Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Live Account Credentials Leaking from Windows 8 and Above

hackaday.com

Post reply on HN
Print view View original

31–40 of 144 posts

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#31

Post by Sylos »

cylo wrote: post #6
overlordalex wrote: post #4

The articles recommends that you "strengthen your Microsoft Live account password", but if I understand the vulnerability it is only exposing the hash of your password? If it's only exposing the hash, why should you make your password stronger?

To make the password hash harder to crack. There's a big difference in time to crack the hash for "Passw0rd" vs "$)63hjbbdhs23".

The hash for "Passw0rd" would almost certainly also be in some Rainbow table, so effectively no computation time in that case...

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#32

Post by Sylos »

vmateixeira wrote: post #26
cocotino wrote: post #15

Earlier quoted context omitted.

>you can't use the store without this Being honest, what would I want to use the store for?

Install free apps?

Not really a reason for using the store specifically, as you can get those almost certainly from the internet as well.

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#33

Post by tdkl »

tonylemesmer wrote: post #23
daemin wrote: post #17

Earlier quoted context omitted.

You can actually have Windows logged in with a local account (normal old school account) and use the store with a different Live account. But yes, I am quite annoyed by them requiring that I use online credentials to log in to a physical computer. I prefer to separate the two authentication mechanisms.

I seem to remember having a problem with a new Win8 computer and trying to use Skype (I hate Skype but lots of customers of mine use it). It insisted I use a Microsoft live account , which I don't have, to install it. Eventually I somehow managed to get an old version of Skype which stopped asking me.

Probably new Skype vs the "classic" Win32 one.

Pushing the MS Account for installing software is plain bad and it definitely won't help with user adoption like a non mandatory account would.

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#34

Post by cocotino »

vmateixeira wrote: post #26
cocotino wrote: post #15

Earlier quoted context omitted.

>you can't use the store without this Being honest, what would I want to use the store for?

Install free apps?

For what? Everything is available on the Internet. I have used Windows 8, 8.1 and 10 for years now and I have never felt the need to install anything from the Store.

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#35

Post by chli »

danielbarla wrote: post #21
pjc50 wrote: post #19

Earlier quoted context omitted.

That would be great - when I most recently tried to use it I was told by the dialog box that entering my Live credentials would convert my local account to the Live account, and I'd need to log in with the Live password not the local one.

I'm not sure who's correct in this particular thread, but sometimes they hide the "unfavoured" approach so well that they convince people to use the new method. In one case, I unsuccessfully tried to create just a local account in Win 8, because they had hidden it behind 3+ layers of "sign in here with your live account". I was sure that there must be a way to create a local one, but just couldn't find the right path…

Migrated my Windows 7 Home Premium to Windows 10 Home last week (pressurized by the free update ultimatum... so their strategy works !) and my local account stayed a local account and I could use the Microsoft Store with an independent account without converting my local account.

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#36

Post by arviewer »

pjc50 wrote: post #9

And people wonder why some of us haven't upgraded from Windows 7. Win10 tries really hard to make you log into your desktop with your Live Account credentials - you can't use the store without this. Whereas if it were just leaking a local login it would be much less critical.

Just another reason not to put all your eggs in one basket. Using Firefox as browser, no Hotmail or Outlook, no login at Windows 10 installation, this all seems to have little effect on the installations I've done the past weeks.

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#37

Post by deviate_X »

Kenji wrote: post #2

tl;dr: Simply accessing a website with Edge leaks the user name and password hash to the attacker site. They mention that this is also default behaviour in Spartan, Internet Explorer, Outlook (though I do not know how effectively it can be delivered to something like Outlook). Works on up to date Windows 10 and Edge (there is an online test if you're vulnerable). If you don't use the listed software, you're probably…

I'd be interested to know, how easy is it to actually break the hash of the password-code

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#38

Post by daemin »

tonylemesmer wrote: post #23
daemin wrote: post #17

Earlier quoted context omitted.

You can actually have Windows logged in with a local account (normal old school account) and use the store with a different Live account. But yes, I am quite annoyed by them requiring that I use online credentials to log in to a physical computer. I prefer to separate the two authentication mechanisms.

I seem to remember having a problem with a new Win8 computer and trying to use Skype (I hate Skype but lots of customers of mine use it). It insisted I use a Microsoft live account , which I don't have, to install it. Eventually I somehow managed to get an old version of Skype which stopped asking me.

There's a difference between Skype and Skype for Desktop, the second version is what you should install, and is the classic Skype. The first one is a Metro app.

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#39

Post by Sylos »

cocotino wrote: post #15
pjc50 wrote: post #9

And people wonder why some of us haven't upgraded from Windows 7. Win10 tries really hard to make you log into your desktop with your Live Account credentials - you can't use the store without this. Whereas if it were just leaking a local login it would be much less critical.

>you can't use the store without this Being honest, what would I want to use the store for?

In my personal opinion, the reasons for using it don't outweigh the reasons against it, but either way, the reasons for using it ( / an app store in general) are:

1) Convenience: You don't have to search all over the web for your software and don't have to click through an installer when installing (because everything is packaged in a standardized way and can therefore be installed in a standardized way, too). Also, there's a centralized way of distributing updates now, meaning that not anymore each and every piece of software has to come with an auto-updater.

2) Security: If you don't install your stuff from the internet, you're also much less likely to install from a wrong source and therefore less likely to catch viruses. If there is a virus-infected app on the Windows Store, it's also possible for Microsoft to remove it. The UWP-apps that Microsoft is pushing along with their store, are also sandboxed, so again, much less likely for software to be able to damage your system.

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#40

Post by daemin »

danielbarla wrote: post #21
pjc50 wrote: post #19

Earlier quoted context omitted.

That would be great - when I most recently tried to use it I was told by the dialog box that entering my Live credentials would convert my local account to the Live account, and I'd need to log in with the Live password not the local one.

I'm not sure who's correct in this particular thread, but sometimes they hide the "unfavoured" approach so well that they convince people to use the new method. In one case, I unsuccessfully tried to create just a local account in Win 8, because they had hidden it behind 3+ layers of "sign in here with your live account". I was sure that there must be a way to create a local one, but just couldn't find the right path…

Local accounts were not available in Windows 8 or 8.1, they only got reintroduced in Windows 10.

Call me old fashioned, but I prefer my login credentials to my physical PC to be different than for my online accounts.

Post reply on HN