4 ms·

Try having a kid and segregating funds for them while paying for their Xbox Game Pass and a Minecraft Realm with your account. I have 25 years of Windows softwa

Try having a kid and segregating funds for them while paying for their Xbox Game Pass and a Minecraft Realm with your account. I have 25 years of Windows software development experience and I was almost reduced to tears just trying to understand what I'm even trying to accomplish. Realms is still in some kind of half subscribed, half not subscribed state and it still asks for my account's PIN for purchases but actually only accepts my kid's PIN. And every game warns me that my setup is questionable (store account doesn't match game account) even though it's exactly what Microsoft tells parents to do. Even Microsoft's own Minecraft app complains every 30 days! I suggest this area for any web2 bug bounty hunters looking to make a fortune.

aceazzameen 4y ago
Setting up my kids to play on a realms account is horrid experience! And nevermind explaining how to do it to the parents of my kids' friends. Most of the kids still haven't managed to get on. Also parental controls seems to suck in general on most services. Nintendo Switch seems to get it right for the most part.
LeonB 4y ago
I witnessed an egregious bug once - where logging in with one users name and a different users 2FA let me in. I just looked for my notes on it and can’t find them. I’m happy for you not to take my word on it other than to say — I concur that there are some egregious bugs in this area!
- ryanjshaw 4y ago
  I completely believe you - I have performed this setup twice, on different machines, and in both cases the end result is that it uses the kids PIN to authenticate despite requesting the adult's PIN. I have no idea where to report the issue to (Microsoft store? Minecraft support? Microsoft Windows support?), and having dealt with Microsoft support in a professional capacity I know that even if I do figure out where to report it that they will waste weeks of my time asking me to explain the issue and then claim it's working as designed without understanding the problem at all.
  - ryan29 4y ago
    > result is that it uses the kids PIN to authenticate despite requesting the adult's PIN That's been a thing for a long time. I hit it when trying to share games with child accounts. IIRC, the high level process was: - Set up child computer with a child account. - Add parent account as family member on child computer. - Set up a PIN for the parent account on the child computer. - On the child OS account, open the Windows Store and log in as the parent. - Log back in to the Windows Store using the child account. At that point when the child tries to buy something via the Windows Store it should be asking for the parent's PIN, but accepts the child PIN. As far as I could tell it was authenticating the parent account with the child's PIN. When I ran into the issue, I could buy anything I wanted with the child PIN and it bypassed all restrictions. I was so surprised by the way it worked that I spent an entire afternoon testing it. I got a prepaid credit card, set up fresh MS accounts for the parent + child, set up a clean OS install, and recorded everything using VirtualBox by using the on-screen keyboard to show the PINs. At the time there was a bug in VirtualBox's video recording that caused it to record random garbage and I got so frustrated that I set it aside and never went back to it. It seems like an auth bypass issue to me and it's been a problem for over 7 years. It's been around so long it's even made it's way from an unofficial blog into official MS docs [1]: > As of Dec 25 2015, there seems to be a bug in the Windows Store sign in process as it may ask for your PIN code but it actually wants your family member’s PIN code. That is, at least at the time of this writing, use the PIN of the signed in family member even though it asks for your PIN! 1. https://learn.microsoft.com/en-us/archive/blogs/henrikn/sharing-windows-10-store-apps-with-your-family https://learn.microsoft.com/en-us/archive/blogs/henrikn/shar...
  - LeonB 4y ago
    Ok - that sounds like the exact thing. It was so very odd when it happened. I’m sure I tweeted about it at the time, or put it on mastodon if it was more recent.
- wil421 4y ago
  At one of my jobs Workday had a cookie config that let some security guy change his user ID to the CIO’s user and log in. It was hilarious to watch.
b800h 4y ago
The switch over the Microsoft login for Minecraft was so bad that I just gave up and got the kids using MineTest instead. And MS login for work is a complete shambles. I have to do a tactical login to Outlook with a different work account to switch login when I try to use Azure as that's the only obvious way to move to a different org account. It's horrible.
- tmpz22 4y ago
  I had a pre-alpha (beta?) Minecraft account that I had to give up on due to this.
- geraldwhen 4y ago
  Minecraft is so broken that I’ve removed it from all family devices. I would frequently have to reinstall on PS5 to get it to boot, it would lose purchases constantly, and there is no cross play for mac hilariously because Mac doesn’t have a bedrock port, despite it having “Minecraft for education” which is based on bedrock. Microsoft turned Minecraft into a steaming pile of garbage.
- unyttigfjelltol 4y ago
  I had 2 mojang accounts for my kids, attached to 2 separate Java game licenses (because i couldn't buy 2 licenses for 1 account) used on Linux. When Microsoft forced the authentication conversion, I had to disassociate 1 of the 2 emails from the combined MS account (that I had worked really hard to combine in 2020) reincarnate that email as a separate MS account, associate it with the separate Mojang account (because MS also has no way of supporting 2 licenses on 1 MS account, even if the account listed multiple emails) and then I was promptly banned by Microsoft for breach of TOS, whatever that might have been. 12 hours later and a dozen support contacts to Mojang, I was unbanned... but my kids didn't play Minecraft that day. To any MS/Mojang folks lurking,- great game but the authentication merge was an unforced error.
  - lcampbell 4y ago
    > banned by Microsoft for breach of TOS, whatever that might have been FWIW, I had the same thing happen and found out the ban reason was "fraud (please insert phone number)".
AstixAndBelix 4y ago
Couldn't you buy Microsoft Store gift cards so you can use your kid's account to keep the subscription active while not using your credit card directly?
emeril 4y ago
my general approach to this garbage is to just keep making new accounts/email addresses (on my domain) for each purpose this keeps everything from being comingled at the expense of maintaining all of those credentials also, as a bonus, if you organize this by subdomain you can sort your email by it automatically since most emails from this stuff don't really need to hit your inbox
- throwaway290 4y ago
  Until they ban all of your alts when some obscure ToS sentence about creating multiple accounts starts being enforced (or one of them gets taken over when you don't pay close enough attention) and if you happen to use any of them for anything critical you come to HN complaining how MS just killed your life or business. I truly think that's what happens behind the scenes of half of those cry for help posts
MrPatan 4y ago
When I saw Minecraft for the Nintendo Switch I bought it, thinking it'd be a solution for the MS login madness and my kid could play easily with it. Wrong! It's even worse! You still have to log in with some MS account, but on top it's buggy, slow, laggy, and crashed a few times on me generating the world. What a disaster.
- dismalpedigree 4y ago
  Same story here. Thought it would be great for kids to play. Takes 30 minutes of me screwing with it every time they want to play it. I gave up and put linux on an old laptop and them bought another copy of minecraft for it.
  - throwaway290 4y ago
    You still have to use the official launcher that requires online connection to play the game you own (twice), right?
    - b1ue64 4y ago
      You can still use unofficial launchers, but I wouldn't be surprised if Microsoft removes that too
      - throwaway290 4y ago
        You can't use any unofficial launcher that lets you play the game unless it talks to Microsoft servers about it.

