Feeds

Microsoft joins the two-step verification party

Late convert to dual-protection club

Top 5 reasons to deploy VMware with Tegile

Microsoft is bringing two-factor authentication to its users' accounts over the next couple of days.

"With this release you can choose to protect your entire account with two-step verification, regardless of what service (or device) you are using with your Microsoft account," Eric Doerr, group program manager for Microsoft accounts, wrote in a blog post. "It's your choice whether you want to enable this, but for those of you that are looking for ways to add additional security to your account, we've worked hard to make set-up really easy."

Microsoft has been bringing two-step verification to some "critical activities" (like editing credit card information or accessing files on another computer through SkyDrive.com) for a year, but now it is making two-step verification optional for all Microsoft accounts. Microsoft accounts provide access to Windows Phone, Xbox, Outlook.com, SkyDrive, Skype, Office365 and, in the Windows 8 era, the operating system itself.

Microsoft has built an Authentication app for Windows Phone, and punters on other platforms are encouraged to download alternate authentication apps. The system has been designed to work even when offline.

Users can either choose to use a one-time password, or simply plug a password in once on devices that they use regularly, though if they don't use the service for 60 days, they'll need to enter a new code.

"If you have an app or device that doesn’t directly support two-step verification (like your Xbox, or setting up email on your smartphone), you can still use two-step verification. For these devices, we’ll help you set up an app password unique to each application or device."

Punters that want to add the two-factor authentication tech to their accounts need to be careful, Doerr cautioned, as "if you know your password but lose access to your secondary security proof, customer support cannot update it for you." Instead, people will have to go through a recovery process that enforces a 30-day wait, which is as good as a death sentence for any business or individual that depends on their Microsoft account.

Users who can't remember their password and have misplaced their authentication device will "not be able to regain access" to their account at all, Microsoft said.

Microsoft is somewhat late to bringing the technology to users: Apple rolled out two-factor authentication to all Apple ID users in March, Google has offered two-step authentication across several of its products for years – the technology came to app customers in late 2010, and Gmail in February, 2011, and cloud storage player Dropbox began offering two-factor authentication for Windows, Mac, and Linux users in August 2012.

Better late than never, we say. ®

Beginner's guide to SSL certificates

More from The Register

next story
UK smart meters arrive in 2020. Hackers have ALREADY found a flaw
Energy summit bods warned of free energy bonanza
DRUPAL-OPCALYPSE! Devs say best assume your CMS is owned
SQLi hole was hit hard, fast, and before most admins knew it needed patching
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Mozilla releases geolocating WiFi sniffer for Android
As if the civilians who never change access point passwords will ever opt out of this one
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Simplify SSL certificate management across the enterprise
Simple steps to take control of SSL across the enterprise, and recommendations for a management platform for full visibility and single-point of control for these Certificates.