> ...and from what I can tell, their online account security is craptastic.

I'm not convinced that their offline security is good, either.

I sometimes will pick up my Surface Pro 4 and disconnect it from the charger. Disconnecting from the charger usually (but not always...not sure what determines it) wakes it. It then turns on their equivalent of Apple's Face ID, and tries to log in.

Sometimes I don't actually want that yet, as I just picked it up to take it somewhere else. So I'll hit the power button to put it back to sleep. The screen blanks...and then sometimes it quickly comes back, logged in.

The thing is I've sometimes had it do this when I've been careful to have my face out of view, holding it so I can only barely see the screen around the edge to see if disconnecting power will wake it up and I'll need to hit power to put it back to sleep.

This doesn't happen all the time, but it has happened several times, leading me to wonder if there is some sort of glitch if you interrupt a face-based login attempt at just the right time via the power button causing it to think it logged in.

Anyone else seen this?

Happened to me all the time when I used SP4. However, biometrics can be disabled through settings or group policy!

Face logon takes some seconds to initialize, and if you interrupt it it gets confused. But the solution to your issue is to have the type cover closed when you unplug it.

That is hardly a solution to a security issue. I can't ensure the burglar keeps the cover closed

The burglar won't have your face?

I’m a sensitive location.

That's why I gave it back after a week. That and updates.

> I'm not convinced that their offline security is good, either.

If they have physical access to the device there isn't much you can do anyway.

You can with encryption and not using face unlock.

As far as I can figure out, you also need to opt for manually unlocking bitlocker via USB key (prone to copy/theft) or via typing in a passphrase (inconvenient) in order to safeguard the encryption key.

Windows will otherwise use hsm to store your key (as evidenced by eg face unlock working) - it's not at all clear how that could possibly be secure if an attacker steals your device?

If the key is in the HSM, then what's protecting your data is the trust in the boot chain not being broken, and the OS login not not being compromised (theoretically).

Booting an alternate OS, or removing the media will result in the HSM not giving up the key, and rendering the drive unusable for all attackers except those able to physically probe the HSM chips and extract keys. (theoretically)

Right. It's not really the hsm itself I worry about (although as we saw with the Xbox hack people are able to do some crazy stuff) , but the possibility of working around/breaking the os login manager - manipulating the camera or hooking up a custom "keyboard" or some such.

For example i have trouble trusting pin login against brute force when the attacker has unrestricted physical access - including the possibility of replacing/manipulating the ram chips etc.

> ...and from what I can tell, their online account security is craptastic.

There's something weird and shady going on: I did created MS account to get this "marvelous" free Windows 10 offer once the update was smuggled on my Windows 7 installation and in subsequent buggy releases I had to reinstall the OS from scratch. So I had to login to activate this thing but I choose to not use the account later switching to local one (I did created an offline one during OOBE) and yet, Windows is still holding credentials to the online account somewhere because Activity section of the MSA Privacy page is still registering OneDrive activity coming from my desktop. I am not logged anywhere in OS, credentials manager is cleared out, OneDrive application is removed but still, it happens.

It seems to me MS customer support is incapable of doing anything meaningful with your account, except making it easier to be hacked via social engineering.

My MS account had my desktop's Win 10 Pro N (the one with less crap) license attached to it. When I bought a new laptop with Win 10 Pro (regular, non-N), my desktop would suddenly claim that its license was invalid. Great. Called support, but nothing they could do except recommending to reinstall Windows. No guarantee the other system would then not go into that "your license is invalid state" if I use the N license again. Solution: Screw them, I'll install kmspico.

I'm probably lucky I use that sh*tshow of an OS only for gaming, and Linux for everything else (including work - we're essentially a Linux company even though most of our customers (embedded devs) still use windows.

>My MS account had my desktop's Win 10 Pro N (the one with less crap)

Not sure what you mean by "less crap". The only advantage of the N versions is that it doesn't have Windows Media Player. You need enterprise to set telemetry level to lowest, and enterprise LTSC to not have Windows store (and a bunch of other UWP apps) installed by default.

The family accounts are crazy anyway. I once worked for an agency that had just bought its first Windows Phone for testing. Setting it up I dutifully signed in with the company’s MS account, but found that I couldn’t install any apps and there were loads of restrictions. It took me multiple hours of debugging to realise that because someone at the past had entered the company’s formation date in the birthdate of the MS account Windows Phone thought I was a child and blocked me from doing a load of the things I needed to do.

That sounds okay for a child though.

Today you still can use and create an offline account. If you’re offline. People here don’t read the original thread.

It's a really nasty dark pattern. Most users won't realise they have to disconnect from the internet to sign up and will fall for Microsoft's trap.

Astonishing story, thanks for sharing. It actually says a lot about their level of customers support and care.

It is a griefers hack. Your son gets denied and basically has to do work, or make a new account.

