Feeds

Microsoft joins the two-step verification party

Late convert to dual-protection club

Securing Web Applications Made Simple and Scalable

Microsoft is bringing two-factor authentication to its users' accounts over the next couple of days.

"With this release you can choose to protect your entire account with two-step verification, regardless of what service (or device) you are using with your Microsoft account," Eric Doerr, group program manager for Microsoft accounts, wrote in a blog post. "It's your choice whether you want to enable this, but for those of you that are looking for ways to add additional security to your account, we've worked hard to make set-up really easy."

Microsoft has been bringing two-step verification to some "critical activities" (like editing credit card information or accessing files on another computer through SkyDrive.com) for a year, but now it is making two-step verification optional for all Microsoft accounts. Microsoft accounts provide access to Windows Phone, Xbox, Outlook.com, SkyDrive, Skype, Office365 and, in the Windows 8 era, the operating system itself.

Microsoft has built an Authentication app for Windows Phone, and punters on other platforms are encouraged to download alternate authentication apps. The system has been designed to work even when offline.

Users can either choose to use a one-time password, or simply plug a password in once on devices that they use regularly, though if they don't use the service for 60 days, they'll need to enter a new code.

"If you have an app or device that doesn’t directly support two-step verification (like your Xbox, or setting up email on your smartphone), you can still use two-step verification. For these devices, we’ll help you set up an app password unique to each application or device."

Punters that want to add the two-factor authentication tech to their accounts need to be careful, Doerr cautioned, as "if you know your password but lose access to your secondary security proof, customer support cannot update it for you." Instead, people will have to go through a recovery process that enforces a 30-day wait, which is as good as a death sentence for any business or individual that depends on their Microsoft account.

Users who can't remember their password and have misplaced their authentication device will "not be able to regain access" to their account at all, Microsoft said.

Microsoft is somewhat late to bringing the technology to users: Apple rolled out two-factor authentication to all Apple ID users in March, Google has offered two-step authentication across several of its products for years – the technology came to app customers in late 2010, and Gmail in February, 2011, and cloud storage player Dropbox began offering two-factor authentication for Windows, Mac, and Linux users in August 2012.

Better late than never, we say. ®

The smart choice: opportunity from uncertainty

More from The Register

next story
BMW's ConnectedDrive falls over, bosses blame upgrade snafu
Traffic flows up 20% as motorway middle lanes miraculously unclog
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.