4 ms·

>Now, you can build systems where it's just impossible for even your own people to get access. But that has a high cost, as you will see in every thread where p

>Now, you can build systems where it's just impossible for even your own people to get access. But that has a high cost, as you will see in every thread where people castigate Google because they got locked out of something. Why can't Google just hire helpdesk people who have super-user access, they ask... I don't see how allowing helpdesk operators to help users recover access to their accounts has any relation at all to the helpdesk operators having access to the account itself. They need to be able to access and update account metadata, not the account itself.

deleted 8y ago
[deleted]
tialaramex 8y ago
> I don't see how allowing helpdesk operators to help users recover access to their accounts has any relation at all to the helpdesk operators having access to the account itself. They need to be able to access and update account metadata, not the account itself. So in your system the bad guy can't read my email because he only has the ability to access and update account metadata such as my password and the helpdesk system doesn't give him access to the actual email? That would work, unless any of the bad guys is smarter than you and realises that they can use this metadata to... log into my account and read my email.
- theaustinseven 8y ago
  If the password is stored in plaintext or can be changed by an admin(in a method other than a reset where the user still sets the new password), we've got other problems.
- 0xffff2 8y ago
  >That would work, unless any of the bad guys is smarter than you and realises that they can use this metadata to... log into my account and read my email. No need to be so rude and disrespectful. Obviously there needs to be a password reset mechanism. That mechanism can absolutely be designed in a way that does not involve the helpdesk operator having access to the password or the account.
  - CamJN 8y ago
    People get locked out of their accounts because in addition to losing their password, they don't have access to the recovery email/phone/whatever which they already set (or never set one at all). If the helpdesk operator has the ability to change or otherwise set a destination for a recovery email/token/pin/secret to be sent then they have the ability to set their own account/device as the trusted reset device/account. There really isn't a way that normal people can use that would allow a helpdesk operator to give them back access to their account without also allowing the helpdesk operator to gain access to the account themselves if they so choose.
    - 0xffff2 8y ago
      Gaining access is different from having access though. The mechanism you're describing would require that the bad actor reset the user's password, which would at least set off some alarm bells. That's very different from being able to eavesdrop invisibly.

deleted 8y ago

[deleted]

tialaramex 8y ago

> I don't see how allowing helpdesk operators to help users recover access to their accounts has any relation at all to the helpdesk operators having access to the account itself. They need to be able to access and update account metadata, not the account itself. So in your system the bad guy can't read my email because he only has the ability to access and update account metadata such as my password and the helpdesk system doesn't give him access to the actual email? That would work, unless any of the bad guys is smarter than you and realises that they can use this metadata to... log into my account and read my email.

theaustinseven 8y ago
If the password is stored in plaintext or can be changed by an admin(in a method other than a reset where the user still sets the new password), we've got other problems.
0xffff2 8y ago
>That would work, unless any of the bad guys is smarter than you and realises that they can use this metadata to... log into my account and read my email. No need to be so rude and disrespectful. Obviously there needs to be a password reset mechanism. That mechanism can absolutely be designed in a way that does not involve the helpdesk operator having access to the password or the account.
- CamJN 8y ago
  People get locked out of their accounts because in addition to losing their password, they don't have access to the recovery email/phone/whatever which they already set (or never set one at all). If the helpdesk operator has the ability to change or otherwise set a destination for a recovery email/token/pin/secret to be sent then they have the ability to set their own account/device as the trusted reset device/account. There really isn't a way that normal people can use that would allow a helpdesk operator to give them back access to their account without also allowing the helpdesk operator to gain access to the account themselves if they so choose.
  - 0xffff2 8y ago
    Gaining access is different from having access though. The mechanism you're describing would require that the bad actor reset the user's password, which would at least set off some alarm bells. That's very different from being able to eavesdrop invisibly.