Feeds

Microsoft joins the two-step verification party

Late convert to dual-protection club

Internet Security Threat Report 2014

Microsoft is bringing two-factor authentication to its users' accounts over the next couple of days.

"With this release you can choose to protect your entire account with two-step verification, regardless of what service (or device) you are using with your Microsoft account," Eric Doerr, group program manager for Microsoft accounts, wrote in a blog post. "It's your choice whether you want to enable this, but for those of you that are looking for ways to add additional security to your account, we've worked hard to make set-up really easy."

Microsoft has been bringing two-step verification to some "critical activities" (like editing credit card information or accessing files on another computer through SkyDrive.com) for a year, but now it is making two-step verification optional for all Microsoft accounts. Microsoft accounts provide access to Windows Phone, Xbox, Outlook.com, SkyDrive, Skype, Office365 and, in the Windows 8 era, the operating system itself.

Microsoft has built an Authentication app for Windows Phone, and punters on other platforms are encouraged to download alternate authentication apps. The system has been designed to work even when offline.

Users can either choose to use a one-time password, or simply plug a password in once on devices that they use regularly, though if they don't use the service for 60 days, they'll need to enter a new code.

"If you have an app or device that doesn’t directly support two-step verification (like your Xbox, or setting up email on your smartphone), you can still use two-step verification. For these devices, we’ll help you set up an app password unique to each application or device."

Punters that want to add the two-factor authentication tech to their accounts need to be careful, Doerr cautioned, as "if you know your password but lose access to your secondary security proof, customer support cannot update it for you." Instead, people will have to go through a recovery process that enforces a 30-day wait, which is as good as a death sentence for any business or individual that depends on their Microsoft account.

Users who can't remember their password and have misplaced their authentication device will "not be able to regain access" to their account at all, Microsoft said.

Microsoft is somewhat late to bringing the technology to users: Apple rolled out two-factor authentication to all Apple ID users in March, Google has offered two-step authentication across several of its products for years – the technology came to app customers in late 2010, and Gmail in February, 2011, and cloud storage player Dropbox began offering two-factor authentication for Windows, Mac, and Linux users in August 2012.

Better late than never, we say. ®

Internet Security Threat Report 2014

More from The Register

next story
George Clooney, WikiLeaks' lawyer wife hand out burner phones to wedding guests
Day 4: 'News'-papers STILL rammed with Clooney nuptials
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.