3 ms·

"they had no idea what I was talking about and clearly had no ability to actually do anything about the 2FA issue" What are they supposed to do to fix your iss

"they had no idea what I was talking about and clearly had no ability to actually do anything about the 2FA issue" What are they supposed to do to fix your issue without compromising their security model? What you describe sounds like 2FA working like it's supposed to.

zackees 5y ago
Their security model locks users out. I nearly lost all my passwords with LastPass when something similar happened to me. Is grandma supposed to file her 128 character recovery code in a safe vault when she just wants to get from the airport? Stop blaming users for them not adapting to terrible authentication experience.
- pmoriarty 5y ago
  I'd be interested in hearing about a better model. To me they're all terrible in one way or another.
  - zackees 5y ago
    If the security is this important then recovery should involve AI facial recognition with human fallback to unlock a device. Or else submitting a passport / drivers license to force unlock. We have global identity systems. Why not use them?
lkbm 5y ago
Disconnect the phone number from that old account and allow him to create a new account using the phone number. If I cancel my phone service, and someone else later ends up with my phone number, does it make sense that that person can never use Uber with their new phone? Phone numbers are less transitory than street addresses, but much more so than email addresses. You should expect some amount of re-use, and need to be able to handle that situation.
joshvm 5y ago
Most companies offer manual processes to get round failed 2FA - for example, provide copies of ID, a video chat to confirm, security questions about account details (eg last trips you took), etc. I've had to do this for a couple of services where the process was quite onerous, but that's the point. Doesn't help if you lose the keys and you're the only one that held them. This happened to me with an SSD that I took out of an old laptop, without realising that But locker stored its key on a chip in the laptop. I didn't even know that I had bitlocker enabled. But Uber shouldn't have your trip details behind end to end encryption, so they should be able to unlock it.
- pmoriarty 5y ago
  ID can be easily faked. Security questions are often shared between services, so someone who's hacked any of the other services could get the answers to these same security questions and then use them to bypass 2FA.
VWWHFSfQ 5y ago
OK, replace "Uber" with your power company. You can't log into your account to update your expired credit card. Are they going to turn off your electricity because you dumb dumb didn't save your backup codes! No of course not. They're going to help you out. Because we live in the real world where people make mistakes.

zackees 5y ago

Their security model locks users out. I nearly lost all my passwords with LastPass when something similar happened to me. Is grandma supposed to file her 128 character recovery code in a safe vault when she just wants to get from the airport? Stop blaming users for them not adapting to terrible authentication experience.

pmoriarty 5y ago
I'd be interested in hearing about a better model. To me they're all terrible in one way or another.
- zackees 5y ago
  If the security is this important then recovery should involve AI facial recognition with human fallback to unlock a device. Or else submitting a passport / drivers license to force unlock. We have global identity systems. Why not use them?

lkbm 5y ago

Disconnect the phone number from that old account and allow him to create a new account using the phone number. If I cancel my phone service, and someone else later ends up with my phone number, does it make sense that that person can never use Uber with their new phone? Phone numbers are less transitory than street addresses, but much more so than email addresses. You should expect some amount of re-use, and need to be able to handle that situation.

joshvm 5y ago

Most companies offer manual processes to get round failed 2FA - for example, provide copies of ID, a video chat to confirm, security questions about account details (eg last trips you took), etc. I've had to do this for a couple of services where the process was quite onerous, but that's the point. Doesn't help if you lose the keys and you're the only one that held them. This happened to me with an SSD that I took out of an old laptop, without realising that But locker stored its key on a chip in the laptop. I didn't even know that I had bitlocker enabled. But Uber shouldn't have your trip details behind end to end encryption, so they should be able to unlock it.

pmoriarty 5y ago
ID can be easily faked. Security questions are often shared between services, so someone who's hacked any of the other services could get the answers to these same security questions and then use them to bypass 2FA.

VWWHFSfQ 5y ago

OK, replace "Uber" with your power company. You can't log into your account to update your expired credit card. Are they going to turn off your electricity because you dumb dumb didn't save your backup codes! No of course not. They're going to help you out. Because we live in the real world where people make mistakes.