7 ms·

Security and convenience are usually in direct competition with each other. Customer service people have to listen to people yell at them when convenience is s

by slg 5y ago

Security and convenience are usually in direct competition with each other. Customer service people have to listen to people yell at them when convenience is sacrificed and aren't held accountable for security problems. They therefore optimize for customer convenience. I don't completely fault them for it. If anyone has had the frustration of sitting on the phone with a customer service rep trying to remember a PIN code that was setup 5 years ago when signing up with an ISP and was never thought about since, you can probably understand it. It is easy to blame a single person or a single company for poor practices, but I have yet to encounter any real solution to this problem that allows someone to prove they are who they say they are which is able to hit the sweet spot between too many false positives (hijacked accounts) and too many false negatives (valid customers locked out). If I was a security-minded person looking for startup ideas, this is the problem I would be looking to solve.

lrvick 5y ago
We already have a solution: WebAuthn. Almost every phone and laptop today supports it, and you can optionally have a backup in the form of a $10 keychain device or 24 words written on paper. This does mean people will be best off to keep at least one backup safe with other things they can't afford to lose like their SSN card and drivers license. Once WebAuthn is setup then day to day as long as a person has not lost -all- their devices, then remote identity verification can be fast tracked. If they have lost all their devices it would be like if they lost all citizenship paperwork and will be a longer, generally in person, process involving reference verification and a waiting period.
- haukem 5y ago
  Why are only very few services supporting WebAuthn? Google and github supprot WebAuthn, but most services only support OATH-TOTP, OATH-HOTP or even worse only their own app.
  - dheera 5y ago
    If something doesn't support Web'n'Auth you can use TOTP with a Yubikey, the TOTP moves with the key, much better than those dumb authenticator possibly-spyware apps.
    - chris37879 5y ago
      Since moving my totp keys onto a yubikey, I device hop with wild abandon since I know I can't accidentally bork my 2fa, it's great.
    - tyingq 5y ago
      Generating the 6 digit codes from a TOTP seed is < 10 lines of python and requires only core modules. Meaning it's pretty easy to find or make a client you would trust.
    - Dylan16807 5y ago
      > much better than those dumb authenticator possibly-spyware apps If the google or microsoft TOTP app is spyware, I have bigger problems. I don't see what's dumb about them either.
      - dheera 5y ago
        They are dumb because - they involve storing secrets on a readable filesystem - are tied to a particular instance of a filesystem, not actually tied to a piece of hardware, which fails the "something you have" part of 2FA - either (a) fail if you reinstall your OS, OR (b) need to transmit secrets to Google and Microsoft to allow you to reinstall the OS, both bad With Yubikey TOTP you cannot read back the secret, the hardware itself doesn't provide an interface to do that.
        Dylan16807 5y ago
        For a normal user with an app that doesn't allow export, it's more or less equivalent to a yubikey. There's no reasonable way to get the secrets out of a locked phone or a yubikey, but an expert with a lot of resources probably could. And a normal user isn't reinstalling their phone OS so that worry's out of the way. For apps that do allow export/transfer, it's up to the user if they want to keep the secret safe. But really at some point it's up to the user no matter what method or hardware you use. And since most sites don't have an easy way to have multiple tokens, allowing export/transfer also reduces the temptation to insecurely store a copy of enrollment QR codes.
  - tialaramex 5y ago
    Reluctantly I think my conclusion is the majority of services do not care.
- slg 5y ago
  The ideal solution should hopefully handle a "mugged in a foreign country" hypothetical. If a normal person traveling abroad loses both their wallet and phone, would they be able to regain access to their digital life before they got home? With Sprint/T-Mobile's current approach, the answer would be yes. With WebAuthn, it is a big maybe and is probably a no for most people. We are back at the security versus convenience choice.
  - jdavis703 5y ago
    I think most people carry their security keys on their keyring. And since most muggers don't demand keys I think people should generally be safe.
    - eikenberry 5y ago
      Except many people keep their keyring in their bag and muggers often just grab the bag.
      - pishpash 5y ago
        Then keep another key somewhere else, like with a fellow traveler or at the hotel. This is why people make copies of physical keys. All security is physical security. We need to end the delusion that it is not or can somehow be bypassed, and embrace it instead.
