3 ms·

Such a high risk of being locked out permanently is more than most people can stomach. Why can't they offer a last-resort option like showing up in person at an

Such a high risk of being locked out permanently is more than most people can stomach. Why can't they offer a last-resort option like showing up in person at an Apple Store with government-issued photo ID?

toomuchtodo 3y ago
Because they aren’t required to by law. I have filed comments with the FTC that this recovery path should be legally mandated for digital accounts, I encourage others to do the same. It doesn’t have to be an Apple Store (insider risk, see SIM swapping analogy); could be USPS or another government identity proofer they partner with. Login.gov uses USPS for in person identity proofing, for example. Your data and account ownership interest doesn’t disappear because of failure to possess the right sequence of bytes or a string. Can you imagine if your real estate or securities ownership evaporated because you didn't have the right password? Silliness.
- kccqzy 3y ago
  Well previously when stock trades involved exchanging physical certificates, I could imagine that ownership could evaporate if you lost that piece of paper. Or just think about cash: you do lose that ownership when you lose that magical piece of paper. It's a simpler world when what you have physically determines what you own.
  - josephcsible 3y ago
    If the deed to land or the title to a car gets destroyed, what happens? It doesn't suddenly forever become unownable.
  - jrkatz 3y ago
    Physical certificates are not a thing of the past and can be restored upon loss or destruction: https://www.investor.gov/introduction-investing/investing-basics/glossary/lost-or-stolen-stock-certificates https://www.investor.gov/introduction-investing/investing-ba...
  - toomuchtodo 3y ago
    People want a just world (imho, n=1, based on all available evidence, etc), recourse, and protections, not a simple world. Interestingly, cash will likely be the last to go in the near future from a “possession of value” as the world goes cashless (although whether this is "good" or "bad" can be argued in another thread). https://en.wikipedia.org/wiki/Cashless_society https://en.wikipedia.org/wiki/Cashless_society
- AnthonyMouse 3y ago
  This should not be required by law because many people specifically don't want it. I'm content to keep my own redundant copies of a recovery key and suffer the consequences of my own actions, rather than allowing someone to steal my account just because they made a convincing fake ID or hacked some government system. In general centralized identity systems are a single point of failure and hooking more things into them is a bad thing. > Your data and account ownership interest doesn’t disappear because of failure to possess the right sequence of bytes or a string. Somehow you have to establish that you are the owner of the account, in a way that nobody else can do it. This is very much not a trivial problem, and government IDs don't provide any kind of solution to it. If you need a driver's license, how do you get a driver's license? With a birth certificate? Okay, how do you get a copy of your birth certificate when you don't have a driver's license? If there is a path to go from your house burning down and you having zero documents to you having a valid ID again without proving you've memorized or otherwise backed up any kind of secrets, an attacker can do the same thing and get an ID in your name. This is why identity theft is a thing in every system that relies on government ID. Requiring all systems to accept government ID is requiring all systems to be subject to identity theft.
  - toomuchtodo 3y ago
