3 ms·
> I have yet to encounter any real solution to this problem I can think of a number of solutions. One of them might be taking advantage of timing + an external
by dataflow 5y ago
> I have yet to encounter any real solution to this problem
I can think of a number of solutions. One of them might be taking advantage of timing + an external contact:
0. Require a point of contact upon signup.
1. If any change requires bypassing ordinary authentication, ask contact to approve.
2. If they approve within M minutes, authorize.
3. If they don't reply within H hours, authorize.
4. If contact rejects operation, then deny.
5. If customer disputes denial, require them to wait O(days) for some out-of-band resolution mechanism (like mail verification, video call + ID verification, or whatever makes sense given the context).
(You can also allow the customer to customize the behavior here if they're e.g. particularly paranoid and want longer delays or explicit approval or whatever... lots of possible variations on this method.)