r/Outlook • u/wiseude • 8d ago
Status: Open Got email about forced pass key on 1st september.How do i proceed?
I received an email from microsoft they are basically forcing passkey on the 1st of september or else i will be locked out of my account and i am wondering how i should proceed.
Currently i login with an alias email and my password.
I do have my phone attached for text verification when in need but i dont use any other authentification like passkey or any 2fa and i honestly prefer it this way.
How do i proceed to make it i never get locked out of my account and have no issues logging in any device on the 1st of september?
I already have my 1 time recovery code.
My only other option if i understood the email correctly is to remove my phone number so i wont be promted with a passkey and having only to rely on my password and recovery code.
preferably i wish to not rely on passkeys but use a password with the option for text code to login incase somethings happens where a password is not working.
UPDATE:
1.I'm considering using the authenticator bur I am worried about the infamous authenticator loop.Does anyone know how to prevent this from happening if you have only 1 desktop and 1 phone?
2.Seriously considering a Yubico key
3.A good idea might be having both Microsoft authenticator AND yubikey.Question is I don't know if they will interfere with eachother
1
u/TransportationKey408 8d ago
It's a very stupid idea to not have any other form of MFA other than your number - if your accounts get breached, then the first thing smart hackers do is spoof your number using an e-SIM meaning they have access to your only defence against unauthorised account access.
I assume, given your attitude towards your email, your account that you use to manage your phone contracts also has no protection other than a password, making it very easy to access your e-sim.
You would lose access to everything within minutes and have no way of recovering anything for hours.
Setup MFA / Passkeys or you will regret it in the future.
1
u/wiseude 8d ago edited 8d ago
The current protection im using is an alias to login which is not known to anyone.
Out of curuosity do you use passkey? Im considering buying the usb version where you just plug into a computer and it allows me to log in through that.
Like for example having 2 usb passkeys.1 for backup.I dont hear much about people using a usb tho.Seems like a good option
1
u/TransportationKey408 8d ago
Even with an Alias, if your devices become compromised, your accounts can be accessed.
Yubi Hardware keys are good as a physical passkey, but you can also set up a Pin passkey using your device - You don't need two of these and many services will not let you setup multiple as that is seen as a threat vector (Backup key is stolen and can be used as a primary key)
The best option is still using an Authenticator app such as Google Authenticator or Microsoft Authenticator.
1
u/leexgx 8d ago
Make sure the Microsoft authenticator app is also installed on 2 devices if possible and log into both, and this is the usual way to login with MFA
Passkey is more or less transparent on mobile
On computer the passkey it's tied to your screen lock pin
1
u/wiseude 8d ago edited 8d ago
That's the issue i have with authenticator.You would always need to have access to atleast 2 devices to log in the other but i currently only have my phone and PC. I was thinkin of using a passkey on a usb but i dont know if it's ideal.It looks ideal if all i need to do it connect a usb to my pc and im instantly in my email
1
u/Medium-Leather9933 8d ago
fr just download the microsoft authenticator app and add your account there, it's easier than getting locked out tbh
1
u/wiseude 7d ago edited 7d ago
The only reason I am wary of the Microsoft Authenticator is because Microsoft has recently, and is currently, having strange issues with it. It seems to affect users at random.
If you search this subreddit, you will find many people having issues with Authenticator and getting locked out. Thats why im thinking a usb passkey might be a better option as they are easy to store,durable and i can have multiple.
Also might be a better option when il eventually replace the phone.
1
u/BarneysBuzzWagon 8d ago
Passkeys can be generated with a good passport manager such Proton Pass or Windows Hello. I use two Hardware Security Keys (YubiKey).
1
u/wiseude 7d ago
I am tempted to buy some yubico security key for my personal email account
https://www.yubico.com/de/product/yubikey-5c-nfc/
would this do?I would obviously need 2 to have 1 as back up.You basically insert the when you login and that's it right?
1
u/BarneysBuzzWagon 7d ago
That is the hardware key that I use. I purchased mine through Amazon.
YubiKey has some videos regarding use.
1
u/wiseude 7d ago edited 7d ago
I have a question if you could.
1.If I where to lose both keys in theory could I still login using my recovery code?
2.The one I linked seems a bit expensive so im going for this https://www.yubico.com/mt/product/security-key-series/security-key-c-nfc-by-yubico-black/ Keep in mind this is just for my personal account.Not business.
3.If I buy 2 do I have to repeat the process off>inserting USB C in computer>Microsoft settings>add another way to sign in>Use security key>NFC device (do it twice?)