    I argue for and advocate that this capability should exist, but not be mandatory. If you do not want to tie your personal identity to your digital identity, certainly, you should be able to not do so and rely solely on a cryptographic primitive, recovery key, or other digital mechanism to govern access of last resort. If your account access is lost forever, it's on you and that was a choice that was made. > Somehow you have to establish that you are the owner of the account, in a way that nobody else can do it. This is very much not a trivial problem, and government IDs don't provide any kind of solution to it. This is actually very easy. You can identity proof someone through Stripe Identity [1] for ~$2/transaction. There are of course other private companies who will do this. You bind this identity to the digital identity once, when you have a high identity assurance level (IAL). Account recovery is then trivial. > If you need a driver's license, how do you get a driver's license? With a birth certificate? Okay, how do you get a copy of your birth certificate when you don't have a driver's license? This is government's problem luckily, not that of private companies who would need to offer account identity bootstrapping. Does the liquor store or bar care where you got your government ID? The notary? The bank? They do not, because they trust the government to issue these credentials. They simply require the state of federal government credential. Based on the amount of crypto fraud that has occurred (~$72B and counting [2]), government identity web of trust is much more robust than "not your keys, not your crypto" and similar digital only primitives. NIST 800-63 should answer any questions you might have I have not already answered: https://pages.nist.gov/800-63-3/ https://pages.nist.gov/800-63-3/ (NIST Digital Identity Guidelines) [1] https://stripe.com/identity https://stripe.com/identity [2] https://www.web3isgoinggreat.com/charts/top https://www.web3isgoinggreat.com/charts/top (customer identity is a component of my work in financial services)
lazide 3y ago
Have you seen how easy it is to get fake government ID? It’s damn near a rite of passage for teenagers so they can buy alcohol. $20-$50 if you know the right person or can wander the dark web right. I’m not sure you want that to be the absolute best digital security you can get.
- SoftTalker 3y ago
  Yes it is vulnerable to an attacker who is willing to present himself in person with a fake ID to target a specific account. However it's not scalable or remotely exploitable.
  - lazide 3y ago
    Since it requires a human looking at an ID and then pressing a button, the system triggered by the button press is likely quite exploitable no? Or even worse, scanning and storing an ID, which allows spoofing if those get compromised. Recovery key isn’t susceptible to that - and isn’t susceptible to fake-id-spotting-ability or bribeability of staff either.
- josephcsible 3y ago
  Okay, then also require a photo when opting in to this, and make sure the person who shows up looks like said photo too.
  - deleted 3y ago
    [deleted]
semiquaver 3y ago
> Why can't they offer a last-resort option like showing up in person at an Apple Store with government-issued photo ID? This is easy to defeat and completely subverts the purpose of the system. If you are not comfortable with self-custody then don’t opt in.
- nottorp 3y ago
  Only because you don't have proper IDs over there in the US? I'd say a lot of identity problems are there because companies have to identify people without an official ID somehow...
matwood 3y ago
I think their option for last resort is the trusted contact.
recursive 3y ago
How would this work? If this was possible, that would mean an Apple employee is verifying the ID. This has failure modes. See SIM swapping attacks.
- mlyle 3y ago
  There's a wide set of possible approaches between "let any employee validate any ID" and "never let someone into an account that they have lost the credential to." E.g. you could make it costly to attempt, require a notarized proof of identity -and- showing up at the Apple store, and enforce a n-day waiting period. A different employee does the unlock (from a customer service queue) than accepts the paperwork. We don't lock people out of financial accounts forever when they forget a credential. It could definitely be solved for other types of accounts.
- josephcsible 3y ago
  Aren't SIM swapping attacks only such a problem because you can get a new SIM without showing up in person with ID?
  - recursive 3y ago
    No, they're also a problem because you can run into a storefront and snatch the employee's authenticated tablet, regardless of what company policy is.
hedora 3y ago
This is the default behavior if you don't turn this stuff on. They store your account recovery key in an escrow device. The main problem is that walking into an apple store with a government-issued warrant works just as well as walking in with a government-issued ID.