        tannedNerd 5y ago
        And when you get mugged in transit from the hotel to the airport or vis-versa your plan falls apart. Unless you are going to pay someone to drive a different route in a different car with your hardware key...
        bashinator 5y ago
        You can’t duplicate hardware MFA keys. You’d have to individually set up the second device everywhere you use MFA, and many services only support a single device (looking at you, AWS).
- bbarnett 5y ago
  People can't recall their 4 pin password, but you think they will store docs in a safe? The problem is, no matter what you tell the average person, they are not capable of such diligence.
  - lrvick 5y ago
    Then they will experience pain at some point, and that pain will cause them to seek out ways to not have that pain in the future. Ask anyone who makes diligent backups why they do it. You will hear a story of pain that taught them. This is sadly just how most humans work.
    - bbarnett 5y ago
      There are those which learn from such things, this is true. There are those which will never, ever learn. Ever. And it is a large part of the population.
- vanburen 5y ago
  "24 words written on paper." That's cool, I didn't realise it was possible to backup the webauthn secret this way. I googled but couldn't find any documentation on how to set this up, could you let me know how you set this up? Not being able to make backup of the Webauthn secret is why I have stuck with TOTP so far.
  - chris37879 5y ago
    It's not exactly part of the webauthn standard. Or at least not a described part, it falls under the 'roaming authenticator' and 'backup credentials' mentioned in the spec, effectively it's a function that generates a crypto key where the key matter is the 24 randomly chosen words. It's basically just _another_ key that a service can setup and store for your, but encrypted with the secret they share with you up front in the form of those words.
  - wereHamster 5y ago
    The Ledger hardware wallet can act as a FIDO U2F (probably other hardware wallets as well). And to back up a hardware wallet you write down the 24 words…
- kube-system 5y ago
  > If they have lost all their devices it would be like if they lost all citizenship paperwork If you're running something like a phone company in the US, millions of the people you service probably aren't citizens. If your process is "longer, generally in person, process involving reference verification and a waiting period", then your competitor will get those customers instead. Prepaid plans first became very popular in the US in part because they do not require bank accounts or SSNs.
- danShumway 5y ago
  > Almost every phone and laptop today supports it Eh. I'm super excited for WebAuthn, but unless my sources are out of date it's far from being supported everywhere (https://webauthn.me/browser-support https://webauthn.me/browser-support). A giant challenge with WebAuthn is the lack of platform authenticator integrations, particularly on Linux. You basically need to buy a separate key. And if you're on Android and you swapped out Chrome for Firefox (which you should do) then even the physical key stops working. I desperately want to start using WebAuthn everywhere and I desperately want to start encouraging devs to swap over to it for most new logins. But I don't think I can. I don't know that I own a single phone or desktop that as configured can use WebAuthn without a security key. If I'm doing something wrong, or if there's some config option that just hasn't gotten flipped by default on platforms like Firefox Linux, then I'd love to know.
  - psanford 5y ago
    I made a FIDO token (a platform authenticator) implementation that uses the TPM to protect your private keys on Linux: https://github.com/psanford/tpm-fido https://github.com/psanford/tpm-fido
    - apostacy 5y ago
      That's really cool. Is it possible to use it without a hardware TPM, for testing? I have used rust-u2f in the past for that purpose.
      - psanford 5y ago
        Yup, there's a flag `-backend memory` that generates ephemeral keys in memory.
    - lrvick 5y ago
      As I understand this, if malware is on the machine it can do unlimited WebAuthn validations in the background without user interaction. Anchoring to physical human interaction with a button or biometric sensor is a huge security property I don't think current gen TPMs can solve for. In a typical implementation someone must be present at the machine expecting a tap, and tapping. That said, overall this is a clever best effort for when a TPM is all a user has and you at least want to prove a given machine is involved in with.
- EE84M3i 5y ago
  >drivers license How does anyone keep their drivers license in a safe? If they don't drive?
  - tyingq 5y ago
    At least in the places I've been in the US, law enforcement doesn't seem to care if you have your physical license with you. They just look it up, since they are doing that anyway...whether you have it or not. I'm sure that varies, though.