aceazzameen 4y ago

Setting up my kids to play on a realms account is horrid experience! And nevermind explaining how to do it to the parents of my kids' friends. Most of the kids still haven't managed to get on. Also parental controls seems to suck in general on most services. Nintendo Switch seems to get it right for the most part.

LeonB 4y ago

I witnessed an egregious bug once - where logging in with one users name and a different users 2FA let me in. I just looked for my notes on it and can’t find them. I’m happy for you not to take my word on it other than to say — I concur that there are some egregious bugs in this area!

ryanjshaw 4y ago
I completely believe you - I have performed this setup twice, on different machines, and in both cases the end result is that it uses the kids PIN to authenticate despite requesting the adult's PIN. I have no idea where to report the issue to (Microsoft store? Minecraft support? Microsoft Windows support?), and having dealt with Microsoft support in a professional capacity I know that even if I do figure out where to report it that they will waste weeks of my time asking me to explain the issue and then claim it's working as designed without understanding the problem at all.
- ryan29 4y ago
  > result is that it uses the kids PIN to authenticate despite requesting the adult's PIN That's been a thing for a long time. I hit it when trying to share games with child accounts. IIRC, the high level process was: - Set up child computer with a child account. - Add parent account as family member on child computer. - Set up a PIN for the parent account on the child computer. - On the child OS account, open the Windows Store and log in as the parent. - Log back in to the Windows Store using the child account. At that point when the child tries to buy something via the Windows Store it should be asking for the parent's PIN, but accepts the child PIN. As far as I could tell it was authenticating the parent account with the child's PIN. When I ran into the issue, I could buy anything I wanted with the child PIN and it bypassed all restrictions. I was so surprised by the way it worked that I spent an entire afternoon testing it. I got a prepaid credit card, set up fresh MS accounts for the parent + child, set up a clean OS install, and recorded everything using VirtualBox by using the on-screen keyboard to show the PINs. At the time there was a bug in VirtualBox's video recording that caused it to record random garbage and I got so frustrated that I set it aside and never went back to it. It seems like an auth bypass issue to me and it's been a problem for over 7 years. It's been around so long it's even made it's way from an unofficial blog into official MS docs [1]: > As of Dec 25 2015, there seems to be a bug in the Windows Store sign in process as it may ask for your PIN code but it actually wants your family member’s PIN code. That is, at least at the time of this writing, use the PIN of the signed in family member even though it asks for your PIN! 1. https://learn.microsoft.com/en-us/archive/blogs/henrikn/sharing-windows-10-store-apps-with-your-family https://learn.microsoft.com/en-us/archive/blogs/henrikn/shar...
- LeonB 4y ago
  Ok - that sounds like the exact thing. It was so very odd when it happened. I’m sure I tweeted about it at the time, or put it on mastodon if it was more recent.
wil421 4y ago
At one of my jobs Workday had a cookie config that let some security guy change his user ID to the CIO’s user and log in. It was hilarious to watch.

