Solved MS asking for cell phone number

Well, it is easy to belittle Facebook, Yahoo, etc. Most of our 100+ online accounts to whom we have disclosed our credit cards etc are a lot less secure than that. And the obvious advice is to disclose only on a need-to-know basis etc

Looking beyond Captain Obvious ...

Haydon said:

Well, it is easy to belittle Facebook, Yahoo, etc. Most of our 100+ online accounts to whom we have disclosed our credit cards etc are a lot less secure than that. And the obvious advice is to disclose only on a need-to-know basis etc

Looking beyond Captain Obvious ...

Click to expand...

Life is about living. If I worried about everything I'd never do anything. Yes we all want to feel safe, but sometimes things happen.

Sticking to the thread title, the information requested by Microsoft is already out in the wild, yet but because "Microsoft" is asking for it, all of a sudden "privacy concerns" arise.... even though the information requested IS to help you protect your privacy (data)!!!

Looking beyond the unreasonable....

Most just want your device info..., they could care less about your security!

Edwin said:

Most just want your device info..., they could care less about your security!

Click to expand...

Oh, the contrary post for nothing more than being contrary!

Dru2 said:

Oh, the contrary post for nothing more than being contrary!

Click to expand...

Ummm..., yeah, pretty much!
I might as well go stand in the corner again!

:)

johnlgalt said:

I believe you have to go to your Microsoft account to alter those settings for 2 factor authentication.

Click to expand...

I haven't been to my MS account in 5 yrs - not sure it is still there.

gewb said:

I haven't been to my MS account in 5 yrs - not sure it is still there.

Click to expand...

How to use two-step verification with your Microsoft account

Dru2 said:

How to use two-step verification with your Microsoft account

Click to expand...

Thanks but no thanks. I will not log into a microsoft account. So far Win10 doesn't require it and Win11 will not run on my current hardware so I should be safe for a few years.

I don't recall ever being asked for my cell. Perhaps I didn't select for it to use two-factor identification.

Dru2 said:

Life is about living. If I worried about everything I'd never do anything. Yes we all want to feel safe, but sometimes things happen.

Sticking to the thread title, the information requested by Microsoft is already out in the wild, yet but because "Microsoft" is asking for it, all of a sudden "privacy concerns" arise.... even though the information requested IS to help you protect your privacy (data)!!!

Looking beyond the unreasonable....

Click to expand...

Sure, life is about living, but you completely missed my two points. The first point is security on the consumers' side of things (including 2FA) The second point is security on the merchants' side of things. BOTH sides have to hold for on-line security. It is thus NOT a case of looking beyond the unreasonable, but a case of looking both ways.

The merchants' side of things is also lacking. For example, the reason for the often given advice to use unique passwords for each merchant and not to re-use passwords, stems from this lack of security on the merchants' side of things. But as I said earlier, there is only so much that the consumer can do ...

Haydon said:

Sure, life is about living, but you completely missed my two points. The first point is security on the consumers' side of things (including 2FA) The second point is security on the merchants' side of things. BOTH sides have to hold for on-line security. It is thus NOT a case of looking beyond the unreasonable, but a case of looking both ways.

Click to expand...

Based on your replay it's clearly you who is missing "my" point. And you didn't say anything I don't understand and isn't part of my thought process. And if you claim to believe what you stated above you'd also know the greatest threat (and weakest link) to security is the end user!

And this is.... curious at best....

The merchants' side of things is also lacking. For example, the reason for the often given advice to use unique passwords for each merchant and not to re-use passwords, stems from this lack of security on the merchants' side of things. But as I said earlier, there is only so much that the consumer can do ...

Click to expand...

Yeah, cause I want one password for all my accounts so that if it gets compromised all my accounts are at risk not just one.

Yes, it would be nice to have a universal password for everything but we aren't there yet. And that's not because of a merchant's lack of security.

The right here and now fact of the matter is there are things out there that can be done to enforce/enhance security, but people rather complain (as exampled by some here), then comply to help their own cause.

You can have all the security in the world, but if the end user refuses to use it (based on some false notions), well... Your data. Your PC. Your choice.

Peace

jvickers said:

I don't recall ever being asked for my cell. Perhaps I didn't select for it to use two-factor identification.

Click to expand...

I think it happened here because this use did not have 2FA enabled, and Windows 11 is attempting to get the user to start using it. If you've already enabled it, then Microsoft will use whatever you've already set up.

As with me - I have been using it for a while now, using the Microsoft Authenticator app on Android, and it simply redirects me to the app to authenticate that I'm actually trying to log in - even when I've just cleanly installed Windows on my machine / in a VM. I've never been asked about using my cell number because I already have alternatives set up.