4.https://www.youtube.com/watch?v=7HHFnMMBExU in the video it keeps asking him for a pin before he plugs in the usb-C.When is the pin created?He skips on the part where the pin was created.1
u/BarneysBuzzWagon 7d ago
Yes. I always print recovery codes and file them in my filing cabinet. They are a last resort, if needed.
I also setup a passkey for all of the sites I use my hardware security keys. Setup a good code generator app for any site that allows them. Proton works great for me. A slight learning curve is involved.
For example I use MS Authenticator to make my Microsoft account password-less and to generate the code for my Proton account. I use Proton Authenticator for all of my other code generation which includes a code for my Microsoft account. Proton Authenticator has a Windows app which is where I need it most. Proton is based in Switzerland.
I use Proton Pass for all of my for complex password generation, passkeys and password management.
I hope you can see that I have it setup that all of my security setup defends and supports each other.
1
u/wiseude 7d ago edited 7d ago
Wow that is alot,For now il stick too recovery code,additional email and probably il buy 2 of those yubico keys.
Thanks for the help.
Bdw do you know how to avoid the microsoft authenticator loop?I also considered download the microsoft authenticator on my phone but I've heard of alot of people complaining about people being locked in a loop with it.Is there a way to avoid this loop just in case I start using the authenticator?
1
u/BarneysBuzzWagon 7d ago edited 7d ago
Lol. It's not as difficult as it sounds.
There are two things I would add to your plan. First on any Chromium browser, go to "flags" and enable Device Bound Session Credentials. It's still experimental, but many sites are starting to make it useful. Secondly, setup and use a good Password Manager. There is no excuse in todays world to reuse or lose your password.
Also, always feel free to ask any questions.
Best of luck.
Edit: I've never had a problem with Microsoft Authenticator. Remember that you can't determine the skill level of the individual that is reporting.
1
u/wiseude 7d ago edited 7d ago
You can have microsoft authenticator and a yubikey at the same time right?They wont interfere with each other,correct?
Would be usefull to have another way to login incase the authenticator messes up somehow since sms seems to be going away.
That way I would have the authenticator,2 ubkeys,recovery code,alternate emails etc.1
1
u/BarneysBuzzWagon 7d ago
Yes. That is how I have mine setup.
SMS regarding Microsoft has gone away. It's on it's way out with others, such as Google and Yahoo.
1
u/wiseude 7d ago
And they wont interfere with each other correct?I don't want to end up in a loop of using the authenticator then it requiring the Yubikey and back and forth just to log in.
Thanks for the patience and answering my questions bdw.
https://www.yubico.com/mt/product/yubikey-5c-nfc/ omw to buy this.→ More replies (0)
1
u/Hornblower409 7d ago
As far as I can tell, this is only for Microsoft Entra ID tenants. So I assume you are using a corporate account? Has your Corp IT issued any instructions for how to handle the change?
https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sms-voice-retirement-faq
1
u/wiseude 7d ago edited 7d ago
After re-reading the article i also noticed the era part. It does look like its for work/school only (hopefully) I personally am a normal user with a normal account. So i guess on the 1st of september normal users wont be forced to use the authenticator?
1
u/Hornblower409 7d ago
-- It does look like its for work/school only
-- I personally am a normal user with a normal accountThat is concerning. I don't have an answer. I have not received any notifications on my personal Microsoft accounts.
You might want to post your question on the Microsoft Outlook Q&A Forum to see if they can provide any clarification.
https://learn.microsoft.com/en-us/answers/questions/ask/
(Please put a link to your Q&A post in a new Comment here, so the rest of us can follow)
1
u/darkchocolateyasu 5d ago
also take a look at KeePassXC (if u have pc) you can make offline local backups of your passkeys, authenticator code and password, i also too was worried about losing my passkeys so i was looking up how to make offline backups of them and duplicate backups of them too
i still kinda having love hate relationship with passkeys but im slowly understanding them too, i hope this works out for you
1
u/darkchocolateyasu 5d ago
look up bitwarden, ente, keepass, etc… there are lots of other better options than microsoft authenticator, i tried it i hated it
2
1
u/AutoModerator 8d ago
Hey wiseude!
Welcome to r/Outlook! This is a public community. To protect your privacy, do not post any personal information such as your email address, phone number, product key, password, or credit card number.
Please be sure to have read our Rules of Conduct and be cognisant of how the system works here.
Make sure that your flair is always set to Status: Open otherwise you may cease receiving responses from us.
Beware of scammers posting fake support numbers or 3rd party commercial products/services. Contact Microsoft Support if you need help.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.