Solved Why is MS all of a Sudden requiring to have an Alternate email address?

jimbo45 said:

Some of this security just gets too much these days for ordinary home machines e.g rediculous multi request for confirmation via codes that are sent to phones etc (and never arrive) when you do online shopping etc -- It's bonkers, annoying etc -- When security gets this rediculous people just try and avoid the whole thing -- in any case who these days keeps any sort of sizeable sum of money in a current bank account now -- I can understand this for businesses etc but home users ??? .

What's 99% worse is the nonsense of dealing with customer services when you always seem to have to phone (usually to some horrible call centre) -after say getting an email -- but you can never reply to these emails by email -- and people are against all sensible advice given on the planet by nearly every financial regulatory body on Earth in democratic countries forced into making financial arrangements over the phone -- BONKERS !!!!!!!.

I'm sure people these days with so many subscriptions / other regular payments etc may have missed one or two and got the email - please contact xxxx to "regularise" the account - but NO WAY to arrange this other than by phone !!!!!.

Cheers
jimbo

Click to expand...

Lol, we are taking care of my wife's parents who both have dementia and it's been a royal pain in the ass trying to do anything and everything online with them. I understand the need for the security, but when you have to work around it to go to benefits and such....WOW is it a PITA.

win11freak said:

This is NONSENSE as Email Verification codes are not secure

Click to expand...

Email verification is the most secure way. Authenticator codes can be easily stolen, they repeat.
Passkey is like 1.5FA, once the device is verified, the session can be stolen and you will never know.

win11freak said:

Can I just create a temporary throw away alternate email account just to continue with the setup and then after that delete the throw away email account?

Click to expand...

I use Yahoo with a different userID. Yahoo accumulates mostly trash and spam

Edwin said:

Idiots!!!

Click to expand...

No just average people who are not tech-obsessed like the people here.

win11freak said:

Can I just create a temporary throw away alternate email account just to continue with the setup and then after that delete the throw away email account?

Click to expand...

Yes, but everyone should really have at least two emails accounts these days anyway. One for real legit mail, and one for situations like Microsoft is wanting.

A recovery system is needed, and non tech savvy people wont be in to using authenticator apps, so it be sms, phone or email for them.

What's the problem with SMS? I mean the direct phrase that describes the problem, not a web page with thousands of encyclopedias around inside... :)

Should the security email address be from a different domain? The most frequent "MS account lost" event I've seen is b/c the email address has been discontinued, and the codes are sent to an address that doesn't exist. Normally the full domain is discontinued in a bussiness-related decision. The phone number is a lot more permanent so it's a good idea that the backup is your phone number. I cannot catch nor imagine why it's insecure now. Everything is insecure if the attacker is determined enough, but not everyone can mount a CIA/Mossad/etc level security at home.

My older email accounts were discontinued time ago. I was notified in advance. I'm "tech-savvy", but I had to recover one of the accounts with an "out of band" method. The problem was I didn't learn in time that I had to change both the primary alias and the security address independently. They both were set at the same time when I did my accounts (in years like 2010 and 2023), but I didn't know the detail I was actually filling TWO fields of data, with the same data but two fields.

My "out of band method": I accessed the account from a Windows 7 system owned by me (likely 7 8 10 or 11 doesn't matter) that had it set as the account of Edge (in 10 or 11, this is your Windows MS Account unless you've bothered to set it different). It's a reasonable level of authentication. When accessed from this system, I wasn't asked the codes and I could change my security address (the old and non-existent email address) with my ordinary primary alias (already replaced with my new address) and my ordinary password.

Standard SMS protocol is very easy to intercept and "decrypt".

SlicEnDicE said:

Standard SMS protocol is very easy to intercept and "decrypt".

Click to expand...

It is vulnerable for decades (SS7), yet some banks still use it, because of elderly. I always prefer secure 2FA email over it.
Many scammers these days even clone SIM and use it for scam calls, there is no known protection, except using eSIM.

SlicEnDicE said:

Standard SMS protocol is very easy to intercept and "decrypt".

Click to expand...

Thanks :) .

I don't have good arguments against, and I know SMSs are very old (and maybe initially conceived for a "hello how are you" not for a "the strongbox combination is xx-yy-zz"), I should know many more details I suppose ([kidding] SHA 0.000000000000001? [/kidding]). Only I see many important senders trusting these codes, I've never been asked a code (sent by SMS) longer or shorter than 6 digits or an alphanumeric one of any length, sounds to standard. Since months ago, my phone does additional authentication of important senders, like "qwerti banq" instead of "qwerty bank", and I've understood that there's more authentication than just the sender's name, maybe a [kidding]SHA 10^500[/kidding] and in any case you cannot invent a "shivcuh bank" that doesn't exist or hasn't been enrolled in this system. This alone doesn't affect a virus decrypting SMSs, but if they have reinforced the identity they should have done something about the contents...

The Finnish Police force once made a recruitment post on X (old Twitter) for the cyber criminal education department . The message was fully encoded in GSM-7.

I thought about the random characters on my screen for a while, until I figured out what it was all about and responded back with a similarily encoded message stating "Thank you for asking, but this time I have to decline the offer".

JLArranz said:

What's the problem with SMS?

Click to expand...

People can often port your phone number to their own SIM card, making SMS verification codes go to them instead of you. Granted, this is due to slackness on the phone company's part, because they're meant to fully ID you before porting, but some only ask for your name and date of birth to port.

TairikuOkami said:

It is vulnerable for decades (SS7), yet some banks still use it, because of elderly.

Click to expand...

elderly ???

BarryGuff said:

People can often port your phone number to their own SIM card, making SMS verification codes go to them instead of you. Granted, this is due to slackness on the phone company's part, because they're meant to fully ID you before porting, but some only ask for your name and date of birth to port.

Click to expand...

Not only that, but since the telcos 'recycle' phone numbers you can end up with someone's 'old' number and if they haven't updated their number on various social media and government, etc. websites before changing numbers the new owner of the number ends up getting the 2FA codes.

A perfect example is myself - I got a 'new' mobile number from a different telco a year ago and within an hour of putting the SIM in the phone and turning it on I discovered the number used to belong to someone in Victoria on the other side of Australia from me.

I've had 2FA codes meant for the previous owner from VicRoads (twice), Facebook and Snapchat. I was waiting for a text message asking me if I had her codes but she is obviously too smart to fall for that because I would have replied and said "Sure, here's your code and, by the way, is this your new number"? which I would have helpfully provided to anyone who called or sent me a text looking for her from then on. Including the debt collectors who are now trying to track her down regarding several debts. Which explains why she dropped the number in a hurry and didn't update it on all these websites.

She didn't even tell her own mother that she'd changed her number because I received a Happy Birthday text on March 1st.