Dru2 said:

And if you claim to believe what you stated above you'd also know the greatest threat (and weakest link) to security is the end user!

Click to expand...

Gee, if you have read any of my posts at all, I have written several times myself that the human is the most vulnerable variable in on-line security.

Dru2 said:

Yes, it would be nice to have a universal password for everything but we aren't there yet.

Click to expand...

I did not advocate for a universal password at all, my point was that even if the consumer did everything right, there is still the merchant's vulnerability.

You still miss my 2 points that there are vulnerabilities on BOTH sides.

Let's move on.

johnlgalt said:

I think it happened here because this use did not have 2FA enabled, and Windows 11 is attempting to get the user to start using it. If you've already enabled it, then Microsoft will use whatever you've already set up.

Click to expand...

It could be because Microsoft is insisting users of Windows 11 use a Microsoft Account, and thus in setting up a Microsoft Account, the account may have "suggested" a phone number. I say "suggested" because there is "no requirement" to provide a phone number. The only thing you need is an email address. So again, I'm baffled about all the vitriol over something that's NOT even required

Additionally, you don't even need to provide a phone number for 2FA if you're using the Authenticator app...

What you'll need for set up

Two-step verification begins with an email address (we recommend two different email addresses, the one you normally use, and one as a backup just in case), a phone number, or an authenticator app. When you sign in on a new device or from a new location, we'll send you a security code to enter on the sign-in page. For more info about the authenticator app, see How to use the Microsoft Authenticator app.

Click to expand...

Source: How to use two-step verification with your Microsoft account

Note the requirement says either the Authenticator app OR a phone number (for those fearful of proving a phone number). Those using the phone instead of the app would get their authentication codes texted to them. That's the reason for the phone number

As with me - I have been using it for a while now, using the Microsoft Authenticator app on Android, and it simply redirects me to the app to authenticate that I'm actually trying to log in - even when I've just cleanly installed Windows on my machine / in a VM. I've never been asked about using my cell number because I already have alternatives set up.

Click to expand...

I'm also using Microsoft's Authenticator on my phone as well. Makes authenticating stuff a breeze

Haydon said:

Let's move on.

Click to expand...

Agree (between us)

Dru2 said:

So again, I'm baffled about all the vitriol over something that's NOT even required

Click to expand...

Because people see what they want to see, and fill in the blanks to their own musings / questions.

After all, what is not required today may become required tomorrow.

Example - Windows 10 supports, but does not require, TPM 1.3 minimum (2.0 recommended). Windows 11 does. So, people see a simple request to make your logins more secure and think "OMG, I'm never going to be able to use another Microsoft product again unless I give them my phone number!"

It's akin to "The sky is falling!" Nothing more.

You, and I, and several others have explained, and at length, why multi-factor authentication is a good, necessary thing, even using examples from our own experiences as to what happens when it is not used on an account. And yet there are posters in this thread who think they don't need it, or else flat out stubbornly refuse to use it, all because they think it is a privacy issue, instead of understanding that it is a security issue.

In old days, doorknobs didn't even have locks. Then times progressed and doorknobs started coming with locks integrated. Then times progressed more, and now, at least here in the US, modern exterior doors are fitted with both a doorknob with an integrated lock and a deadbolt. Because, security. Not because manufacturers want to make more money off you, not because of them attempting to garner additional information that will attempt to gather data on you - but because of security, plain and simple.

So, we went from one layer of security (door with doorknob with no lock) to 2 layers of security (doorknob with lock) to 3 layers of security (door, doorknob with lock, and deadbolt).

It's a very similar thing when it comes to logins online. Nothing more.

I think that it is important to note that 2FA practically necessitates not just 1 but 2 phone numbers, default and recovery. At least that's what I always do to minimize chances of a lock out. If recovery is not given as an option (either 2nd phone or some other reliable recovery option) then don't open the on-line account in the first place, look for alternatives.

Generally speaking, the more secure, the more hassle it causes to recover from a failure, and reliable recovery becomes essential. Edit: I hope this statement is not misinterpreted as me being against more security, LOL

BunnyJ said:

It's not about hiding something. It's unnecessary to have my or anyone's phone number. What I did was to set up a Google voice account so I could get a text sent to me without using my real cell number.

I don't buy the 'if you have nothing to hide' line. We are still allowed to have some sort of privacy.

Click to expand...

For now, check out what's happening in Australia.

TheOldMarine said:

For now, check out what's happening in Australia.

Click to expand...

Yes, it's pretty bad. 1984 is here. A bad law that I can see could be abused.