1

If you want to update your security info (such as a password). You need to verify your ID with your phone or another email. If you don't have any connected to you account (or forgot them), you can add them. After doing this you need to wait 30 days for verification and you can not change your password (and other security settings).[1]

If a hacker or someone has your password, you need to wait 30 days. Before you can change it. Giving the hacker free access for 30 days.

Why would a company still choose to make you wait 30 days?

  • As a side note. Thats a good example of why "One ring to rule them all" policy is risky. If they get limited or full access to the single account used as account recovery for several services it is a fair assumption to consider all services could be compromised. And restoring access to all services could be a pain in the ass. – bradbury9 Apr 13 '18 at 10:06
3

The 30-day waiting period helps Microsoft stop unauthorized people from trying to completely take over an account that isn't theirs. For example, an unauthorized person obtaining an account password through phishing or shared passwords across third party platforms. This waiting period gives the real account owner enough time to be alerted of any major changes and to cancel it if they didn't make those changes.

During this 30-day period, you'll still be able to access most Microsoft services. You won't, however, be able to do things that require a security code, like changing your password, viewing billing information, or buying new apps or games from Microsoft Store or on Xbox.

After the process of resetting your security information has started, you must wait the full 30 days for it to complete. However, if you regain access to a piece of your original security info, you can cancel the replacement yourself.

Source: Official Microsoft Source

  • 3
    Regardless if it's a smart move or not, that is their reason – toom Apr 13 '18 at 9:33
  • But this also give the hacker 30 days to undo anything the real user did. Or am I missing something? – SirDuckduck Apr 13 '18 at 9:38
  • 1
    Indeed, access to the account is granted, and the attacker could do several things, but no full control is given and the victim could react to the credential theft without economic implications (as long as MS is concerned). If the email has sensitive messages tha could help impersonate or password recovery other services it could be troublesome imho. I can not buy myself at microsoft store, but there goes paypal! – bradbury9 Apr 13 '18 at 9:47
  • As @bradbury9 it does deliver some security for your accounts and the settings but it also guarantees some free 'playtime' for the hacker – toom Apr 13 '18 at 9:51
0

IMO, the 30 days delay is excessive, unnecessary and counter productive. Being able to make changes to security verification information quickly but safely is essential. My PC is now effectively hijacked by Microsoft because I wanted to change the mobile phone number I use to verify my security details.

Actually, I wanted to add an additional contact number and e-mail address but seemingly I cannot do that in Windows 10. Other systems, such as Facebook, Google, Twitter, Yahoo! etc., allow multiple phone and e-mail contacts to be used to verify identity and authorise changes.

If Microsoft were a serious OS developer, they would have implemented full biometric security in Windows Hello for all devices whereas it only seems to support certain mobile and portable devices, specifically Microsoft's own Surface products.

I have three HP laptops running both Windows 10 Home and Pro, each of which has a built-in camera, but Windows Hello "isn't available on this device" so I can't use facial recognition on them!

Anyway, surely if I have access to the current mobile phone or e-mail account to authorise the change, that should be enough. The likelihood that both my phone and laptop would be stolen whilst logged in (to an Administrator account in the case of Windows) with their screens unlocked is extremely unlikely.

If Microsoft is trying to protect me from myself by assuming I'm an idiot then they should at least allow me to make that judgement myself!

  • 1
    My suggestion would be, to avoid using m$ products if you can, and try to inject non-m$ solutions in any systems where you find m$ problems. – user259412 Apr 30 at 8:04
  • I do use Linux on most of my business systems but still have pre-installed Microsoft Windows on the three personal laptops although they are also configured for dual boot into Linux. – Felim Doyle Apr 30 at 11:55
  • Fortunately I don't need to fight with Windows 10, what I consider the worst win since win98. – user259412 Apr 30 at 12:10
  • I agree, it's appalling! – Felim Doyle Apr 30 at 12:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.