Microsoft Live Account Credentials Leaking from Windows 8 and Above
1–10 of 144 posts
Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above
#2tl;dr: Simply accessing a website with Edge leaks the user name and password hash to the attacker site. They mention that this is also default behaviour in Spartan, Internet Explorer, Outlook (though I do not know how effectively it can be delivered to something like Outlook).
Works on up to date Windows 10 and Edge (there is an online test if you're vulnerable). If you don't use the listed software, you're probably completely safe (maybe there is other Microsoft software that does this, though?). If you don't use your Microsoft Live Account as a Windows account, you're safe (someone then just finds out the hash of your local password).
EDIT: Interestingly, Edge on the Xbox One is not vulnerable. It seems like the behaviour on the console is different.
Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above
#3tl;dr: Simply accessing a website with Edge leaks the user name and password hash to the attacker site. They mention that this is also default behaviour in Spartan, Internet Explorer, Outlook (though I do not know how effectively it can be delivered to something like Outlook). Works on up to date Windows 10 and Edge (there is an online test if you're vulnerable). If you don't use the listed software, you're probably…
Password hash? Do they mean an auth token?
Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above
#4The articles recommends that you "strengthen your Microsoft Live account password", but if I understand the vulnerability it is only exposing the hash of your password?
If it's only exposing the hash, why should you make your password stronger?
Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above
#5tl;dr: Simply accessing a website with Edge leaks the user name and password hash to the attacker site. They mention that this is also default behaviour in Spartan, Internet Explorer, Outlook (though I do not know how effectively it can be delivered to something like Outlook). Works on up to date Windows 10 and Edge (there is an online test if you're vulnerable). If you don't use the listed software, you're probably…
Password hash? Do they mean an auth token?
No I think they mean the NTLMv2 hash of the password.
Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above
#6The articles recommends that you "strengthen your Microsoft Live account password", but if I understand the vulnerability it is only exposing the hash of your password? If it's only exposing the hash, why should you make your password stronger?
To make the password hash harder to crack. There's a big difference in time to crack the hash for "Passw0rd" vs "$)63hjbbdhs23".
Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above
#7The articles recommends that you "strengthen your Microsoft Live account password", but if I understand the vulnerability it is only exposing the hash of your password? If it's only exposing the hash, why should you make your password stronger?
My uneducated understanding is that it is an MD5 hash, quite easily brute forceable if that's the case.
Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above
#8Microsoft should fix this ASAP.
You should enable Two-factor Authentication (2FA) on your account.
https://support.microsoft.com/en-us/help/12408/microsoft-acc...
Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above
#9And people wonder why some of us haven't upgraded from Windows 7.
Win10 tries really hard to make you log into your desktop with your Live Account credentials - you can't use the store without this. Whereas if it were just leaking a local login it would be much less critical.
Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above
#10And people wonder why some of us haven't upgraded from Windows 7. Win10 tries really hard to make you log into your desktop with your Live Account credentials - you can't use the store without this. Whereas if it were just leaking a local login it would be much less critical.
But if you upgrade to Windows 10 from Windows 7, your existing log-on (which has no Live account connection) continues exactly as before....
It's not really a surprise if an app store needs an account. Are there any that don't?