    - NavinF 5y ago
      That's very surprising. How do they look up your license? Using your name? Driving is without a license in your "immediate possession" is definitely against the law in California[1] and I've never met someone that intentionally leaves it at home. Restaurants that card for alcohol also makes this a no-go for most people. 1: https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=VEH&sectionNum=12951 https://leginfo.legislature.ca.gov/faces/codes_displaySectio...
      - michaelt 5y ago
        In the UK you don't have to carry your license or insurance while driving - although you can be required to give your name, and to take those documents to a police station within 7 days. For certain crimes they can also arrest you and/or seize your vehicle. Of course, in the UK car registration plates are issued and attached by the dealer, before a car's first sale, and they never expire. So they can find the registered keeper of a vehicle just by looking at the plates.
        FDSGSG 5y ago
        >Of course, in the UK car registration plates are issued and attached by the dealer, before a car's first sale, and they never expire. So they can find the registered keeper of a vehicle just by looking at the plates. Yet another situation where foreign registered vehicles are essentially immune from UK traffic enforcement.
- kortilla 5y ago
  > with other things they can't afford to lose like their SSN card and drivers license. Both of those things are trivial to replace.
  - lrvick 5y ago
    If you lose all your ID and don't have family to vouch for you, getting ID back is a real nightmare. I have seen it take months even with living family in the picture. Getting access to an AWS root account you are locked out of however just requires -photos- of identity documents and billing verification etc. I would way rather have the latter problem.
ummonk 5y ago
The ideal would be DNA-based authentication. You go to their store, they prick you and use rapid sequencing to verify that you are who you say you are.
- Jolter 5y ago
  If you have to go to a store, wouldn’t a government issued ID be sufficient and less invasive?
  - ummonk 5y ago
    What if you lose your government ID? What if someone fakes your ID?
    - Jolter 5y ago
      What if someone bribes the person taking the dna sample? Corrupt telecom employees have already been complicit in ID fraud by redirecting SMS traffic to attackers. How does the business know the DNA used to set up an account for Bob comes from him and not from attacker Bill? They would have to take his ID at his first visit so you’re still vulnerable to ID fraud. We can argue back and forth but IMO the DNA idea has two problems: 1 It is too invasive as it requires customers to reveal their DNA to the business. 2 It is impractical. Firstly, the technology doesn’t exist. Secondly, it requires a physical visit to authenticate.
    - beardyw 5y ago
      Or it turns out you are officially dead. BBC News - India's living dead: 'They stared at me like I was a ghost' https://www.bbc.co.uk/news/stories-58259497 https://www.bbc.co.uk/news/stories-58259497
- ipaddr 5y ago
  Why not take cheek samples? Wouldn't a finger print be easier? Why would you need to go to the store plenty of dna sequencing happens over the mail for ancestry and alike. Partner with them and offer discounted dna results. Ideally you do this once and keep a card and use it everywhere.
dataflow 5y ago
> I have yet to encounter any real solution to this problem I can think of a number of solutions. One of them might be taking advantage of timing + an external contact: 0. Require a point of contact upon signup. 1. If any change requires bypassing ordinary authentication, ask contact to approve. 2. If they approve within M minutes, authorize. 3. If they don't reply within H hours, authorize. 4. If contact rejects operation, then deny. 5. If customer disputes denial, require them to wait O(days) for some out-of-band resolution mechanism (like mail verification, video call + ID verification, or whatever makes sense given the context). (You can also allow the customer to customize the behavior here if they're e.g. particularly paranoid and want longer delays or explicit approval or whatever... lots of possible variations on this method.)
IncRnd 5y ago
The PUK itself is one such method. An ID is another. Have a separate contact #. And so on. There are many ways, but the essence is to have something out-of-band. It's really very simple. Generally speaking, there are three classes of auth, who you are, what you have, and what you know. Single factor auth is meaningless, which is why many people are stumped by this situation. Use two factor auth, which is verification from two separate categories. Certain industries use 1.5 auth. There are also software and hardware tokens. Those are generally what you have (and might spill into what you know), but are also time-bound. Ultimately, security is risk-management. Risk can also be transfered, such as by using a different identity provider. Then it is no longer the company's issue to solve.
