3 ms·

That's a working, but very very scary foundation for security. "Google's customers service is _so_ fucked even the most dedicated social engineers with the big

That's a working, but very very scary foundation for security. "Google's customers service is _so_ fucked even the most dedicated social engineers with the biggest of whales in their sights can't get them to do a fucking thing."

red_phone 7y ago
What’s even scarier is the premise of your comment: "Any decent customer service operation will fall prey to social engineering." And what's unfortunate is that you're probably right!
- bigiain 7y ago
  To be fair, banks do an OK job of that. (Well, it's hard to take over an account purely by remote social engineering, some of mine still blindly use SMS as an authentication thing...) Telcos do not secure phone numbers to banking grade security, because they never agreed to be part of anyone's critical security posture, and their own incentives are to make it as easy and quick as possible for customers to move their phone numbers around. It's in the telco's interest for you to be able to walk into a $TelcoBrand store and walk out with a functioning device with your old number. (Or to call up their support line and do the same thing.) They never offered to make that more difficult than it needs to be just because companies like PayPal wanted to outsource security to be somebody else's expense. They've been actively recommending against it since forever: https://www.itnews.com.au/news/telcos-declare-sms-unsafe-for-bank-transactions-322194 https://www.itnews.com.au/news/telcos-declare-sms-unsafe-for...
  - mrb 7y ago
    «To be fair, banks do an OK job of that» Are you kidding? Banks do a terrible job. Just one data point: «Losses from [bank] account takeovers hit $5.1 billion last year, a 120 percent increase over 2016» https://www.aarp.org/money/scams-fraud/info-2018/thieves-targeting-bank-accounts.html https://www.aarp.org/money/scams-fraud/info-2018/thieves-tar...
narrator 7y ago
It would be nice if you could show up in person with a photo id and validate yourself. For a lot of bank transactions in developing countries you have to inconveniently show up in person with your ID because it's a simple way to reduce fraud.
- deleted 7y ago
  [deleted]

red_phone 7y ago

What’s even scarier is the premise of your comment: "Any decent customer service operation will fall prey to social engineering." And what's unfortunate is that you're probably right!

bigiain 7y ago
To be fair, banks do an OK job of that. (Well, it's hard to take over an account purely by remote social engineering, some of mine still blindly use SMS as an authentication thing...) Telcos do not secure phone numbers to banking grade security, because they never agreed to be part of anyone's critical security posture, and their own incentives are to make it as easy and quick as possible for customers to move their phone numbers around. It's in the telco's interest for you to be able to walk into a $TelcoBrand store and walk out with a functioning device with your old number. (Or to call up their support line and do the same thing.) They never offered to make that more difficult than it needs to be just because companies like PayPal wanted to outsource security to be somebody else's expense. They've been actively recommending against it since forever: https://www.itnews.com.au/news/telcos-declare-sms-unsafe-for-bank-transactions-322194 https://www.itnews.com.au/news/telcos-declare-sms-unsafe-for...
- mrb 7y ago
  «To be fair, banks do an OK job of that» Are you kidding? Banks do a terrible job. Just one data point: «Losses from [bank] account takeovers hit $5.1 billion last year, a 120 percent increase over 2016» https://www.aarp.org/money/scams-fraud/info-2018/thieves-targeting-bank-accounts.html https://www.aarp.org/money/scams-fraud/info-2018/thieves-tar...

narrator 7y ago

It would be nice if you could show up in person with a photo id and validate yourself. For a lot of bank transactions in developing countries you have to inconveniently show up in person with your ID because it's a simple way to reduce fraud.

deleted 7y ago
[deleted]