Feeds

Microsoft joins the two-step verification party

Late convert to dual-protection club

Security for virtualized datacentres

Microsoft is bringing two-factor authentication to its users' accounts over the next couple of days.

"With this release you can choose to protect your entire account with two-step verification, regardless of what service (or device) you are using with your Microsoft account," Eric Doerr, group program manager for Microsoft accounts, wrote in a blog post. "It's your choice whether you want to enable this, but for those of you that are looking for ways to add additional security to your account, we've worked hard to make set-up really easy."

Microsoft has been bringing two-step verification to some "critical activities" (like editing credit card information or accessing files on another computer through SkyDrive.com) for a year, but now it is making two-step verification optional for all Microsoft accounts. Microsoft accounts provide access to Windows Phone, Xbox, Outlook.com, SkyDrive, Skype, Office365 and, in the Windows 8 era, the operating system itself.

Microsoft has built an Authentication app for Windows Phone, and punters on other platforms are encouraged to download alternate authentication apps. The system has been designed to work even when offline.

Users can either choose to use a one-time password, or simply plug a password in once on devices that they use regularly, though if they don't use the service for 60 days, they'll need to enter a new code.

"If you have an app or device that doesn’t directly support two-step verification (like your Xbox, or setting up email on your smartphone), you can still use two-step verification. For these devices, we’ll help you set up an app password unique to each application or device."

Punters that want to add the two-factor authentication tech to their accounts need to be careful, Doerr cautioned, as "if you know your password but lose access to your secondary security proof, customer support cannot update it for you." Instead, people will have to go through a recovery process that enforces a 30-day wait, which is as good as a death sentence for any business or individual that depends on their Microsoft account.

Users who can't remember their password and have misplaced their authentication device will "not be able to regain access" to their account at all, Microsoft said.

Microsoft is somewhat late to bringing the technology to users: Apple rolled out two-factor authentication to all Apple ID users in March, Google has offered two-step authentication across several of its products for years – the technology came to app customers in late 2010, and Gmail in February, 2011, and cloud storage player Dropbox began offering two-factor authentication for Windows, Mac, and Linux users in August 2012.

Better late than never, we say. ®

Beginner's guide to SSL certificates

More from The Register

next story
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Edward who? GCHQ boss dodges Snowden topic during last speech
UK spies would rather 'walk' than do 'mass surveillance'
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
NOT OK GOOGLE: Android images can conceal code
It's been fixed, but hordes won't have applied the upgrade
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.