toomuchtodo 3y ago

Because they aren’t required to by law. I have filed comments with the FTC that this recovery path should be legally mandated for digital accounts, I encourage others to do the same. It doesn’t have to be an Apple Store (insider risk, see SIM swapping analogy); could be USPS or another government identity proofer they partner with. Login.gov uses USPS for in person identity proofing, for example. Your data and account ownership interest doesn’t disappear because of failure to possess the right sequence of bytes or a string. Can you imagine if your real estate or securities ownership evaporated because you didn't have the right password? Silliness.

kccqzy 3y ago
Well previously when stock trades involved exchanging physical certificates, I could imagine that ownership could evaporate if you lost that piece of paper. Or just think about cash: you do lose that ownership when you lose that magical piece of paper. It's a simpler world when what you have physically determines what you own.
- josephcsible 3y ago
  If the deed to land or the title to a car gets destroyed, what happens? It doesn't suddenly forever become unownable.
- jrkatz 3y ago
  Physical certificates are not a thing of the past and can be restored upon loss or destruction: https://www.investor.gov/introduction-investing/investing-basics/glossary/lost-or-stolen-stock-certificates https://www.investor.gov/introduction-investing/investing-ba...
- toomuchtodo 3y ago
  People want a just world (imho, n=1, based on all available evidence, etc), recourse, and protections, not a simple world. Interestingly, cash will likely be the last to go in the near future from a “possession of value” as the world goes cashless (although whether this is "good" or "bad" can be argued in another thread). https://en.wikipedia.org/wiki/Cashless_society https://en.wikipedia.org/wiki/Cashless_society
AnthonyMouse 3y ago
This should not be required by law because many people specifically don't want it. I'm content to keep my own redundant copies of a recovery key and suffer the consequences of my own actions, rather than allowing someone to steal my account just because they made a convincing fake ID or hacked some government system. In general centralized identity systems are a single point of failure and hooking more things into them is a bad thing. > Your data and account ownership interest doesn’t disappear because of failure to possess the right sequence of bytes or a string. Somehow you have to establish that you are the owner of the account, in a way that nobody else can do it. This is very much not a trivial problem, and government IDs don't provide any kind of solution to it. If you need a driver's license, how do you get a driver's license? With a birth certificate? Okay, how do you get a copy of your birth certificate when you don't have a driver's license? If there is a path to go from your house burning down and you having zero documents to you having a valid ID again without proving you've memorized or otherwise backed up any kind of secrets, an attacker can do the same thing and get an ID in your name. This is why identity theft is a thing in every system that relies on government ID. Requiring all systems to accept government ID is requiring all systems to be subject to identity theft.
- toomuchtodo 3y ago
  I argue for and advocate that this capability should exist, but not be mandatory. If you do not want to tie your personal identity to your digital identity, certainly, you should be able to not do so and rely solely on a cryptographic primitive, recovery key, or other digital mechanism to govern access of last resort. If your account access is lost forever, it's on you and that was a choice that was made. > Somehow you have to establish that you are the owner of the account, in a way that nobody else can do it. This is very much not a trivial problem, and government IDs don't provide any kind of solution to it. This is actually very easy. You can identity proof someone through Stripe Identity [1] for ~$2/transaction. There are of course other private companies who will do this. You bind this identity to the digital identity once, when you have a high identity assurance level (IAL). Account recovery is then trivial. > If you need a driver's license, how do you get a driver's license? With a birth certificate? Okay, how do you get a copy of your birth certificate when you don't have a driver's license? This is government's problem luckily, not that of private companies who would need to offer account identity bootstrapping. Does the liquor store or bar care where you got your government ID? The notary? The bank? They do not, because they trust the government to issue these credentials. They simply require the state of federal government credential. Based on the amount of crypto fraud that has occurred (~$72B and counting [2]), government identity web of trust is much more robust than "not your keys, not your crypto" and similar digital only primitives. NIST 800-63 should answer any questions you might have I have not already answered: https://pages.nist.gov/800-63-3/ https://pages.nist.gov/800-63-3/ (NIST Digital Identity Guidelines) [1] https://stripe.com/identity https://stripe.com/identity [2] https://www.web3isgoinggreat.com/charts/top https://www.web3isgoinggreat.com/charts/top (customer identity is a component of my work in financial services)

lazide 3y ago

Have you seen how easy it is to get fake government ID? It’s damn near a rite of passage for teenagers so they can buy alcohol. $20-$50 if you know the right person or can wander the dark web right. I’m not sure you want that to be the absolute best digital security you can get.

SoftTalker 3y ago
Yes it is vulnerable to an attacker who is willing to present himself in person with a fake ID to target a specific account. However it's not scalable or remotely exploitable.
- lazide 3y ago
  Since it requires a human looking at an ID and then pressing a button, the system triggered by the button press is likely quite exploitable no? Or even worse, scanning and storing an ID, which allows spoofing if those get compromised. Recovery key isn’t susceptible to that - and isn’t susceptible to fake-id-spotting-ability or bribeability of staff either.
josephcsible 3y ago
Okay, then also require a photo when opting in to this, and make sure the person who shows up looks like said photo too.
- deleted 3y ago
  [deleted]

semiquaver 3y ago

> Why can't they offer a last-resort option like showing up in person at an Apple Store with government-issued photo ID? This is easy to defeat and completely subverts the purpose of the system. If you are not comfortable with self-custody then don’t opt in.

nottorp 3y ago
Only because you don't have proper IDs over there in the US? I'd say a lot of identity problems are there because companies have to identify people without an official ID somehow...

matwood 3y ago

I think their option for last resort is the trusted contact.

recursive 3y ago

How would this work? If this was possible, that would mean an Apple employee is verifying the ID. This has failure modes. See SIM swapping attacks.

mlyle 3y ago
There's a wide set of possible approaches between "let any employee validate any ID" and "never let someone into an account that they have lost the credential to." E.g. you could make it costly to attempt, require a notarized proof of identity -and- showing up at the Apple store, and enforce a n-day waiting period. A different employee does the unlock (from a customer service queue) than accepts the paperwork. We don't lock people out of financial accounts forever when they forget a credential. It could definitely be solved for other types of accounts.
josephcsible 3y ago
Aren't SIM swapping attacks only such a problem because you can get a new SIM without showing up in person with ID?
- recursive 3y ago
  No, they're also a problem because you can run into a storefront and snatch the employee's authenticated tablet, regardless of what company policy is.

hedora 3y ago

This is the default behavior if you don't turn this stuff on. They store your account recovery key in an escrow device. The main problem is that walking into an apple store with a government-issued warrant works just as well as walking in with a government-issued ID.