roywiggins 5y ago
I've never used it, but I've always been impressed with NearlyFreeSpeech's recovery procedure, at least as listed: https://www.nearlyfreespeech.net/about/faq#LostEverything https://www.nearlyfreespeech.net/about/faq#LostEverything It's on the paranoid end of usable, it seems to me
deleted 5y ago
[deleted]
brianmanning0 5y ago
This is exactly the problem/solution we're working on at https://www.sharehold.com https://www.sharehold.com :) You're quite right that it is about striking that balance. We do it by keeping the app focused on recovery codes. From there, users can optionally assemble their own personal recovery team of trusted contacts. Either way, users get the same universal account recovery experience for every one of their accounts on every service.
deleted 5y ago
[deleted]
deleted 5y ago
[deleted]
deleted 5y ago
[deleted]
deleted 5y ago
[deleted]
deleted 5y ago
[deleted]
deleted 5y ago
[deleted]
dumpsterdiver 5y ago
> It is easy to blame a single person or a single company for poor practices, but I have yet to encounter any real solution to this problem that allows someone to prove they are who they say they are which is able to hit the sweet spot between too many false positives (hijacked accounts) and too many false negatives (valid customers locked out). We're getting there. Authentication comes down to three things, "Something you know (a password in your head), something you have (a private key, or a phone that gives you a code), and something you are (your face, a retinal scan, or a fingerprint)". In most cases, people won't lose what they are. There are of course exceptions, such as injuries by fire - which brings us right back to step one, hounding poor support agents with a (possibly fabricated) sob story. The weakest link is often the support folks who can press a button and allow the attacker to authenticate.
hellbannedguy 5y ago
I don't think yelling at customer service is nearly as common as it was years ago. Why? The person on the other end usually doesn't speak the same language, or if they do--it's not their native tongue. There's no point in getting mad when they don't quite understand why you are calling in the first place. Companies need to stop outsourcing Customer Service to the cheapest country. Having a command over the customer's language might prevent a lot of security mixups?
- pjc50 5y ago
  > There's no point in getting mad This has never stopped people getting angry.
geocar 5y ago
> I have yet to encounter any real solution to this problem that allows someone to prove they are who they say they are I think the solution is third-party attestation. The government can offer an identity service - it doesn't need to be linked to your real-person, but could simply require proof of residency (by say, mailing you a postcard that you would bring in), but once established, you could use this service to attest your identity to third-parties. There are companies that increasingly offer this service (like Facebook, Google, Amazon, and Apple) but I think they struggle to avoid conflicts-of-interest in offering this service, so they make me nervous how popular they are becoming in the US and UK. Where I live, the government provides a smartcard which you can use with government websites and a few non-government sites, and this is used as a second-factor for making critical changes. If I lose this smartcard, I have to go into a government office with some documentation to start the process of getting a new one (where it will be mailed to me, and I can bring it in with documentation to be activated). I don't find this onerous; I don't have to use the smartcard to do any "normal" things -- the non-government sites (and some of the government sites) allow me to log in using just a password and a mobile-app, but if I were to lose my phone (or my password), I know I have a government-provided recovery mechanism. Finally, anticipating a particular antagonist of this idea: As far as I know, the government doesn't actually know what services I use this smartcard with (unless the company shares this information, but we already know Facebook and Google and probably Amazon and Apple do) and I have multiple cards with different identifying details on them, so I think any privacy risk is minimal.
- arcticbull 5y ago
  I've seen a lot of both private (MGM properties in Vegas, at least Vdara) and public (CA DMV) using id.me for this purpose. It actually works really well.
  - geocar 5y ago
    I believe id.me is a corporation that sells your personal data, and the identity-holder doesn't benefit from id.me selling their data. Their privacy policy makes mention of list-scrubbing services and marketing uses of data, and other shady things that I understand are quite normal in the US, but make me nervous. This is part of what I was referring to by "conflicts of interest": I don't see how any private corporation could possibly be trusted to do this.

