2 ms·

At a minimum, a good system would email both old and new email addresses saying, "someone has changed the email address, click here if that is wrong". This kind

At a minimum, a good system would email both old and new email addresses saying, "someone has changed the email address, click here if that is wrong". This kind of slapdash approach to security needs to become criminal because companies are clearly not following best-practices and to be honest, as someone who has implemented these sorts of things on a number of legacy systems, it really isn't hard to do.

richrichardsson 4y ago
> slapdash approach to security needs to become criminal 100% this. If there were serious consequences to not taking (customer) account security seriously, perhaps it wouldn't be such a common occurrence.
rocqua 4y ago
If you start mandating companies do proper authentication, then you kinda need proper authentication to be possible. Really, the way to do that is through a government-issued ID, but the US does not like that idea. Without government-issued ID as a base, doing authentication right is difficult. Especially account recovery simply becomes a mess. Having high fines might cause certain users to be permanently locked out 'because we cannot properly authenticate you'. It would light a nice fire under efforts to properly handle authentication, but that fire would burn a lot of people first.
- lotsofpulp 4y ago
  This is at the root of the problem. No entity wants to take liability and responsibility for quick and easy identify verification, and only the federal government is in a position to do that. There is no reason they could not use USPS to provide a passport type identify verification service and API for other organizations to use. It should be a utility.
  - Philadelphia 4y ago
    The problem is that US Christian conservatives believe a government ID is the “the mark of the beast.” Seriously. http://archive.boston.com/news/local/maine/articles/2007/03/11/biblical_prophecy_finds_way_to_legislators_in_battle_over_id_plan/ http://archive.boston.com/news/local/maine/articles/2007/03/...
    - lotsofpulp 4y ago
      The crazy thing is no one needs to be forced to get. We already have passports, and they are initially applied for at USPS. All the feds need to do is set up an online verification system with an API to plug into.

richrichardsson 4y ago

> slapdash approach to security needs to become criminal 100% this. If there were serious consequences to not taking (customer) account security seriously, perhaps it wouldn't be such a common occurrence.

rocqua 4y ago

If you start mandating companies do proper authentication, then you kinda need proper authentication to be possible. Really, the way to do that is through a government-issued ID, but the US does not like that idea. Without government-issued ID as a base, doing authentication right is difficult. Especially account recovery simply becomes a mess. Having high fines might cause certain users to be permanently locked out 'because we cannot properly authenticate you'. It would light a nice fire under efforts to properly handle authentication, but that fire would burn a lot of people first.

lotsofpulp 4y ago
This is at the root of the problem. No entity wants to take liability and responsibility for quick and easy identify verification, and only the federal government is in a position to do that. There is no reason they could not use USPS to provide a passport type identify verification service and API for other organizations to use. It should be a utility.
- Philadelphia 4y ago
  The problem is that US Christian conservatives believe a government ID is the “the mark of the beast.” Seriously. http://archive.boston.com/news/local/maine/articles/2007/03/11/biblical_prophecy_finds_way_to_legislators_in_battle_over_id_plan/ http://archive.boston.com/news/local/maine/articles/2007/03/...
  - lotsofpulp 4y ago
    The crazy thing is no one needs to be forced to get. We already have passports, and they are initially applied for at USPS. All the feds need to do is set up an online verification system with an API to plug into.