Take the 2-minute tour ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.

I've read multiple news articles that claim Hotmail offers two-factor authentication. One of the articles describes Hotmail's system, saying

...whenever you go to Hotmail...you can choose to get a single-use code–a string of numbers that will be sent via text message to your phone–to use instead of your password.

  1. Is this an accurate description of Hotmail's system?
  2. If so, does Hotmail really offer two-factor authentication? If you can use either your password or a single-use code, it seems to me that it does not.
  3. Is this system really more secure than just having a password? Doesn't this just make an additional "key" available to a hacker? (I must be wrong here, I know the folks at Microsoft are much smarter than I am).
share|improve this question
add comment

1 Answer 1

up vote 1 down vote accepted

Well your second article merely references the first, so only one article is really spreading the idea.

Hotmail doesn't have a two-factor system. As you suggest, you actually have the option of having a single use code sent to your phone to use on a public computer to login instead of a password. So in effect it is still single sign on, but you have a choice of two ways for that way to be.

Using the code is more secure in the sense that a keylogger or packet sniffer on the computer will only get a single use code that has been used, as opposed to your password. If you have HTTPS enabled (which I believe is default now) then there is also little opportunity for session hijacking as well. Just don't forget to log off!

share|improve this answer
    
Ok, that's what I thought. I didn't think about keyloggers/packet sniffers though; thanks for pointing that out. –  Brian Koser Jun 12 '12 at 13:39
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.