b800h 4y ago

The switch over the Microsoft login for Minecraft was so bad that I just gave up and got the kids using MineTest instead. And MS login for work is a complete shambles. I have to do a tactical login to Outlook with a different work account to switch login when I try to use Azure as that's the only obvious way to move to a different org account. It's horrible.

tmpz22 4y ago
I had a pre-alpha (beta?) Minecraft account that I had to give up on due to this.
geraldwhen 4y ago
Minecraft is so broken that I’ve removed it from all family devices. I would frequently have to reinstall on PS5 to get it to boot, it would lose purchases constantly, and there is no cross play for mac hilariously because Mac doesn’t have a bedrock port, despite it having “Minecraft for education” which is based on bedrock. Microsoft turned Minecraft into a steaming pile of garbage.
unyttigfjelltol 4y ago
I had 2 mojang accounts for my kids, attached to 2 separate Java game licenses (because i couldn't buy 2 licenses for 1 account) used on Linux. When Microsoft forced the authentication conversion, I had to disassociate 1 of the 2 emails from the combined MS account (that I had worked really hard to combine in 2020) reincarnate that email as a separate MS account, associate it with the separate Mojang account (because MS also has no way of supporting 2 licenses on 1 MS account, even if the account listed multiple emails) and then I was promptly banned by Microsoft for breach of TOS, whatever that might have been. 12 hours later and a dozen support contacts to Mojang, I was unbanned... but my kids didn't play Minecraft that day. To any MS/Mojang folks lurking,- great game but the authentication merge was an unforced error.
- lcampbell 4y ago
  > banned by Microsoft for breach of TOS, whatever that might have been FWIW, I had the same thing happen and found out the ban reason was "fraud (please insert phone number)".

AstixAndBelix 4y ago

Couldn't you buy Microsoft Store gift cards so you can use your kid's account to keep the subscription active while not using your credit card directly?

emeril 4y ago

my general approach to this garbage is to just keep making new accounts/email addresses (on my domain) for each purpose this keeps everything from being comingled at the expense of maintaining all of those credentials also, as a bonus, if you organize this by subdomain you can sort your email by it automatically since most emails from this stuff don't really need to hit your inbox

throwaway290 4y ago
Until they ban all of your alts when some obscure ToS sentence about creating multiple accounts starts being enforced (or one of them gets taken over when you don't pay close enough attention) and if you happen to use any of them for anything critical you come to HN complaining how MS just killed your life or business. I truly think that's what happens behind the scenes of half of those cry for help posts

MrPatan 4y ago

When I saw Minecraft for the Nintendo Switch I bought it, thinking it'd be a solution for the MS login madness and my kid could play easily with it. Wrong! It's even worse! You still have to log in with some MS account, but on top it's buggy, slow, laggy, and crashed a few times on me generating the world. What a disaster.

dismalpedigree 4y ago
Same story here. Thought it would be great for kids to play. Takes 30 minutes of me screwing with it every time they want to play it. I gave up and put linux on an old laptop and them bought another copy of minecraft for it.
- throwaway290 4y ago
  You still have to use the official launcher that requires online connection to play the game you own (twice), right?
  - b1ue64 4y ago
    You can still use unofficial launchers, but I wouldn't be surprised if Microsoft removes that too
    - throwaway290 4y ago
      You can't use any unofficial launcher that lets you play the game unless it talks to Microsoft servers about it.