Original URL: http://www.theregister.co.uk/2013/04/17/microsoft_two_factor_authentication/

Microsoft joins the two-step verification party

Late convert to dual-protection club

By Jack Clark

Posted in Security, 17th April 2013 18:09 GMT

Microsoft is bringing two-factor authentication to its users' accounts over the next couple of days.

"With this release you can choose to protect your entire account with two-step verification, regardless of what service (or device) you are using with your Microsoft account," Eric Doerr, group program manager for Microsoft accounts, wrote in a blog post. "It's your choice whether you want to enable this, but for those of you that are looking for ways to add additional security to your account, we've worked hard to make set-up really easy."

Microsoft has been bringing two-step verification to some "critical activities" (like editing credit card information or accessing files on another computer through SkyDrive.com) for a year, but now it is making two-step verification optional for all Microsoft accounts. Microsoft accounts provide access to Windows Phone, Xbox, Outlook.com, SkyDrive, Skype, Office365 and, in the Windows 8 era, the operating system itself.

Microsoft has built an Authentication app for Windows Phone, and punters on other platforms are encouraged to download alternate authentication apps. The system has been designed to work even when offline.

Users can either choose to use a one-time password, or simply plug a password in once on devices that they use regularly, though if they don't use the service for 60 days, they'll need to enter a new code.

"If you have an app or device that doesn’t directly support two-step verification (like your Xbox, or setting up email on your smartphone), you can still use two-step verification. For these devices, we’ll help you set up an app password unique to each application or device."

Punters that want to add the two-factor authentication tech to their accounts need to be careful, Doerr cautioned, as "if you know your password but lose access to your secondary security proof, customer support cannot update it for you." Instead, people will have to go through a recovery process that enforces a 30-day wait, which is as good as a death sentence for any business or individual that depends on their Microsoft account.

Users who can't remember their password and have misplaced their authentication device will "not be able to regain access" to their account at all, Microsoft said.

Microsoft is somewhat late to bringing the technology to users: Apple rolled out two-factor authentication to all Apple ID users in March, Google has offered two-step authentication across several of its products for years – the technology came to app customers in late 2010, and Gmail in February, 2011, and cloud storage player Dropbox began offering two-factor authentication for Windows, Mac, and Linux users in August 2012.

Better late than never, we say. ®