4 ms·
You go through.... account recovery? Like if you lose your password today?
by growse 3y ago
You go through.... account recovery?
Like if you lose your password today?
- ses1984 3y agoIf you can recover an account without the passkey, how much security is it really adding?
- toomuchtodo 3y agoDepends on the recovery mechanism. Providing a government credential with a live selfie is the gold standard. If a company doesn't support that, they're being cheap at the cost of security (you can perform such an identity proof for ~$1-2/per successful proof through a vendor like Stripe Identity or ID.me). Passkeys solves for digital identity compromise (credential theft or stuffing/spraying), but you must rely on other mechanisms (such as a I mention above) if you want to elevate identity assurance higher in the event of credential loss. (consumer IAM is a component of my work at a fintech; auth/creds security, passkey rollout, high identity confidence when an account is recovered, etc)
- vel0city 3y agoHow do I actually give them my real government document with it's physical security features through the internet? Just take a grainy photo of it? Really secure!
- grotorea 3y agoIt at least avoids the user being phished or being compromised by reusing passwords. But it seems in this case the account recovery is just using the password so the passkey is mostly convenience and maybe Google trying to move things away from passwords more than a complete change.
- echelon 3y ago> maybe Google trying to move things away from passwords more than a complete change Google wants to be a gateway to everything else you do. The next step is to get other platforms to accept Google passwordless auth.
- kube-system 3y agoThat depends entirely on how rigorous the recovery process is.
- lopis 3y agoAh right, account recovery. The one that tells me the only way to sign in to my old Google account is to use a phone that no longer exists.
- jasonjayr 3y agoor to fax/email/send in government identity documents.
- lopis 3y agoNo, have a Google account that is locked forever without recourse. Even though I have email forwarding setup in that account to my main one.
- lxgr 3y agoDespite what many companies seem to believe, looking at a copy of somebody's identification presented remotely documents does not constitute identity verification. Photo ID is (relatively) secure in exactly one use case: Verifying that a person standing in front of you is who they claim to be. Everything else is inane pseudo-security.
- Eumenes 3y agoGoogle has notoriously horrible customer service, or none at all ... A Google Domains issue took me months to resolve, I couldn't contact a human.
- tshaddox 3y agoWhat’s the standard then? Should it be possible to recover your account without possessing any evidence whatsoever that you are the person you say you are?
- gomox 3y agoGiven your response you should read up on the reality of Google Account recovery, because the usual horror story is not that you have "no evidence whatsoever" but more like "I have all the evidence in the world including recovery codes, TOTP backups and a valid password and somehow I'm still locked out".
- throwawayqqq11 3y agoAnd then? get asked for a unique pw that you havent typed for ages or a duplicate pw that you use for everything?