2 ms·

The two quotes you picked out don't do it justice. > After being asked, the technical support worker gained access to Grant’s locked server pen, plugged in a l

• kbenson 9y ago
  It is (or at least sounds so from the details given), but this dovetails right into the current discussions about identity and verification and how to do each well in an age where much of your personal identification is spread around the internet and easily obtainable. Would we really think it was less mind-bogglingly stupid if there was an email verification beforehand but the hacker had compromised the email account? Probably, but maybe not by much. It's a hurdle, but not always an unsurpassable one, and sometimes not hard at all (how hard is it to convince the tech that the reason you're calling is because you route all mail to the server in question and it has crashed, so email verification doesn't work so you need to fall back on other provided info?). Good procedures and policies can help, but that also means the attacker knows exactly what's needed to defeat them.