4 ms·
You could be the hacker who got hold of the old recovery email. :/ There's no safe way to do these recovery processes. Weak/lost/compromised password means th
by pas 7y ago
You could be the hacker who got hold of the old recovery email. :/
There's no safe way to do these recovery processes.
Weak/lost/compromised password means that, the account is gone.
Sure it'd be nice to have a fallback that ties recovery to visiting an office, where you establish some shared secrets, biomarkers, etc. But big companies are not into that because probably too few people pay for this. (As they also don't want to depend on a 3rd party for identity management.)
- klipt 7y ago> There's no safe way to do these recovery processes. Imagine if banks said the same thing. "Oh someone changed the password and email on your bank account, sorry you permanently lost access to all that money." If you signed up with your real name, some combination of government id, proof of physical address etc should be enough for recovery. If it's good enough for banks, shouldn't it be good enough for email?
- oefrha 7y agoOkay, so you’re proposing that Google ask for your government ID when you sign up for a Gmail account?
- theli0nheart 7y agoYour comment seems a little aggressive, but that notwithstanding, there is the option of letting users allow it only if they wanted some extra security. 2FA and other safety-related items are optional...so why couldn't this be?
- kijin 7y agoIt doesn't even need to be government ID. As soon as you pay for something, like starting a Google One subscription or buying an app on the Play Store, your billing information should establish your identity. Later when you need to get your account back, you may need to present some sort of government ID and/or proof of address that matches your billing information. It's not bulletproof but it's better than losing access to a paid account forever.
- oefrha 7y agoA paid account, sure, I assume that might already be the case? I certainly don’t expect to lose access to my GSuite account or Google Fi account if I forget my password. However, ggp seems to be talking about a free account, as the vast majority of Gmail accounts are.
- kijin 7y agoYeah, that's unfortunate. But I wouldn't expect a free account to be recoverable. You need to have put something on file, whether government ID or billing info, in order for anyone to verify whether someone who claims to be you is actually you. Americans are weirdly averse to using government IDs, so billing info is really the only option.
- maxerickson 7y agoI mean, for a long time that's how banks dealt with some types of fraud. They even got people calling it "identity theft".
- avip 7y agoIt happens all the time and bank will tell you you have to physically step in a branch with the ID used to open the account. Source: happened to me.
- klipt 7y agoYes and having that option is way better than losing your account forever with no recourse.
- avip 7y agoSure. But I see some trend in comments where people assume you can't be locked out of resources in traditional banking. And that is patently false. It's extremely easy to have a bank account you cannot access. But at least you get to talk to a (useless) person about it.
- deleted 7y ago[deleted]
- pas 7y agoBut that starts with first establishing your identity at the bank. And who knows what would really happen if someone really targeted you and/or your account at that bank. I mean banks I have some dealings with try to match my signature (after checking my gov issued ID cards), but if it doesn't match they just let me look at the screen so I can try something similar. So what would happen were someone walk in with fake ID cards? Probably they could just walk out with my money, and then it's up to the CCTV tapes to maybe "prove" that it wasn't me. If there were truly properly secure and cost effective physical identity assurance services big Internet companies would probably use them.
- enraged_camel 7y ago>>Weak/lost/compromised password means that, the account is gone. Not if you have 2FA enabled. Not that SMS-based crap either. I'm talking about the _real_ stuff, such as TOTP.
- polskibus 7y agoWhat if you lose your phone?
- klipt 7y agoUse Yubikeys, plural.
- sowbug 7y agoTOTP isn't any more real than SMS. Social engineering easily defeats both. Use FIDO2 or U2F. [Cue usual HN discussion about loss or unavailability of physical tokens]
- lukevp 7y agoThis is not true, SMS can be MITMd easily with sim jacking and TOTP is running fully offline.
- sowbug 7y agoTOTP is the one that is more trivially MITMed. SMS is also vulnerable to the Confused Deputy problem.
- oefrha 7y agoFalse. Every MITM technique for TOTP works for SMS. Not the other way round.
- sowbug 7y agoA TOTP-based phishing attack can start entirely from a false origin. The user can enter the offline-generated secret into that false origin and never realize the phishing even happened. SMS MITM is harder to pull off, as the normal UX flow assumes the origin knows the user's phone number, which is a weak measure of authenticity on the part of the origin. If a user is taken to a false origin to begin with, then it must somehow either prompt the user for a phone number (which is likely to signal to the user that something is amiss), or else have an actual communication conduit to the true origin so that it can trick it into initiating the SMS challenge. By the way, we're misusing the term MITM here, but I went with it to keep the conversation going. I believe OP meant phishing. Edit, since we're in a reply war that HN code is properly stifling: of course we're talking about the TOTP generated secret (what you're calling the six-digit PIN), not the shared secret that's transmitted from the origin once at setup time. SMS and TOTP are both atrociously susceptible to social engineering, and SMS has the additional feature that the engineering can happen without any involvement of the user. Your downvoting suggests there's a significant difference between the two, but phishing studies show that all of us, even those of us who consider ourselves experts, are vulnerable to phishing.