Live data from Hacker News

Microsoft Live Account Credentials Leaking from Windows 8 and Above

hackaday.com

11–20 of 144 posts

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#11
post #6

The articles recommends that you "strengthen your Microsoft Live account password", but if I understand the vulnerability it is only exposing the hash of your password? If it's only exposing the hash, why should you make your password stronger?

To make the password hash harder to crack. There's a big difference in time to crack the hash for "Passw0rd" vs "$)63hjbbdhs23".

>$)63hjbbdhs23

Great, I'll just store this in my password manag... oh, wait.

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#12
post #10
post #9

And people wonder why some of us haven't upgraded from Windows 7. Win10 tries really hard to make you log into your desktop with your Live Account credentials - you can't use the store without this. Whereas if it were just leaking a local login it would be much less critical.

But if you upgrade to Windows 10 from Windows 7, your existing log-on (which has no Live account connection) continues exactly as before.... It's not really a surprise if an app store needs an account. Are there any that don't?

F-Droid for Android: https://f-droid.org/

Also nearly any Linux package manager ;) (if they count as an "app store" for you)

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#13
post #9

And people wonder why some of us haven't upgraded from Windows 7. Win10 tries really hard to make you log into your desktop with your Live Account credentials - you can't use the store without this. Whereas if it were just leaking a local login it would be much less critical.

There is an option when you install an app to only use your Live Account for that app. This way you can still have a local account and use store apps.

http://lifehacker.com/install-windows-10-store-apps-without-...

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#14
post #10
post #9

And people wonder why some of us haven't upgraded from Windows 7. Win10 tries really hard to make you log into your desktop with your Live Account credentials - you can't use the store without this. Whereas if it were just leaking a local login it would be much less critical.

But if you upgrade to Windows 10 from Windows 7, your existing log-on (which has no Live account connection) continues exactly as before.... It's not really a surprise if an app store needs an account. Are there any that don't?

Chrome's?

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#15
post #9

And people wonder why some of us haven't upgraded from Windows 7. Win10 tries really hard to make you log into your desktop with your Live Account credentials - you can't use the store without this. Whereas if it were just leaking a local login it would be much less critical.

>you can't use the store without this

Being honest, what would I want to use the store for?

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#16
post #10
post #9

And people wonder why some of us haven't upgraded from Windows 7. Win10 tries really hard to make you log into your desktop with your Live Account credentials - you can't use the store without this. Whereas if it were just leaking a local login it would be much less critical.

But if you upgrade to Windows 10 from Windows 7, your existing log-on (which has no Live account connection) continues exactly as before.... It's not really a surprise if an app store needs an account. Are there any that don't?

> It's not really a surprise if an app store needs an account. Are there any that don't?

Yeah the ones that have existed since forever: GNU/Linux repositories (Ubuntu's, Debian's, etc.). Even Ubuntu's Software Center, which you might find closer to an app store than a command line interface even though it's the same thing, does not require an account until you try to leave comments or review an application.

Then there were browser addon repositories which worked the same way, first from Firefox and later from all other browsers. (Except one of course.)

So yes, no account was the standard. Needing an account is something recent.

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#17
post #9

And people wonder why some of us haven't upgraded from Windows 7. Win10 tries really hard to make you log into your desktop with your Live Account credentials - you can't use the store without this. Whereas if it were just leaking a local login it would be much less critical.

You can actually have Windows logged in with a local account (normal old school account) and use the store with a different Live account.

But yes, I am quite annoyed by them requiring that I use online credentials to log in to a physical computer. I prefer to separate the two authentication mechanisms.

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#19
post #17
post #9

And people wonder why some of us haven't upgraded from Windows 7. Win10 tries really hard to make you log into your desktop with your Live Account credentials - you can't use the store without this. Whereas if it were just leaking a local login it would be much less critical.

You can actually have Windows logged in with a local account (normal old school account) and use the store with a different Live account. But yes, I am quite annoyed by them requiring that I use online credentials to log in to a physical computer. I prefer to separate the two authentication mechanisms.

That would be great - when I most recently tried to use it I was told by the dialog box that entering my Live credentials would convert my local account to the Live account, and I'd need to log in with the Live password not the local one.

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#20
post #10
post #9

And people wonder why some of us haven't upgraded from Windows 7. Win10 tries really hard to make you log into your desktop with your Live Account credentials - you can't use the store without this. Whereas if it were just leaking a local login it would be much less critical.

But if you upgrade to Windows 10 from Windows 7, your existing log-on (which has no Live account connection) continues exactly as before.... It's not really a surprise if an app store needs an account. Are there any that don't?

.. until you try to install an app, at which point you're prompted to switch over your local account. Apparently you can get round this, but it's not the obvious or default path.
Post reply on HN