3 ms·
All Amazon accounts that have ever purchased something are linked to a name, payment card, and address. A random Google account might not have any of those. How
by morpheuskafka 3y ago
All Amazon accounts that have ever purchased something are linked to a name, payment card, and address. A random Google account might not have any of those. How could Google possibly tell who has access to it?
- dotnet00 3y agoFor example, if an account has been inactive for years and suddenly someone is trying to login, is consistently making an effort over a reasonably long period and is willing to prove their own identity in some official way (such that if it turned out they were lying they could be trivially identified and prosecuted), then they can reasonably allow access. On the other hand, if an account is still actively logged into, it would be obvious that anyone else trying to get access should not be allowed to do so.
- judge2020 3y agoThis happens all the time via credential stuffing - or even after credential stuffing someone's email inbox and searching through all relevant account activation emails. Just saying "lower the security if it's been x years" isn't adequate and could cause serious harm if the abandoned account has important or secret information on it. Better to keep it secure and inaccessible if there is any doubt that the human is an attacker.