4 ms·

It's possible that the TOS message is boilerplate that they put up when they haven't created (and localized) an appropriate message for the real reason (or they

by jp57 4y ago

It's possible that the TOS message is boilerplate that they put up when they haven't created (and localized) an appropriate message for the real reason (or they don't want to reveal the real reason). To me it sounds like maybe they detected a successful credential stuffing attack against the accounts and locked them. That said, it sounds like their recovery process leaves a lot to be desired.

Nextgrid 4y ago
I had a gaming-only Microsoft account locked in the same way and I can guarantee you there is no successful credential-stuffing attack against it (even the username was secret, as it was random and not used anywhere else). Locking accounts for "security reasons" and requiring a phone number is a common tactic to harvest phone numbers for "growth & engagement" reasons. Twitter does that since a while ago and recently got caught "accidentally" using those numbers for tracking reasons. The security argument doesn't make sense because if they don't already have an existing phone number to compare to, they can't authenticate the newly-provided phone number - if the account was actually breached, the attacker will trivially bypass the restriction by just providing a phone number they control and take over the account anyway.
- hn2019 4y ago
  Yeah, allowing someone to enter an arbitrary phone number is actually worse security than sending the confirmation code to the email address associated with the account.
- DarylZero 4y ago
  >The security argument doesn't make sense because if they don't already have an existing phone number to compare to, they can't authenticate the newly-provided phone number From a security standpoint, the point of requiring a phone number is to increase the expense of the request -- like a captcha. (Not to say that there is a real security purpose in this specific case.)
shkkmo 4y ago
This is not a triggered action as Microsoft locks the account immediately and reliably. This isn't a recovery process as Microsft doesn't ask you to reset credentials and claims to not keep the phone number associated with the account. This is some sort of incredibily user hostile anti bot technique.
codedokode 4y ago
> they detected a successful credential stuffing attack against the accounts and locked them And how providing a phone number can help Microsoft to distinguish a real owner from an attacker?

by jp57 4y ago

Nextgrid 4y ago

I had a gaming-only Microsoft account locked in the same way and I can guarantee you there is no successful credential-stuffing attack against it (even the username was secret, as it was random and not used anywhere else). Locking accounts for "security reasons" and requiring a phone number is a common tactic to harvest phone numbers for "growth & engagement" reasons. Twitter does that since a while ago and recently got caught "accidentally" using those numbers for tracking reasons. The security argument doesn't make sense because if they don't already have an existing phone number to compare to, they can't authenticate the newly-provided phone number - if the account was actually breached, the attacker will trivially bypass the restriction by just providing a phone number they control and take over the account anyway.

hn2019 4y ago
Yeah, allowing someone to enter an arbitrary phone number is actually worse security than sending the confirmation code to the email address associated with the account.
DarylZero 4y ago
>The security argument doesn't make sense because if they don't already have an existing phone number to compare to, they can't authenticate the newly-provided phone number From a security standpoint, the point of requiring a phone number is to increase the expense of the request -- like a captcha. (Not to say that there is a real security purpose in this specific case.)

shkkmo 4y ago

This is not a triggered action as Microsoft locks the account immediately and reliably. This isn't a recovery process as Microsft doesn't ask you to reset credentials and claims to not keep the phone number associated with the account. This is some sort of incredibily user hostile anti bot technique.

codedokode 4y ago

> they detected a successful credential stuffing attack against the accounts and locked them And how providing a phone number can help Microsoft to distinguish a real owner from an attacker?