Windows Live is entrusted with safekeeping the email, contacts, photos, documents, and more that over 500 million people bring to our services each month. Today is worldwide Data Privacy Day, and we’re observing it by focusing on a critical way to help keep your data private: protecting it from account hijackers.
Over the last year, we have made significant investments in this area, and we are honored that the European security and safety organization TüV Trust IT Corp. awarded its Seal of Trusted Email Service to Hotmail, making us the first US-based web mail service to receive the seal. In the same month, Fox Business ranked Hotmail as the #1 email service for safety and security. While we’re excited to receive this feedback, we know that this is an ongoing battle against hijackers that demands our continued focus, and we will work relentlessly to keep you safe. We think of this in three parts – joining forces across the industry to pool our resources, blocking abuse algorithmically, and giving customers tools to stay in control.
Joining forces across the industry
Data privacy and security really takes an industry-wide effort. More than ever, access to the data in your accounts is connected across multiple services. Additionally, because many people use the same password across their multiple email and social networking accounts, if a hijacker compromises one account, the rest may quickly fall victim. This interdependence makes it more important than ever for these initiatives to be cross-industry, and we are aligned with Google and others in this fight.
Blocking abuse algorithmically
Windows Live is continually getting smarter about detecting and neutralizing threats automatically. One way that hijackers attempt to steal your data is by creating fake email addresses or websites that impersonate “official” ones and ask for your passwords or other information. To help protect against these schemes, we add a green shield icon next to messages from known, trusted senders, and we use Microsoft SmartScreen to automatically recognize and warn you about suspicious senders and messages.
Despite precautions, passwords can still become compromised, so we constantly monitor for suspicious behavior. For example, if we detect login attempts from multiple continents, we will check to verify that a human is using the account, because hijackers often use automated scripts. And if we detect major changes in volume of email being sent or spam-like activity, we will automatically cut off the spammer to stop the abuse and allow you to reclaim your account.
We provide you with tools to stay in control
Although we work hard to prevent abuse, you also play a big role in setting yourself up to be secure and in control of your account. Beyond making your password more complex and never sharing it, there are things that you can do to help keep it secure.
For example, if you are using a public computer that is vulnerable to key-logging, instead of entering your true password, you can use a single-use code, a one-time password sent to your cell phone.
We also offer advanced and reliable password recovery options. When you set these up in advance, they act as a spare key to your account and allow you to take back control if a hijacker tries to lock you out by changing your password. Setting up at least two of these “proofs” – alternate email address, cell phone number, or a physical PC that is designated as “trusted” by your account – will allow you to retake control of your account in seconds, should it become compromised.
For these tools to be effective, we need to make sure that you know about them, so here’s a short video about how to stay secure.
If you’ve ever received an email from a friend’s account that was hacked (e.g., advertising prescription medication or asking for money because they’re stuck in a foreign country), you should share this information with them so they can keep themselves safe as well. As always, let us know what you think and how we can make your account even more secure.
Director, Windows Live Product Management
I have both Gmail and Microsoft email accounts. I had my Gmail account hacked last summer. I dearly love my Google Gmail account despite that. Some of the items mentioned by @langware windowsteamblog.com/.../default.aspx are very fine features available on Gmail, namely his items 3 (a record of IP addresses from most recent 10 logins) and 4 (2-factor authentication). However, item 3 did me no good other than to identify that some one with an IP in central Africa was logging on to my GMail account. I didn't have 2-factor auth setup then.
Next I tried to take the Gmail equivalent steps of those described in comment windowsteamblog.com/.../default.aspx by Matt O'Day. For reasons that were never clear to me, I was 1) locked out of my account and could do nothing about it, 2) went to second option, and was unable to establish to Google's satisfaction that the account had been compromised despite the fact that I've used the account nearly every day for 3+ years from the same Arizona IP address and none other. Finally, most significantly, there WAS no option to open a support ticket with anyone at all at Google! Unlike Windows Live, which actually provides that service per Matt's link: windowslivehelp.com/passwordreset.aspx
Instead, I was forced to resort to measures of my own which involved interacting with the hacker (unknown to me) and because of a mistake on his/her part, regained control of my Gmail account.
Based on that experience, which certainly colors my point-of-view, it is very apparent that Microsoft has a superior process in place for handling a hijacked account scenario.
Here is an example of a customer who has been unable to access his account for over FIVE MONTHS:
The standard process for account recovery are just not working for this customer. PLEASE have a look at this thread, and PLEASE have someone contact this customer privately and resolve his issue.
Then please review your procedures and provide a way in which cases like the one above can be escalated.
You've described Microsoft's reactive actions to account hijackings .... steps that customers can take AFTER their account has been hijacked.
What we customers need from Microsoft are more proactive actions .... steps that Microsoft will take to prevent hijackings BEFORE they occur.
