4 ms·
I had a gaming-only Microsoft account locked in the same way and I can guarantee you there is no successful credential-stuffing attack against it (even the user
by Nextgrid 4y ago
I had a gaming-only Microsoft account locked in the same way and I can guarantee you there is no successful credential-stuffing attack against it (even the username was secret, as it was random and not used anywhere else).
Locking accounts for "security reasons" and requiring a phone number is a common tactic to harvest phone numbers for "growth & engagement" reasons. Twitter does that since a while ago and recently got caught "accidentally" using those numbers for tracking reasons.
The security argument doesn't make sense because if they don't already have an existing phone number to compare to, they can't authenticate the newly-provided phone number - if the account was actually breached, the attacker will trivially bypass the restriction by just providing a phone number they control and take over the account anyway.
- hn2019 4y agoYeah, allowing someone to enter an arbitrary phone number is actually worse security than sending the confirmation code to the email address associated with the account.
- DarylZero 4y ago>The security argument doesn't make sense because if they don't already have an existing phone number to compare to, they can't authenticate the newly-provided phone number From a security standpoint, the point of requiring a phone number is to increase the expense of the request -- like a captcha. (Not to say that there is a real security purpose in this specific case.)