4 ms·
> Hint: if you use passkeys for your personal Google account, do you actually think anyone at Google will be able to help you recover access when you lose them?
by jsnell 3y ago
> Hint: if you use passkeys for your personal Google account, do you actually think anyone at Google will be able to help you recover access when you lose them?
I mean, yes, but that's beside the point. What's more important is that I don't think anyone at Google would need to help me recover my account.
- I have multiple trusted devices signed in already, in addition to my phone
- I have a recovery phone number and recovery email set. In a situation where I lose my phone, I can get a new SIM card for the same phone number within hours.
- I have my TOTP key saved on another device besides my primary phone. (Though I have to admit that I didn't turn the backup phone on last year; I used to do it twice per year, so it's possible this doesn't work any more.)
- I have a set of 2FA recovery codes printed, and stored in a place where I'd know to look for them.
Now, obviously basically nobody else has all of that set up. Just having printed and knowing where the recovery codes are is like 99.99th percentile level of preparedness. But most of it is also totally unnecessary. In the last 10 years I've had one phone stolen and one that stopped working suddenly and irrevocably. In both cases just the stuff that basically everyone would have (getting a new SIM in one case, an existing session from a trusted device) was enough to get the account back into a good state.
Look, the people working on this stuff are neither idiots nor malicious. They understand that people lose stuff and forget stuff all the time, and they understand that the accounts can be very precious to the owners. So they try to make sure that as many people as possible have a way to recover their accounts. And as long as you haven't gone out of your way to make sure the account is unrecoverable, it'll work out fine.
- nottorp 3y ago> Now, obviously basically nobody else has all of that set up. Yep, your average hooman only has the one smartphone these days and no access to a printer :)
- jsnell 3y agoWell, it's a good thing that even those people will still be able to recover their account with just a new SIM or new phone. (Depending on whether they lost the phone completely, or if it just stopped working.)
- nottorp 3y agoSo those impenetrable keys can be reset with just a SIM clone? What's the point then?
- jsnell 3y agoUnlike what reading HN comments might lead you to believe, SIM swapping is neither easy nor common. It requires an insider accomplice with limited bandwidth and who is running a very real risk of getting caught. That's expensive. Just trading off the phishing risk against that would be an amazing deal for most people. (Of course not everyone, I know you'd never be fooled by a phishing attack.) But also, account recoveries are in principle rare events, as opposed to logging in which is common. So you can and should apply very different security policies to the two cases. A very simple solution to preventing SIM swapping attacks on account recovery is to just add a delay to the recovery, and notify the user about the attempt via other channels. That means that not only does the attacker need to hijack the phone number, they also need to keep control of it for days, prevent the real user from seeing the messages and blocking the recovery attempt, etc. (There's plenty one can do to decrease the friction and to increase the security on top of that, but even that simple solution gets you most of the way there.) That wouldn't be acceptable in a login scenario, you can't tell the user to wait for three days for the login to complete. But for a once per decade loss of all credentials? That's a lot more palatable.
- namaria 3y agoSIM swapping absolutely does not require vulnerable insiders. It is exceedingly easy to impersonate people to corporate employees who are neither trained nor willing to be strict about identity documentation lest a legitimate client get angry and result in their termination.