Sorry about this - the good news is that you should be able to kick the hijacker out pretty quickly. Here's how:
If you're still able to log in, I'd recommend that you reset your password ASAP by going to our Password Reset site: account.live.com/ResetPassword.aspx
That should work even if you do get locked out of your account, provided you've set up proofs. (Trusted PC/alternate contact info both highly recommended. Learn more here: explore.live.com/windows-live-account-account-security-password-information-faq )
On the off chance that you're not able to have your password reset automatically, open a ticket with our Hotmail support specialists here: windowslivehelp.com/passwordreset.aspx
Hi, My hotmail account has been hijacked. Its been sending out emails to all my contacts. I'm wondering what I can do to fix this? I really am happy with my address and do not want to cancel my account. However this problem is very frustrating and I feel there should be more options for us customers in place to be able to protect ourselves. Can you please give me advice as to the best way to solve this?
I love the web-based built-in messaging feature with so much ease of access and retention of same look and feel as in the desktop app (considering rich emoticons!). Though, I have observed a little bug in it. The other day, using windows live messenger app, I helloed a contact who didn't replied me. Next day (i.e. today), I logged into Hotmail web and got her offline message: "Sorry, I was away!", while she is offline (a real offline message!). Now, whatever windows-live page I browsed to, I am getting that message over 'n over again. "Until I *just* actually clicked that window!!!!!" This qualifies as a little bug.
Possible solution: Seems like the delivery status changes, from "pending" to "delivered" triggers, when the click event is called on the quasi-chat-window area on webpage, while it should get triggered by the JS/JQuery/whatnot when the offline chat window is rendered in the user agent (may be in a callback method).
Thank you for your reply.
I can appreciate your not wanting to provide details on the specific actions being taken to help prevent hijackings.
All we customers need to see are the results of those actions: a significant reduction in the frequency of hijackings being reported in the Windows Live Solution Center. That measurable objective hopefully can be achieved in 2011. All 350+ million Hotmail users (whether one has been a victim of hijacking or not) would benefit from achieving that objective.
In terms of proactive efforts to stop hijackers from getting access to your account, we invest in that area a great deal (to the sections above on working with other providers like Google and algortihmically detecting threats). As you can imagine, we don't detail out everything we do in this area as it would provide the hijackers with more information on how to try to circumvent our efforts.
And in terms of suggestions for other tools we can provide consumers, that is something we continue to look at. Appreciate your feedback and it's something we'll consider with other input for future releases, but we don't have anything to announce right now about what's coming next.
Microsoft has implemented some good reactive solutions to address the problem of hijacking. However, if you search the forums on the Windows Live Solution Center (search for the word "hijack"), you will see that many customers continue to report account hijackings each and every day. The frequency of reported hijackings does not seem to have diminished.
Phishing is one technique used to hijack accounts. The shield icon is a good first step, but as you can see from posts in the Windows Live Solution Center, many customers receive phishing messages that appear to be from Hotmail Support. These phishing messages ask the recipient for account information, and state that the account will be closed if the recipient does not quickly respond. Thus, many customers respond immediately (and get their account hijacked). Other customers post a question in the Windows Live Solution Center, but the response time from moderators often takes days, and the customer (fearing that their account will be closed) gives up waiting for a moderator and responds to the phishing message.
Why not offer the option to either automatically delete phishing messages (especially those that appear to be from Microsoft) or to insert a big yellow banner at the top of the phishing message warning the recipient not to respond.
The single use password is also a good idea, but what about your customers who do not have a text enabled cell phone? Why not offer the ability to obtain one (or more) single use passwords that get sent directly to ones Hotmail account?
Here are a few more suggestions for improving Hotmail's security:
1. An option that allows users to specify a default IP address. If an attempt to sign on to Hotmail does not originate from the user's default IP address, then the user's secret question(s) or other "proofs" must be successfully answered before the sign on is accepted.
2. An option to warn the user if there is more than one computer currently signed on to the account (possibly indicating that a spammer was in the process of hijacking the account).
3. A table showing the last 10 sign-on attempts to the user's account ... with the IP address and date/time of each sign-on.
4. A two-factor authentication process similar to what Google announced on Sept 20, 2010 ... where customers who elect to use this feature are required to provide a password and a code (sent to their mobile phone) in order to sign in.
In addition to the reactive solutions that already have been implemented, innovative proactive solutions are needed to stop hijackings BEFORE they occur.
Since "Windows Live is entrusted with safekeeping the email, contacts, photos, documents, and more that over 500 million people bring to our services each month", does Microsoft have a measurable objective to significantly reduce the number of Hotmail hijackings in 2011?? If so, will you publish monthly status reports showing your progress in attaining that goal? Let your 500 million customers see that Microsoft is taking this problem seriously!
What happens if the hacker removes your security? If they removed your trusted PC, phone, alternate email, and more, would you not be able to access your account again?