3 ms·

I understand the point of view, but it still smacks of weak process. Support should not be able to do anything other than trigger an email reset link. If they l

by cal5k 8y ago

I understand the point of view, but it still smacks of weak process. Support should not be able to do anything other than trigger an email reset link. If they lost the email password, they need to take it up with their email provider. Otherwise a manual process involving ID verification of some type should be required to reset the email or phone number on the account. I’m not saying doing this properly is easy, but I think “don’t use SMS ever” is a bit extreme.

StavrosK 8y ago
This is just offloading the responsibility for security to the email provider. If their security is weaker than yours, you've disadvantaged your users. If you have an easy way to do ID verification, that's great, but that's not always possible.
- jessaustin 8y ago
  Isn't email still the skeleton key? Most popular email providers can be secure enough for many uses. We could imagine e.g. a bank that hands out OTP devices to its high-value customers who bring passports to the bank, but that's overkill for many situations.
jschwartzi 8y ago
Ideally the manual process should require ID verification live and in-person, not over the phone. This raises the bar for an attacker from "has to have access to the Equifax hacked database" to "has to get a decent fake ID made before their appointment with the ID verification people."
- cal5k 8y ago
  That's actually a really good point. I'm not sure what options are available in the US, but Canada Post has a service for exactly this purpose: https://www.canadapost.ca/cpc/en/business/postal-services/digital-proof-identity.page https://www.canadapost.ca/cpc/en/business/postal-services/di...
  - derekp7 8y ago
    One way of implementing it in the US is what Paypal does, which is assume that your bank has authenticated you, then deposit a couple small random amounts that you have to report back. Another way is to charge a fee for last-resort password resets. Charge $10.00 to the user's credit card, if the account info matches, and refund $5.00 in two random small amounts for them to retrieve off their online account statement and report those numbers back to you.
    - jschwartzi 8y ago
      What if the user's bank account is compromised using the Equifax dump?
  - WorldMaker 8y ago
    That would be a good service for the USPS to add, though unlikely that they would provide it for the same reason they no longer provide Notary services: in the US identification is generally considered a role for the state-level (it's a wonder we don't have state-issued passports and there is a federal agency involved in that much). That said, I wonder if it would be useful to encourage more usage of Notaries for ID verification in such matters. There's no easy digital API to request a notary's involvement (yet?), and there are complications between states/countries in what powers/abilities/checks/balances notaries have. But it is an ancient business practice to ask "please get this form notarized with valid ID", so why not just update that for contemporary needs?

by cal5k 8y ago

StavrosK 8y ago

This is just offloading the responsibility for security to the email provider. If their security is weaker than yours, you've disadvantaged your users. If you have an easy way to do ID verification, that's great, but that's not always possible.

jessaustin 8y ago
Isn't email still the skeleton key? Most popular email providers can be secure enough for many uses. We could imagine e.g. a bank that hands out OTP devices to its high-value customers who bring passports to the bank, but that's overkill for many situations.

jschwartzi 8y ago

Ideally the manual process should require ID verification live and in-person, not over the phone. This raises the bar for an attacker from "has to have access to the Equifax hacked database" to "has to get a decent fake ID made before their appointment with the ID verification people."

cal5k 8y ago
That's actually a really good point. I'm not sure what options are available in the US, but Canada Post has a service for exactly this purpose: https://www.canadapost.ca/cpc/en/business/postal-services/digital-proof-identity.page https://www.canadapost.ca/cpc/en/business/postal-services/di...
- derekp7 8y ago
  One way of implementing it in the US is what Paypal does, which is assume that your bank has authenticated you, then deposit a couple small random amounts that you have to report back. Another way is to charge a fee for last-resort password resets. Charge $10.00 to the user's credit card, if the account info matches, and refund $5.00 in two random small amounts for them to retrieve off their online account statement and report those numbers back to you.
  - jschwartzi 8y ago
    What if the user's bank account is compromised using the Equifax dump?
- WorldMaker 8y ago
  That would be a good service for the USPS to add, though unlikely that they would provide it for the same reason they no longer provide Notary services: in the US identification is generally considered a role for the state-level (it's a wonder we don't have state-issued passports and there is a federal agency involved in that much). That said, I wonder if it would be useful to encourage more usage of Notaries for ID verification in such matters. There's no easy digital API to request a notary's involvement (yet?), and there are complications between states/countries in what powers/abilities/checks/balances notaries have. But it is an ancient business practice to ask "please get this form notarized with valid ID", so why not just update that for contemporary needs?