Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I boot up Windows 8 and the first thing I notice is that it allows you to login with your email credentials. Let's say if my laptop is stolen then what are the advantages or disadvantages of email based authentication?

share|improve this question
add comment

1 Answer

up vote 10 down vote accepted

Using the stolen laptop scenario; if you don't use whole disc encryption then all your data belongs to the thief. All of it. So what account you use is of little significance. Keep in mind, however, that if you connect your OS credentials with your email credentials then you're exposing a wider attack surface by which a bad guy can get them. Remember that email itself has no default assurance of security. Different systems implement email security in different ways and with varying degrees of success, but email itself isn't something you can really put a whole lot of trust in.

Advantages:

  • convenience of single sign on

Disadvantages:

  • OS security bound to a non-secure system with non secure protocols.
  • Common credential gives total access
  • Windows :-P

If you have whole disc encryption enabled then you're better off but I would not trust any security features to email integration. Yes it is convenient, but so is leaving the keys in the ignition.

share|improve this answer
1  
Actually, it uses a Microsoft Account, not an arbitrary email account. –  SLaks Dec 24 '12 at 20:59
1  
Well, it's an email account and a bit more: ""Microsoft account" is the new name for what used to be called a "Windows Live ID." Your Microsoft account is the combination of an email address and a password that you use to sign in to services like Hotmail, Messenger, SkyDrive, Windows Phone, Xbox LIVE, or Outlook.com." It's just my opinion but from a security point of view I think this is a terrible idea. –  grauwulf Dec 24 '12 at 21:18
1  
Also ( windows.microsoft.com/en-US/windows-live/… ) "You can also use a Microsoft account to sign in to any PC running Windows 8." I hope it's just a poor wording but it sounds like I can use my Windows Account to log into your computer. :-/ –  grauwulf Dec 24 '12 at 21:20
    
How is that worse than a Google Account? –  SLaks Dec 24 '12 at 21:32
1  
I take it you don't have a Chromebook... (or an Android tablet) –  SLaks Dec 24 '12 at 23:01
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.