Hacker News Reader

Comment by inciampati | Hacker News Reader

I set up a Microsoft account because it was required to purchase Minecraft in late 2021. Somehow I forgot the password or the account was locked because I didn't supply a phone number. I tried to recover using my recovery email address and Microsoft would not grant me access unless I gave a record of who I'd corresponded with and some email headings. I literally only have a receipt for Minecraft in the inbox. A recovery attempt failed after 10 days. I don't see how initiating another would solve the problem and I find it mindbending that the won't let me recover using my recovery email address. So here I am telling my kid that we can't access all the worlds we made over the holidays, and contemplating making another purchase because my time isn't worth this annoyance. But I'm incredibly annoyed that they will happily take my money again for something I just purchased!

View on HN

Microsoft doesn't shy away from outright lying to pry phone numbers from people.

I made a couple of Xbox accounts for my kids to use for some PC game. Used unique emails on my own domain and hosted on my own private mail server. Declined requests to provide any extras. Not a week in MS sends an email to both that literally said "Your _email_ account was hacked. Your Xbox account is suspended. Secure it with a phone number or it will be deleted."

The new and improved, people-friendly Microsoft. Just a fresh coat of paint over the same old core.

This is really bad. This should be considered outright computer fraud. It's a lie to extort information from you. Although it's probably way too small and trivial for that, I'd really like to see this slapped down hard by a court.

Fear not, you didn't lose any of your progress (unless you plaid on a realm), all the worlds are saved ~/.minecraft/saves.

If you don't want to buy another account you could use one of the many launchers that allow you to play without an account (tlauncher, shiginima...) but your mileage may vary. You could also use multimc but, since it requires an account to download the assets, you'd need to copy around the files in the .minecraft folder used by the official launcher which can be challenging and annoying to do.

Edit: I have a similar thing going on with Microsoft too, to migrate the account I need access to the email which I no longer have. I've been opening a ticket every ~3 months for the past ~2 years and they still refuse to switch my email address. Luckily I can still play the game (not for long) since I still have access to the account

I'm really sad to read that. It's too late for you to avoid that horrible situation, but maybe in order to avoid repeating it, and for anyone else who is reading this, consider playing Minetest instead of Minecraft. It's free software, so you're structurally protected against this kind of abuse.

https://www.minetest.net/

(and now I've lost the last 4 hours building a fortress in Minetest and defending it against attacking golems)

Anyone knows how to set a Microsoft account so they don't require a verification code sent to another email? I want this to be the place where other accounts send their verification codes. The last thing I need is to go on a spree of chained verifications when on a hurry and/or on the go with my tiny smartphone.

What's worse with all these verification systems is that what happens if you make the human mistake of setting them to the other email, so each one sends their verificacion to the other one. I just want to use my very secure passwords and maybe a OTP key, not depending on third party emails :-(

ProtonMail allows you to make an account without another email address or a phone number (or at least, they did last time I checked).

If you own your own domain and pay for web hosting, many hosts also provide e-mail as a free add-on.

Microsoft does this all the time where they will lock you out of an account and make it near impossible for you to recover even when you still have access to the email address and password.

Microsoft locked me out of my Skype account by enabling an old phone number as two factor out of the blue. I hadn't used that number for 10 years.

So disappointing since it was my only point of contact with lots of old friends.

This happened to me with LinkedIn (during a job search!) when my phone that had 2FA on it stopped booting entirely (Pixel 3a). Support had no reason they wouldn't simply contact me via the contact methods on my profile to reset 2FA, so I'm in limbo right now.

To be fair, they want me to email pictures of my driver's license to recover the account, which they pinky-promise they'll delete afterwards. I'm not willing to do that, given I didn't have to provide any ID to sign up in the first place. So now I'm looking into having this form they sent to me notorized so I can get access back. What a mess.

That just sounds like 2FA working as intended to me.

Interesting take! Escalating the information being demanded to recover the account beyond that used to sign up is not something I can really get on board with.

That's what 2FA means though: once you enable it you need both factors to authenticate, whether or not you had them when you first signed up. I agree that if they required you to switch to 2FA at some point, even though it wasn't required when you signed up, that's abusive. But not being able to log in without your phone or other something-you-have credential is the whole point of 2FA.

How do folks recover when 2FA fails?

Edit: nevermind, I'm sure I'm wrong about this, and it's offtopic anyway. Apologies!

> How do folks recover when 2FA fails?

Reset codes, as in some entities will provide you with a page/image/etc. with ~10 codes on it when you enable 2FA, which can each be used once in place of the code generated by the 2FA token, letting you get into the account to, e.g. set up a new 2FA token/method.

Phone numbers aren't 2FA and are susceptible for this reason.

Microsoft literally makes little children cry. God I hate that company and its practices. They have not changed since the nineties, not one bit.

Reply on news.ycombinator.com