The Shrine

This is me telling a story / bitching about about Microshaft's idiocy wrt Live. Don't read any further if you don't care.

So I've been having issues recently allowing the Xbox Live call centre to access my Live account 'cause, according to them a) I clearly have no idea where my mother is from (ie. the answer to my security question is wrong) and b) apparently I don't know the last 4 digits of my credit card number that I've had for 15+ years and use constantly online (ie. I've had it memorized for over 10 years). First time I get these answers "wrong" (I'll explain the quotes in a minute), it becomes a security concern and they send it up for review. This was a couple of months ago but we get that cleared up (after a while.....but that's another story altogether).....or so I thought.

Then, this past weekend, I was at my bud's house and we were on his system and I noticed there was the whole Spring sale thing going on. We quickly sift through it but it was kinda late and he was tired so I figured "no big deal, I'll just go home and check it out there". Get home and turn on the 360 and I can't find the sale under the Spotlight. Figuring this was odd, I went up to Game Marketplace and it wasn't there either. This doesn't make any sense to me so I decide to log off and log back on with my cousin's account that's still on my HDD. Soon as I log in, bam, all the Spotlight and Game Marketplace stuff changes and that Spring Sale listing is front and centre, just like it was at my bud's place. All three of us have Live Free accounts (we all have PS3s, no reason to pay for Gold) so there shouldn't be any restrictions going on as to what I can see.

I'm curious as to why this is happening so I call the Live call centre up and tell them what's going on and how I've tested it against 2 other Free accounts. Of course, the dreaded security question thing comes up and I obviously still have no idea where my mother was born and what my credit card number is. Clearly, if I didn't know it before why the hell would that change? Before she tries it too many times and locks herself out with an automatic security violation escalation, I stop her and ask her where the hell I can check my security question. She says it's part of my Live account so I get her to walk me through how to find it. After quite literally 10 minutes of both of us fumbling around on the website, we find the security question under Change Password (how stupid of me not to know it would be found there, right?). Considering that's the first time I've ever seen that particular page (took me forever to find it after all), I start to wonder "how the hell did anyone even set up my security question to begin with"?

Since everything else in my Live profile is purposely left blank, and I've never seen that page before anyways, there's only one logical answer: when my account was switched from a Hotmail to a Live account, it musta defaulted to the first question in the list (it's a pull-down menu). Likely due to some moronic validation some sour milk-smelling programmer(s) or equally pungent supervisor(s) put it and didn't think through (I know a lot of you are programmers; I'm not bitching about all programmers, just the idiot(s) who designed that particular thing). Of course, since I didn't actually set up my security question, I never answered it. So when the call centre people were entering in my response, it was coming up "wrong" (notice how I've never complained about the call centre people? It's not their fault). And since I never set up any part of my profile, I also have no credit card on my account which is why the backup security question was always coming up wrong. The answer in both cases was "blank" because I was not involved in setting up my Live profile.

So let me ask you programmers this: what the fuck is the point of setting up a question for security purposes that never requires input from the customer? All they had to do was leave the damned thing blank, have it pop up to the CSR that it's never been set up, and they can tell me "we can't do any more unless you set it up" and direct me on how to do it (since I need to be able to log into my Live account to do that, shouldn't be a security issue there). Instead, I'm causing a security concern when trying to look into issues into my own account due to no actions of my own. That, folks, is a textbook example on how NOT to program a front-end. Someone needs to be smacked around for something like this, it's so stupid it's almost unbelievable....if it wasn't Microshaft, a proud equal opportunity employer (I work for the government, I know all about "equal opportunity").

On a side note: it appears that the reason I couldn't see the Spring Sale stuff and why my dashboard isn't updating properly is due to the fact that my account switched from Gold to Free on Friday. Some glitch in the system for no good reason whatsoever. I'm sure it's the same programmers/supervisors who did the Hotmail to Live switchover....

/rant

So after reading all of this I only have one question.

Why don't you know where your mom was born?!

Well, the answer's obvious isn't it? I'm simply a horrible son who has no interest whatsoever in knowing any details about my own mother. Microshaft knows this, which is why I am clearly a security violoation

Such an evasion! Well played.

It is a bug in migrations. Any/all migration from one system to another with added "features" such as the security questions would have triggered this. Obviously Microsoft is somewhat at fault by not forcing you at first log in to fill in said required new "feature" information (which I think is BS because I shouldn't be using personally identifying information on the internet anyway like the last 4 digits of ANY number [CC, SSN, BD]) HUGE security hole.

Imakeholesinu wrote:It is a bug in migrations. Any/all migration from one system to another with added "features" such as the security questions would have triggered this. Obviously Microsoft is somewhat at fault by not forcing you at first log in to fill in said required new "feature" information (which I think is BS because I shouldn't be using personally identifying information on the internet anyway like the last 4 digits of ANY number [CC, SSN, BD]) HUGE security hole.

And really, that's all I'm sayin'. Clearly the ones in charge of developing the system didn't think this through very well and never really tested it properly at a user level. And that's a big no-no in any system development of any kind.

If you're going to do these integrations of your crap, make sure you test, test again, and re-test every possible scenario, particularly one as far-reaching as Live. Don't forget, we're talking about my Hotmail account affecting the use of my console here. And the worst part about it is, the solution to ensure something like this never even has the possibility of occurring is extremely easy (default to nothing, have CSR instruct you to set up properly). It actually took someone, somewhere some effort to come up with what they thought was the "better", but more complicated, solution. The KISS system should be an absolute staple of any programmer's toolbox.

It should, but I've been a part of many migrations with Microsoft products and I've always had a gotcha or two that have popped up because of a configuration they didn't account for in their documentation. I like to call this job security on my part.

Imakeholesinu wrote:It should, but I've been a part of many migrations with Microsoft products and I've always had a gotcha or two that have popped up because of a configuration they didn't account for in their documentation. I like to call this job security on my part.

It's at least nice to know that their incompetence not only causes heartaches for their consumers but is also creating jobs in the industry. Still doesn't discount just how sad they really are at properly performing their duties, though