by slg 5y ago

lrvick 5y ago

We already have a solution: WebAuthn. Almost every phone and laptop today supports it, and you can optionally have a backup in the form of a $10 keychain device or 24 words written on paper. This does mean people will be best off to keep at least one backup safe with other things they can't afford to lose like their SSN card and drivers license. Once WebAuthn is setup then day to day as long as a person has not lost -all- their devices, then remote identity verification can be fast tracked. If they have lost all their devices it would be like if they lost all citizenship paperwork and will be a longer, generally in person, process involving reference verification and a waiting period.

haukem 5y ago
Why are only very few services supporting WebAuthn? Google and github supprot WebAuthn, but most services only support OATH-TOTP, OATH-HOTP or even worse only their own app.
- dheera 5y ago
  If something doesn't support Web'n'Auth you can use TOTP with a Yubikey, the TOTP moves with the key, much better than those dumb authenticator possibly-spyware apps.
  - chris37879 5y ago
    Since moving my totp keys onto a yubikey, I device hop with wild abandon since I know I can't accidentally bork my 2fa, it's great.
  - tyingq 5y ago
    Generating the 6 digit codes from a TOTP seed is < 10 lines of python and requires only core modules. Meaning it's pretty easy to find or make a client you would trust.
  - Dylan16807 5y ago
    > much better than those dumb authenticator possibly-spyware apps If the google or microsoft TOTP app is spyware, I have bigger problems. I don't see what's dumb about them either.
    - dheera 5y ago
      They are dumb because - they involve storing secrets on a readable filesystem - are tied to a particular instance of a filesystem, not actually tied to a piece of hardware, which fails the "something you have" part of 2FA - either (a) fail if you reinstall your OS, OR (b) need to transmit secrets to Google and Microsoft to allow you to reinstall the OS, both bad With Yubikey TOTP you cannot read back the secret, the hardware itself doesn't provide an interface to do that.
      - Dylan16807 5y ago
        For a normal user with an app that doesn't allow export, it's more or less equivalent to a yubikey. There's no reasonable way to get the secrets out of a locked phone or a yubikey, but an expert with a lot of resources probably could. And a normal user isn't reinstalling their phone OS so that worry's out of the way. For apps that do allow export/transfer, it's up to the user if they want to keep the secret safe. But really at some point it's up to the user no matter what method or hardware you use. And since most sites don't have an easy way to have multiple tokens, allowing export/transfer also reduces the temptation to insecurely store a copy of enrollment QR codes.
- tialaramex 5y ago
  Reluctantly I think my conclusion is the majority of services do not care.
slg 5y ago
The ideal solution should hopefully handle a "mugged in a foreign country" hypothetical. If a normal person traveling abroad loses both their wallet and phone, would they be able to regain access to their digital life before they got home? With Sprint/T-Mobile's current approach, the answer would be yes. With WebAuthn, it is a big maybe and is probably a no for most people. We are back at the security versus convenience choice.
- jdavis703 5y ago
  I think most people carry their security keys on their keyring. And since most muggers don't demand keys I think people should generally be safe.
  - eikenberry 5y ago
    Except many people keep their keyring in their bag and muggers often just grab the bag.
    - pishpash 5y ago
      Then keep another key somewhere else, like with a fellow traveler or at the hotel. This is why people make copies of physical keys. All security is physical security. We need to end the delusion that it is not or can somehow be bypassed, and embrace it instead.
      - tannedNerd 5y ago
        And when you get mugged in transit from the hotel to the airport or vis-versa your plan falls apart. Unless you are going to pay someone to drive a different route in a different car with your hardware key...
      - bashinator 5y ago
        You can’t duplicate hardware MFA keys. You’d have to individually set up the second device everywhere you use MFA, and many services only support a single device (looking at you, AWS).
bbarnett 5y ago
People can't recall their 4 pin password, but you think they will store docs in a safe? The problem is, no matter what you tell the average person, they are not capable of such diligence.
- lrvick 5y ago
  Then they will experience pain at some point, and that pain will cause them to seek out ways to not have that pain in the future. Ask anyone who makes diligent backups why they do it. You will hear a story of pain that taught them. This is sadly just how most humans work.
  - bbarnett 5y ago
    There are those which learn from such things, this is true. There are those which will never, ever learn. Ever. And it is a large part of the population.
vanburen 5y ago
"24 words written on paper." That's cool, I didn't realise it was possible to backup the webauthn secret this way. I googled but couldn't find any documentation on how to set this up, could you let me know how you set this up? Not being able to make backup of the Webauthn secret is why I have stuck with TOTP so far.
