3 ms·
This reminds me of a rather interesting design decision I encountered with Windows Phone this summer. I'm still undecided as to whether it is a good design or n
by rlu 13y ago
This reminds me of a rather interesting design decision I encountered with Windows Phone this summer. I'm still undecided as to whether it is a good design or not.
So, over the summer I was traveling through Europe and lost my phone in Italy. I have two factor authentication on for my Microsoft account so this was somewhat of a problem seeing as every way to authenticate myself was with the phone (text, email, auth/code app).
Then I remembered I could go online and locate my phone through some web-app on windowsphone.com. This seemed like a terrific idea. So I went there, and, unsurprisingly but disappointingly, was unable to login because that app was not excluded from two factor authentication.
It was extremely frustrating to say the least.
- srathi 13y agoGoogle gives 10 emergency codes that you can keep in your wallet and use them to access your account in these kind of situations. Does Microsoft have a similar feature?
- rlu 13y agoNot that I know of. The real culprit of my misfortune though was that my trusted devices (which wouldn't require 2nd auth) got erased because when I got asked to do two factor authentication in the hostel's computer I clicked on the "I don't have access to my phone anymore" link (seemed very fitting!) which then let me change my verification options (e.g. add a 2nd email address that they can send a link to, rather than have them text me a code). This got me into a weird state (which I think they told me ahead of time but I went through it anyways) where it takes 30 days for these new verification options to override the old ones. You can of course cancel this - provided that you have access to your old verification options (i.e. phone in my case) :) That's a good design for sure (prevents a hacker from changing verification options without me noticing). However, what is a terrible design, and I don't know if it's a bug or not, is that when you change these verification options it also decides to erase every single one of your already trusted devices. This meant that now, instead of only being unable to login to anything on random computers (e.g. hostels) I was unable to use any of the MS services on my Surface which I had brought on the trip. Thank goodness that this happened near the end of the trip and not the beginning. I was only left without email, skydrive etc. for ~2 weeks.
- cocoflunchy 13y agoI disabled 2-factor auth on my Google account for the same reason: the only time I need to use it is when I'm not using my computer because I'm on vacation somewhere remote, and most of the time I don't have access to the network on my phone or I don't have any battery left...