3 ms·
What practical ways are there for a company like Twitter to verify your identity for purposes of account restore verification without using some increasingly un
by mattacular 7y ago
What practical ways are there for a company like Twitter to verify your identity for purposes of account restore verification without using some increasingly unreliable piece of info like phone or social security numbers?
The available alternative today is a token 2FA, which has to be setup and requires some savvy, and a number of one-off security codes which are issued at account creation and then the user must figure out how to store securely, indefinitely. Forcing this on the avg Twitter user is obviously a nonstarter.
- ghaff 7y agoIt's certainly a conundrum. Depending upon the type of account involved, there has to be some reasonable medium between 1. Accounts/resets performed because you asked nicely and maybe provided some laughably easy-to-obtain information and 2. Showing up at the Twitter office in San Francisco with notarized copies of your birth certificate, latest utility bill, Social Security Card, etc. And that happy medium will doubtless be both vulnerable to a determined targeted attack and a sufficient PITA for some users that they'll end up losing access to an account.