- chris37879 5y ago
  It's not exactly part of the webauthn standard. Or at least not a described part, it falls under the 'roaming authenticator' and 'backup credentials' mentioned in the spec, effectively it's a function that generates a crypto key where the key matter is the 24 randomly chosen words. It's basically just _another_ key that a service can setup and store for your, but encrypted with the secret they share with you up front in the form of those words.
- wereHamster 5y ago
  The Ledger hardware wallet can act as a FIDO U2F (probably other hardware wallets as well). And to back up a hardware wallet you write down the 24 words…
kube-system 5y ago
> If they have lost all their devices it would be like if they lost all citizenship paperwork If you're running something like a phone company in the US, millions of the people you service probably aren't citizens. If your process is "longer, generally in person, process involving reference verification and a waiting period", then your competitor will get those customers instead. Prepaid plans first became very popular in the US in part because they do not require bank accounts or SSNs.
danShumway 5y ago
> Almost every phone and laptop today supports it Eh. I'm super excited for WebAuthn, but unless my sources are out of date it's far from being supported everywhere (https://webauthn.me/browser-support https://webauthn.me/browser-support). A giant challenge with WebAuthn is the lack of platform authenticator integrations, particularly on Linux. You basically need to buy a separate key. And if you're on Android and you swapped out Chrome for Firefox (which you should do) then even the physical key stops working. I desperately want to start using WebAuthn everywhere and I desperately want to start encouraging devs to swap over to it for most new logins. But I don't think I can. I don't know that I own a single phone or desktop that as configured can use WebAuthn without a security key. If I'm doing something wrong, or if there's some config option that just hasn't gotten flipped by default on platforms like Firefox Linux, then I'd love to know.
- psanford 5y ago
  I made a FIDO token (a platform authenticator) implementation that uses the TPM to protect your private keys on Linux: https://github.com/psanford/tpm-fido https://github.com/psanford/tpm-fido
  - apostacy 5y ago
    That's really cool. Is it possible to use it without a hardware TPM, for testing? I have used rust-u2f in the past for that purpose.
    - psanford 5y ago
      Yup, there's a flag `-backend memory` that generates ephemeral keys in memory.
  - lrvick 5y ago
    As I understand this, if malware is on the machine it can do unlimited WebAuthn validations in the background without user interaction. Anchoring to physical human interaction with a button or biometric sensor is a huge security property I don't think current gen TPMs can solve for. In a typical implementation someone must be present at the machine expecting a tap, and tapping. That said, overall this is a clever best effort for when a TPM is all a user has and you at least want to prove a given machine is involved in with.
EE84M3i 5y ago
>drivers license How does anyone keep their drivers license in a safe? If they don't drive?
- tyingq 5y ago
  At least in the places I've been in the US, law enforcement doesn't seem to care if you have your physical license with you. They just look it up, since they are doing that anyway...whether you have it or not. I'm sure that varies, though.
  - NavinF 5y ago
    That's very surprising. How do they look up your license? Using your name? Driving is without a license in your "immediate possession" is definitely against the law in California[1] and I've never met someone that intentionally leaves it at home. Restaurants that card for alcohol also makes this a no-go for most people. 1: https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=VEH&sectionNum=12951 https://leginfo.legislature.ca.gov/faces/codes_displaySectio...
    - michaelt 5y ago
      In the UK you don't have to carry your license or insurance while driving - although you can be required to give your name, and to take those documents to a police station within 7 days. For certain crimes they can also arrest you and/or seize your vehicle. Of course, in the UK car registration plates are issued and attached by the dealer, before a car's first sale, and they never expire. So they can find the registered keeper of a vehicle just by looking at the plates.
      - FDSGSG 5y ago
        >Of course, in the UK car registration plates are issued and attached by the dealer, before a car's first sale, and they never expire. So they can find the registered keeper of a vehicle just by looking at the plates. Yet another situation where foreign registered vehicles are essentially immune from UK traffic enforcement.
kortilla 5y ago
> with other things they can't afford to lose like their SSN card and drivers license. Both of those things are trivial to replace.
- lrvick 5y ago
  If you lose all your ID and don't have family to vouch for you, getting ID back is a real nightmare. I have seen it take months even with living family in the picture. Getting access to an AWS root account you are locked out of however just requires -photos- of identity documents and billing verification etc. I would way rather have the latter problem.

