Windows Live Sign-in Security ISSUES

Scenario: I am using a large screen laptop with Windows 7 as a Home/Office PC. I use Skydrive and Windows Live Mail. I am checking out the idea of using a mobile device (currently a second laptop as a test vehicle) when I or colleagues travel. The W8 Skydrive, Mail and Calendar Apps look ideal for this, but... I have a security issue.

Imagine the mobile device has been stolen and the sign on password has been compromised (I know - careless! - but it could happen). Naturally you will change your Live password promptly (from your base PC, you no longer have the mobile one). But when I tested the result on the W8 PC I found that even though its sign on password no longer matched my latest Live password it was still receiving calendar updates via the calendar live tile and could view my email via the Mail app. The Skydrive app was better - it refused access as you would hope. However, after completing the test I changed my Live password again to a stronger 'post test' version and found that the Skydrive app was now permitting access, though I was still logging on to the W8 PC with an out of date password! Looks like this needs close scrutinity!

I like the idea of using 'the cloud' in this way, but I'm not conviced that current security methods are up to the job. The password approach is just too vulnerable. Anyone else have any views?

 

Hi Silver8,
very interesting post!

The only thing I could perhaps add is that you were testing under beta conditions and hopefully these areas of concern will be tightened up.

 

Very interesting! I will look into these more as I'm also very curious of what else is going to happen.