4 ms·
> I explicitly don't want any non-deterministic, “risk-based” or ML decision involved in a decision as to whether I can access an account which controls critica
by shortcake27 4y ago
> I explicitly don't want any non-deterministic, “risk-based” or ML decision involved in a decision as to whether I can access an account which controls critical infrastructure
I don't want this on any account, infra or not. If I can supply my password and complete MFA (TOTP/hardware key) then I want access to my account. I've been in a situation where I was logging in from a known IP, provided the correct password, correct OTP, and had access to the recovery email address on my account, and I was still denied access until I authenticated using a phone number which wasn't even associated with my account. Other people aren't so lucky and simply never gain access to their account again. It's mental. Let me make the decision. Give me a button that says "Always allow access for correct password and challenge".
- jefftk 4y ago> authenticated using a phone number which wasn't even associated with my account As in, they required you to add a phone number when you didn't have one before, or they said "verify you can receive SMS at 555-123-5678" which wasn't even yours?
- thrown1212 4y agoI’ve hit this (add a new number to verify) more than once. The security theatre of it all is painful.
- sneak 4y agoThis happened to me yesterday on a brand new paid G Suite/Workspace user-level account, when logging in for the first time from a VPN.
- shortcake27 4y agoYeah they forced me to provide a number during login. I don’t have any numbers associated with my account to protect against sim swapping, and I shouldn’t need a number because I have multiple methods of MFA plus recovery email. But if Google wants your phone number, Google gets your phone number. The number I provided doesn’t appear anywhere in my account but I bet it’s stored somewhere behind the scenes, so they can compare it against previous logins. I do wonder, if I got a new phone number, would it let me in or lock me out?