ummonk 5y ago

The ideal would be DNA-based authentication. You go to their store, they prick you and use rapid sequencing to verify that you are who you say you are.

Jolter 5y ago
If you have to go to a store, wouldn’t a government issued ID be sufficient and less invasive?
- ummonk 5y ago
  What if you lose your government ID? What if someone fakes your ID?
  - Jolter 5y ago
    What if someone bribes the person taking the dna sample? Corrupt telecom employees have already been complicit in ID fraud by redirecting SMS traffic to attackers. How does the business know the DNA used to set up an account for Bob comes from him and not from attacker Bill? They would have to take his ID at his first visit so you’re still vulnerable to ID fraud. We can argue back and forth but IMO the DNA idea has two problems: 1 It is too invasive as it requires customers to reveal their DNA to the business. 2 It is impractical. Firstly, the technology doesn’t exist. Secondly, it requires a physical visit to authenticate.
  - beardyw 5y ago
    Or it turns out you are officially dead. BBC News - India's living dead: 'They stared at me like I was a ghost' https://www.bbc.co.uk/news/stories-58259497 https://www.bbc.co.uk/news/stories-58259497
ipaddr 5y ago
Why not take cheek samples? Wouldn't a finger print be easier? Why would you need to go to the store plenty of dna sequencing happens over the mail for ancestry and alike. Partner with them and offer discounted dna results. Ideally you do this once and keep a card and use it everywhere.

dataflow 5y ago

> I have yet to encounter any real solution to this problem I can think of a number of solutions. One of them might be taking advantage of timing + an external contact: 0. Require a point of contact upon signup. 1. If any change requires bypassing ordinary authentication, ask contact to approve. 2. If they approve within M minutes, authorize. 3. If they don't reply within H hours, authorize. 4. If contact rejects operation, then deny. 5. If customer disputes denial, require them to wait O(days) for some out-of-band resolution mechanism (like mail verification, video call + ID verification, or whatever makes sense given the context). (You can also allow the customer to customize the behavior here if they're e.g. particularly paranoid and want longer delays or explicit approval or whatever... lots of possible variations on this method.)

