5 ms·

Human support of any time opens up tons of social engineering situations that enable account takeovers - and these hurt Google’s reputation more than any abando

by judge2020 3y ago

Human support of any time opens up tons of social engineering situations that enable account takeovers - and these hurt Google’s reputation more than any abandoned account story. What do you suggest would be sufficient proof to the Google human support representative that would verify that you actually did own that account? They already have a process in account recovery that includes inputting the last password you know, entering the month you think you opened the account, and answering some extra questions, after which a human reviews your answers to determine if it’s really you. I’ve had this done for one of my old accounts and I was granted a link to reset the password for that account and set up new recovery details.

dotnet00 3y ago
>Human support of any time opens up tons of social engineering situations that enable account takeovers - and these hurt Google’s reputation more than any abandoned account story. That's an absurd assertion to make. Amazon makes it very easy to get a hold of a human for support (particularly compared to Google), they have no issue with social engineering driven account takeovers despite that it'd be pretty easy to cause significant financial damage within just a few hours.
- morpheuskafka 3y ago
  All Amazon accounts that have ever purchased something are linked to a name, payment card, and address. A random Google account might not have any of those. How could Google possibly tell who has access to it?
  - dotnet00 3y ago
    For example, if an account has been inactive for years and suddenly someone is trying to login, is consistently making an effort over a reasonably long period and is willing to prove their own identity in some official way (such that if it turned out they were lying they could be trivially identified and prosecuted), then they can reasonably allow access. On the other hand, if an account is still actively logged into, it would be obvious that anyone else trying to get access should not be allowed to do so.
    - judge2020 3y ago
      This happens all the time via credential stuffing - or even after credential stuffing someone's email inbox and searching through all relevant account activation emails. Just saying "lower the security if it's been x years" isn't adequate and could cause serious harm if the abandoned account has important or secret information on it. Better to keep it secure and inaccessible if there is any doubt that the human is an attacker.

dotnet00 3y ago

>Human support of any time opens up tons of social engineering situations that enable account takeovers - and these hurt Google’s reputation more than any abandoned account story. That's an absurd assertion to make. Amazon makes it very easy to get a hold of a human for support (particularly compared to Google), they have no issue with social engineering driven account takeovers despite that it'd be pretty easy to cause significant financial damage within just a few hours.

morpheuskafka 3y ago
All Amazon accounts that have ever purchased something are linked to a name, payment card, and address. A random Google account might not have any of those. How could Google possibly tell who has access to it?
- dotnet00 3y ago
  For example, if an account has been inactive for years and suddenly someone is trying to login, is consistently making an effort over a reasonably long period and is willing to prove their own identity in some official way (such that if it turned out they were lying they could be trivially identified and prosecuted), then they can reasonably allow access. On the other hand, if an account is still actively logged into, it would be obvious that anyone else trying to get access should not be allowed to do so.
  - judge2020 3y ago
    This happens all the time via credential stuffing - or even after credential stuffing someone's email inbox and searching through all relevant account activation emails. Just saying "lower the security if it's been x years" isn't adequate and could cause serious harm if the abandoned account has important or secret information on it. Better to keep it secure and inaccessible if there is any doubt that the human is an attacker.