4 ms·

The fact that they make it impossible to get in touch with a human is actually a boon to security. Humans are the weakest link and most prone to social engineer

The fact that they make it impossible to get in touch with a human is actually a boon to security. Humans are the weakest link and most prone to social engineering. I’m not sure why you think getting in touch with a human would help resolve your situation. If you don’t have the right information to satisfy the automated system then why would a human be able to help you?

frereubu 4y ago
I see what you mean, but I'm not looking to talk that person into giving me access, I'm wondering if there are any other remedies for this situation. It can't be all that uncommon. It rather chimes with this plea from a librarian that reached Hacker News recently: https://docs.google.com/document/d/1f6HPQbUjslcbjVHkJkAgYmQmBV3PRRHEcx4WL5rxuE8/preview https://docs.google.com/document/d/1f6HPQbUjslcbjVHkJkAgYmQm...
0x_rs 4y ago
Quite the opposite. It is only the most vulnerable people that won't manage to resolve whatever issue they may have that an endless loop of FAQs (looking at you, Google) with no actual contacts (or very meticulously hidden away, if there's any) won't fix in any way. Bad actors are much more likely to have the networking and specific knowledge to get ahold of somebody internally to bribe, manipulate. Hell, even big companies bribe others' employees en masse, and there's plenty other examples. And automated systems' judgement is very poor (from a design standpoint, better blanket refuse than let in without utterly being certain), at least in my experience trying to recover somebody's Outlook account and inputting all emails and contacts, exact matches line per line. https://news.ycombinator.com/item?id=32416424 https://news.ycombinator.com/item?id=32416424 https://mashable.com/article/instagram-verification-paid-black-market-facebook https://mashable.com/article/instagram-verification-paid-bla...
- unknownaccount 4y ago
  So what you’re implying is that because security for most major companies is a joke, and because they all have crooked employees that help criminals gain authorized access, that it’s an uneven playing field between the so called “most vulnerable members of society” and the criminals, that account access methods should be even broader and made even easier for criminals by giving them a human vector to manipulate? That’s absolutely ridiculous. I think there should be NO HUMAN in the mix, when it comes to my password recovery and resets. I want ONLY code processing my request with no hope of human override. Because it’s so easy to gain authorized access to any account by using the old social engineering backdoor! Why on earth should we make it easier by increasing human vector in the equation? I’ve had hundreds of gmail accounts over the years and never had one hacked thanks to their impeccible way of helping in all but the most exceptional of cases.
  - 0x_rs 4y ago
    I'm implying it's not possible not to have an human in the mix, not currently and I don't see it possible in the future. The manners in which it would be (or at least I think, with real 2FA, passkeys, et cetera) are not a common sight for most people yet. I would be fine with username+password+second factor, backup keys and that's it, if you lose them it's game over, but only as opt-in (I'd love it and toggle it for every service), or you'll quickly notice most people will lose their data eventually, so you may still need human interaction for the majority of the user base. The not-so-interim solution, or really what should've been done since a long time ago, is to develop a common procedure that companies that provide certain services (network operators in particular, since the SMS 2FA industry addiction is not going away anytime soon) or generally have a sizeable amount of users must enforce, no asking for internal ticketry for somebody else or the likes. All of these instances should be stored, trackable internally for law enforcement purposes in case of fraud or stolen identity for a determined amount of time. Right now it's just a mess, some must legally ask for ID and yada yada but all SIM hijacks prove it's not strict enough. That's just how I see it, so I'd like to read how you would implement something that would work best and apply to everybody and OP's mother.

frereubu 4y ago

I see what you mean, but I'm not looking to talk that person into giving me access, I'm wondering if there are any other remedies for this situation. It can't be all that uncommon. It rather chimes with this plea from a librarian that reached Hacker News recently: https://docs.google.com/document/d/1f6HPQbUjslcbjVHkJkAgYmQmBV3PRRHEcx4WL5rxuE8/preview https://docs.google.com/document/d/1f6HPQbUjslcbjVHkJkAgYmQm...

0x_rs 4y ago

Quite the opposite. It is only the most vulnerable people that won't manage to resolve whatever issue they may have that an endless loop of FAQs (looking at you, Google) with no actual contacts (or very meticulously hidden away, if there's any) won't fix in any way. Bad actors are much more likely to have the networking and specific knowledge to get ahold of somebody internally to bribe, manipulate. Hell, even big companies bribe others' employees en masse, and there's plenty other examples. And automated systems' judgement is very poor (from a design standpoint, better blanket refuse than let in without utterly being certain), at least in my experience trying to recover somebody's Outlook account and inputting all emails and contacts, exact matches line per line. https://news.ycombinator.com/item?id=32416424 https://news.ycombinator.com/item?id=32416424 https://mashable.com/article/instagram-verification-paid-black-market-facebook https://mashable.com/article/instagram-verification-paid-bla...

unknownaccount 4y ago
So what you’re implying is that because security for most major companies is a joke, and because they all have crooked employees that help criminals gain authorized access, that it’s an uneven playing field between the so called “most vulnerable members of society” and the criminals, that account access methods should be even broader and made even easier for criminals by giving them a human vector to manipulate? That’s absolutely ridiculous. I think there should be NO HUMAN in the mix, when it comes to my password recovery and resets. I want ONLY code processing my request with no hope of human override. Because it’s so easy to gain authorized access to any account by using the old social engineering backdoor! Why on earth should we make it easier by increasing human vector in the equation? I’ve had hundreds of gmail accounts over the years and never had one hacked thanks to their impeccible way of helping in all but the most exceptional of cases.
- 0x_rs 4y ago
  I'm implying it's not possible not to have an human in the mix, not currently and I don't see it possible in the future. The manners in which it would be (or at least I think, with real 2FA, passkeys, et cetera) are not a common sight for most people yet. I would be fine with username+password+second factor, backup keys and that's it, if you lose them it's game over, but only as opt-in (I'd love it and toggle it for every service), or you'll quickly notice most people will lose their data eventually, so you may still need human interaction for the majority of the user base. The not-so-interim solution, or really what should've been done since a long time ago, is to develop a common procedure that companies that provide certain services (network operators in particular, since the SMS 2FA industry addiction is not going away anytime soon) or generally have a sizeable amount of users must enforce, no asking for internal ticketry for somebody else or the likes. All of these instances should be stored, trackable internally for law enforcement purposes in case of fraud or stolen identity for a determined amount of time. Right now it's just a mess, some must legally ask for ID and yada yada but all SIM hijacks prove it's not strict enough. That's just how I see it, so I'd like to read how you would implement something that would work best and apply to everybody and OP's mother.