IncRnd 5y ago

The PUK itself is one such method. An ID is another. Have a separate contact #. And so on. There are many ways, but the essence is to have something out-of-band. It's really very simple. Generally speaking, there are three classes of auth, who you are, what you have, and what you know. Single factor auth is meaningless, which is why many people are stumped by this situation. Use two factor auth, which is verification from two separate categories. Certain industries use 1.5 auth. There are also software and hardware tokens. Those are generally what you have (and might spill into what you know), but are also time-bound. Ultimately, security is risk-management. Risk can also be transfered, such as by using a different identity provider. Then it is no longer the company's issue to solve.

roywiggins 5y ago

I've never used it, but I've always been impressed with NearlyFreeSpeech's recovery procedure, at least as listed: https://www.nearlyfreespeech.net/about/faq#LostEverything https://www.nearlyfreespeech.net/about/faq#LostEverything It's on the paranoid end of usable, it seems to me

deleted 5y ago

[deleted]

brianmanning0 5y ago

This is exactly the problem/solution we're working on at https://www.sharehold.com https://www.sharehold.com :) You're quite right that it is about striking that balance. We do it by keeping the app focused on recovery codes. From there, users can optionally assemble their own personal recovery team of trusted contacts. Either way, users get the same universal account recovery experience for every one of their accounts on every service.

deleted 5y ago

[deleted]

deleted 5y ago

[deleted]

deleted 5y ago

[deleted]

deleted 5y ago

[deleted]

deleted 5y ago

[deleted]

deleted 5y ago

[deleted]

dumpsterdiver 5y ago

> It is easy to blame a single person or a single company for poor practices, but I have yet to encounter any real solution to this problem that allows someone to prove they are who they say they are which is able to hit the sweet spot between too many false positives (hijacked accounts) and too many false negatives (valid customers locked out). We're getting there. Authentication comes down to three things, "Something you know (a password in your head), something you have (a private key, or a phone that gives you a code), and something you are (your face, a retinal scan, or a fingerprint)". In most cases, people won't lose what they are. There are of course exceptions, such as injuries by fire - which brings us right back to step one, hounding poor support agents with a (possibly fabricated) sob story. The weakest link is often the support folks who can press a button and allow the attacker to authenticate.

hellbannedguy 5y ago

I don't think yelling at customer service is nearly as common as it was years ago. Why? The person on the other end usually doesn't speak the same language, or if they do--it's not their native tongue. There's no point in getting mad when they don't quite understand why you are calling in the first place. Companies need to stop outsourcing Customer Service to the cheapest country. Having a command over the customer's language might prevent a lot of security mixups?

pjc50 5y ago
> There's no point in getting mad This has never stopped people getting angry.

geocar 5y ago

> I have yet to encounter any real solution to this problem that allows someone to prove they are who they say they are I think the solution is third-party attestation. The government can offer an identity service - it doesn't need to be linked to your real-person, but could simply require proof of residency (by say, mailing you a postcard that you would bring in), but once established, you could use this service to attest your identity to third-parties. There are companies that increasingly offer this service (like Facebook, Google, Amazon, and Apple) but I think they struggle to avoid conflicts-of-interest in offering this service, so they make me nervous how popular they are becoming in the US and UK. Where I live, the government provides a smartcard which you can use with government websites and a few non-government sites, and this is used as a second-factor for making critical changes. If I lose this smartcard, I have to go into a government office with some documentation to start the process of getting a new one (where it will be mailed to me, and I can bring it in with documentation to be activated). I don't find this onerous; I don't have to use the smartcard to do any "normal" things -- the non-government sites (and some of the government sites) allow me to log in using just a password and a mobile-app, but if I were to lose my phone (or my password), I know I have a government-provided recovery mechanism. Finally, anticipating a particular antagonist of this idea: As far as I know, the government doesn't actually know what services I use this smartcard with (unless the company shares this information, but we already know Facebook and Google and probably Amazon and Apple do) and I have multiple cards with different identifying details on them, so I think any privacy risk is minimal.

arcticbull 5y ago
I've seen a lot of both private (MGM properties in Vegas, at least Vdara) and public (CA DMV) using id.me for this purpose. It actually works really well.
- geocar 5y ago
  I believe id.me is a corporation that sells your personal data, and the identity-holder doesn't benefit from id.me selling their data. Their privacy policy makes mention of list-scrubbing services and marketing uses of data, and other shady things that I understand are quite normal in the US, but make me nervous. This is part of what I was referring to by "conflicts of interest": I don't see how any private corporation could possibly be trusted to do this.