It's also a "griefer's first social engineering" hack, so it has at least some small "fun" difficulty connected to it. To add a child account when you aren't directly creating the child account on the same device, Microsoft requires an Invite flow that sends an email to the child account asking them to accept "joining the family". So either the griefer also had the password to the account to login to the account on their machine (or otherwise access emails to it) or they somehow social engineered the victim to accepting an invitation to "join them" for something. The griefer can blame the victim for being gullible and claim that it wasn't the griefer's fault the victim fell for it.

Yep, and last I checked (earlier this year I believe), there’s still a 14-character length limit on the MS account password. My bank’s better than that for crying out loud. Forget diceware or any other sane scheme, say hello to random hard-to-type punctuation characters.

And now you’re forced to use that as your computer password too, which you probably have to type multiple times a day.

(Okay, thankfully local account is still possible.)

Are you talking about online microsoft account or something windows specific? Because that's not true, my password has been 40+ characters for a long time and I change it pretty often.

For local login you can use a PIN, or set up windows hello, if you don't want to type in the long password every time.

> Are you talking about online microsoft account or something windows specific?

I'm talking about the Microsoft online account, and I stand by my statement that I was limited to 14 characters until relatively recently (maybe not earlier-this-year recent, that part I'm not sure). Looking at my Microsoft password history, I've changed it five times since 2012 (when I started using a password manager), each one is 14 characters long; the last change was done in 2016. I've been using 32+ character passwords wherever possible since 2012, so the only reason I was using 14 characters for Microsoft was because of the artificial limit imposed on me. And I did check a few times after 2016 to confirm the limit.

Anyway, I just tried to change the password again and this time I was warned that my Microsoft and Skype accounts would be merged if I carried through with the password change, so something did change after I last checked.

> For local login you can use a PIN, or set up windows hello, if you don't want to type in the long password every time.

I'm aware, but I don't consider a PIN secure, and I don't think Windows Hello is an option for most desktop workstations.

I've got more than a passing suspicion the 16 character limitation for Microsoft Accounts was a compatibility need with Windows XP, because the restriction was fixed almost exactly as soon as Windows XP finally hit EOL.

This isn't the case with me. My MS a/c (which is also my Windows login a/c) has a 44 character password.

> last I checked (earlier this year I believe), there’s still a 14-character length limit on the MS account password

It was 16 chars. And it hasn't been true since 2016.

As many people said already you can use longer passwords.

Thanks for that lovely story. It made me laugh at how badly MS is navigating whatever the fuck it is they envision this path they are going down/paving.

However, it did give me a Business Idea; (this is for some hungry 20somethings out there):

Sell a machine image which is basically a windows VM on top of Linux with support, which can handle and navigate all this bullshit that MS is throwing at common users, instead of trying to force the population to become sysads themselves.

Several people here have talked about “hacks” like what happened to ypur son, and I'm of course not saying they're wrong. I don't quite get the idea what it's supposed to get such hackers, though, so I think you shouldn't rule out sheer incompetence: Maybe someone else has a family member with the same or a similar name and was trying to add rhem, and a search threw up your son's name and they added him by mistake?

Shouldn't be able to happen, of course, but given it's Microsoft we're talking about, who would swear it couldn't?

As a sibling comment said, some people are griefers who only seek to inconvenience or otherwise harass others. Particularly with online games.

Especially as a form of revenge. Yeah, it's petty, but it's been my experience that "petty" (and so many other gamers are going to down vote this) describes 90% of gaming cultures.

IIRC this particular family had several thousand children. I don’t think it was a mistake.

I'm almost certain that you were not talking to a real Microsoft employee. Most Fortune 500s have their helpdesks and customer service outsourced to the Tatas and Wipros, Cognizants and HCLs of the world, who may or may not further subcontract the actual bodies filling the roles. Quite frankly, first-level support is useless and ignorant; at best they have scripts for common issues, but to do anything you need to defeat their efforts to no-op and close the ticket, and instead get escalated to a real person with some agency and authority.

If you contact a company through their official channels and they connect to a third party, they get to keep the blame.

Even people who are bad at their jobs are real people. We can’t assume that everyone of low intelligence or motivation is sub human. Just say agency and authority, that made your point.

In the context of their jobs, they are a meat-based chatbot.

This is no reflection on them personally, this is by design of their job role. They have metrics hanging over them to close calls as quickly as possible, without escalating. They are expected to handle dozens or hundreds of calls a day. There is no slack to actually try to resolve the user's problems in any way that requires more creativity than sticking to the SOP script, and moreover, they are usually mandated to stick to a very standardized procedure, with defined suggestions and language that they have to use, in a specific order. A good first-level support person would spoon-feed you the right incantations to get escalated, in a way that their cutthroat metrics aren't negatively impacted.

It's a fucked up system, but this is how call-centers work.

Forget customer service, not even Microsoft's internal IT helpdesk is staffed by FTEs.