4 ms·

So what you’re implying is that because security for most major companies is a joke, and because they all have crooked employees that help criminals gain author

So what you’re implying is that because security for most major companies is a joke, and because they all have crooked employees that help criminals gain authorized access, that it’s an uneven playing field between the so called “most vulnerable members of society” and the criminals, that account access methods should be even broader and made even easier for criminals by giving them a human vector to manipulate? That’s absolutely ridiculous. I think there should be NO HUMAN in the mix, when it comes to my password recovery and resets. I want ONLY code processing my request with no hope of human override. Because it’s so easy to gain authorized access to any account by using the old social engineering backdoor! Why on earth should we make it easier by increasing human vector in the equation? I’ve had hundreds of gmail accounts over the years and never had one hacked thanks to their impeccible way of helping in all but the most exceptional of cases.

0x_rs 4y ago
I'm implying it's not possible not to have an human in the mix, not currently and I don't see it possible in the future. The manners in which it would be (or at least I think, with real 2FA, passkeys, et cetera) are not a common sight for most people yet. I would be fine with username+password+second factor, backup keys and that's it, if you lose them it's game over, but only as opt-in (I'd love it and toggle it for every service), or you'll quickly notice most people will lose their data eventually, so you may still need human interaction for the majority of the user base. The not-so-interim solution, or really what should've been done since a long time ago, is to develop a common procedure that companies that provide certain services (network operators in particular, since the SMS 2FA industry addiction is not going away anytime soon) or generally have a sizeable amount of users must enforce, no asking for internal ticketry for somebody else or the likes. All of these instances should be stored, trackable internally for law enforcement purposes in case of fraud or stolen identity for a determined amount of time. Right now it's just a mess, some must legally ask for ID and yada yada but all SIM hijacks prove it's not strict enough. That's just how I see it, so I'd like to read how you would implement something that would work best and apply to everybody and OP's mother.

0x_rs 4y ago

I'm implying it's not possible not to have an human in the mix, not currently and I don't see it possible in the future. The manners in which it would be (or at least I think, with real 2FA, passkeys, et cetera) are not a common sight for most people yet. I would be fine with username+password+second factor, backup keys and that's it, if you lose them it's game over, but only as opt-in (I'd love it and toggle it for every service), or you'll quickly notice most people will lose their data eventually, so you may still need human interaction for the majority of the user base. The not-so-interim solution, or really what should've been done since a long time ago, is to develop a common procedure that companies that provide certain services (network operators in particular, since the SMS 2FA industry addiction is not going away anytime soon) or generally have a sizeable amount of users must enforce, no asking for internal ticketry for somebody else or the likes. All of these instances should be stored, trackable internally for law enforcement purposes in case of fraud or stolen identity for a determined amount of time. Right now it's just a mess, some must legally ask for ID and yada yada but all SIM hijacks prove it's not strict enough. That's just how I see it, so I'd like to read how you would implement something that would work best and apply to everybody and OP's mother.