4 ms·

The article does specifically mention that he has taken steps to protect himself from stuff like this (i.e. require in-person confirmation with his utility prov

by pfg 11y ago

The article does specifically mention that he has taken steps to protect himself from stuff like this (i.e. require in-person confirmation with his utility providers, etc.). 2FA is certainly a valid response here, and requiring this even for phone transactions when a customer is using it should become the norm. It's a bit weird to blame customers for broken security protocols, and they should be fixed nonetheless. Not every high-profile target is a security expert.

Spooky23 11y ago
It's not about blaming the victim -- My point is extraordinary risk requires extraordinary response. If your career centers around rattling the cage of criminal hackers, you've made a choice to expose yourself to extreme risks. Things you can do about that vary. For example, in New York, if you're a victim of severe domestic abuse (stalker, etc), you can actually get a special address provided by the State, who will confidentially keep your real address and forward mail to you. Maybe a similar approach/service can be used in this case. NIST defines the various trust levels that underlie identity solutions and offer increasing levels of validation from level 1 (no proofing, just validation that you are the same individual) to level 4 (in-person proofing with "hard" crypto authentication token). Two-factor auth without proofing doesn't really change the game -- that's why PayPal MFA is a joke for many use cases. The problem with this stuff is that proofing requires a big uplift in cost & effort. If I were a service provider, in the absence of a mandate to serve Mr. Krebs or other high-risk targets like him, I would terminate my relationship with him.
- pfg 11y ago
  It seems to me like 2FA would've certainly affected the outcome in this particular case, and probably many other scenarios.

4 ms·

The article does specifically mention that he has taken steps to protect himself from stuff like this (i.e. require in-person confirmation with his utility prov

by pfg 11y ago

Spooky23 11y ago
It's not about blaming the victim -- My point is extraordinary risk requires extraordinary response. If your career centers around rattling the cage of criminal hackers, you've made a choice to expose yourself to extreme risks. Things you can do about that vary. For example, in New York, if you're a victim of severe domestic abuse (stalker, etc), you can actually get a special address provided by the State, who will confidentially keep your real address and forward mail to you. Maybe a similar approach/service can be used in this case. NIST defines the various trust levels that underlie identity solutions and offer increasing levels of validation from level 1 (no proofing, just validation that you are the same individual) to level 4 (in-person proofing with "hard" crypto authentication token). Two-factor auth without proofing doesn't really change the game -- that's why PayPal MFA is a joke for many use cases. The problem with this stuff is that proofing requires a big uplift in cost & effort. If I were a service provider, in the absence of a mandate to serve Mr. Krebs or other high-risk targets like him, I would terminate my relationship with him.
- pfg 11y ago
  It seems to me like 2FA would've certainly affected the outcome in this particular case, and probably many other scenarios.