2 ms·
I recently reevaluated my approach to identity & recovery across all the services I rely on and it’s a mess. Apple and Google both provide sensible security se
by konha 3y ago
I recently reevaluated my approach to identity & recovery across all the services I rely on and it’s a mess.
Apple and Google both provide sensible security settings but you can only guess how recovery might work if you are locked out of your account from their docs.
Even with their advanced security programs (requiring a hardware token) I’m not entirely sure that I’m not defeating the whole purpose of these measures by putting a mobile number in my account that can be sim swapped.
On the other hand I’m also not entirely sure if I could recover access from what I think I’d need to provide to prove my identity (recovery codes, trusted contacts, …)
I get why they might not want to lay out the whole process and every heuristic they use, but it’s not really reassuring.
- AdamN 3y agoIt's a good callout and I think these things should be documented just so security researchers can expose flaws in the process publicly. Basically, these companies have unlock keys for our accounts and we don't know enough about their internal processes to know how secure we are from social engineering attacks or internal threats.
- ignite 3y agoGoogle recovery is a disaster. I lost an account that had a recovery email. I got locked out of the account, and it said the recovery email wasn't enough! WTF!? That's exactly what it is for. So, you can lose your google account, even with recovery set up.