Timeline for How does Windows 8's Microsoft Account authentication work?
Current License: CC BY-SA 3.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 16, 2014 at 17:27 | comment | added | Kitet |
While this is out of the scope of current question, when talking about bad guys having access to someone else's computer / data and trust towrds MS, we should all remember Snowden's revelations about alleged cooperation of various corps with NSA. I, for one, will probably never use cloud storage services, which are now default on Windows 8.1.
|
|
| Feb 12, 2014 at 19:07 | comment | added | Ben | @jackweirdy, I am not misunderstanding. Of course they hash the password, and I assume they do this on the server too. But: If they can install software they can install a logon hook and see the plaintext password whenever they like. So it is still all based on trust. | |
| Feb 12, 2014 at 12:16 | comment | added | jackweirdy | @Ben You're misunderstanding my point. We hash passwords because, even though admins are the only ones who should have access, sometimes bad people get in. Similarly, if I log in with my email credentials, I would expect that there's some protection in there stronger than putting username and password in a file and saying "Ah well, if they steal it it's their computer now". Any sensible person would use full disk encryption, but the authentication scheme itself should have some mechanism of keeping credentials secure after auth. | |
| Feb 11, 2014 at 17:20 | comment | added | Ben | @jackweirdy, "what protects your credentials on what is now someone else's computer". They do. If you don't trust them, don't give your computer to them. Since they also issue the windows updates and the trusted root certificates list, they are effectively admin anyway... If you can't trust Microsoft, you can't trust anyone. But some people say indeed you can't trust anyone... | |
| Feb 5, 2014 at 11:18 | comment | added | jackweirdy | @ThomasPornin I'll award the bounty if you add a couple of authoritative sources, though you seem to be knowledgable on this :) | |
| Feb 5, 2014 at 11:18 | comment | added | jackweirdy | @ThomasPornin Nobody could disagree with that :) My question is, what protects your credentials on what is now someone else's computer! | |
| Jan 30, 2014 at 19:08 | comment | added | Thomas Pornin | Also, if some bad guy has admin rights on your computer, then that's not your computer anymore. | |
| Jan 30, 2014 at 18:51 | comment | added | Steve | @jackweirdy I think what Thomas was saying (apologies if not!) was that both the local system and Microsoft need to know this password in some form or another, for offline and online authentication. | |
| Jan 30, 2014 at 18:49 | comment | added | jackweirdy | I don't follow you - are you saying the account password hash is stored locally and at Microsoft's end? Re. DNS poisoning & SSL, I wasn't clear what I meant when I mentioned SSL - what's to stop someone with admin access adding a fake certificate for live.com to Windows' trusted public keys and run a server with the matching fake private key? | |
| Jan 30, 2014 at 18:21 | history | answered | Thomas Pornin | CC BY-SA 3.0 |