3 ms·

I have an unfortunately pointed question: How good are you guys at preventing account takeovers? We live in a world where your digital property is backstopped

I have an unfortunately pointed question: How good are you guys at preventing account takeovers? We live in a world where your digital property is backstopped by "send me an email with a link I can click to regain access to a broken account". Everything I've collected digitally over the course of 20 years "belongs" to my email address through that power dynamic. Tens of thousands of dollars of value that I can only maintain access to if I can guarantee that me and me alone have access to my email account, and I will always have access to that account. I would love to get my email away from Google, I do not trust them at all. But they have demonstrated to me multiple times that they are adept at preventing unauthorized access to my account. Do you have behavioral account takeover prevention? Do you have a risk and fraud department whose job it is to ensure that me and me alone have access to that email? Do you have people who I can call and demonstrate my identity to in order to regain access to that email account if it does get hacked? 2FA is not an answer.

fn-mote 2y ago
On one hand, I acknowledge Google's security is amazing. On the other hand, I am puzzled by your assertion that 2FA is not the answer. Fastmail has passkeys and TOTP... you are a seriously high profile target if that's not enough for you. > Do you have people who I can call and demonstrate my identity to in order to regain access to that email account if it does get hacked? Google doesn't have this, right? And actively doesn't want it. Once your account is locked down and you're not falling for the phishing attacks, this is the route in. > Tens of thousands of dollars So your security only has to stand up to say $50k of assult? No problem. That's not 0-day money. Just stick with your TOTP 2FA.
- mrguyorama 2y ago
  You're right, what I actually should have asked is "How do you guarantee I never lose access" If I lose the key to my house, I can change the lock, it's my property. If I lose the key to my Post Office box, the Post Office will charge me money to set up a new key. I have RIGHTS to my physical property and physical business relationships. What happens when I lose my Fastmail key? Currently the status quo is "get fucked". Which is utterly insane to me. My options in that reality are to either, set up 2fa and ensure that I lose my digital life at some point, or not have 2fa and get my shit taken instead. Google doesn't do much in that regard, other than making me confident that they won't let anyone else pollute my ad profile, but I was an actual child when I set that up, and it doesn't cost $5 a month.
  - EvanAnderson 2y ago
    I have no feelings one way or the other about Fastmail, but since the offer TOTP as an option why not just archive the TOTP secret somewhere safe and offline? Put it with important papers that you'd store in a safe deposit box, with a trusted family member, etc.
brongondwana 2y ago
We have a much better account recovery process than, say, Protonmail where if you lose your encryption key then you really are screwed. Obviously, the more information we have about you, the easier it is for you to prove your identity! Often the people who lose all their credentials and can't get the account back at all are the ones who used anonymous payment methods, clear all their cookies, use a fake name. Hard to identify those! But generally, we help people regain access with a combination of payment method, backup communication methods they have registered with us like another email address or a phone number, and at the most extreme - Government ID. Provide enough of those and survive the lockout period in which we've informed the person with access to the account and given them a chance to object, we can get you back in. Seriously the "24 hour lockout while we make sure nobody is accessing the account" is a pretty key part of slowing down attacks - generally if someone's identity is stolen then the attacker's main advantage is speed rushing through all their other accounts, so the slow-down is hugely advantageous.

fn-mote 2y ago

On one hand, I acknowledge Google's security is amazing. On the other hand, I am puzzled by your assertion that 2FA is not the answer. Fastmail has passkeys and TOTP... you are a seriously high profile target if that's not enough for you. > Do you have people who I can call and demonstrate my identity to in order to regain access to that email account if it does get hacked? Google doesn't have this, right? And actively doesn't want it. Once your account is locked down and you're not falling for the phishing attacks, this is the route in. > Tens of thousands of dollars So your security only has to stand up to say $50k of assult? No problem. That's not 0-day money. Just stick with your TOTP 2FA.

mrguyorama 2y ago
You're right, what I actually should have asked is "How do you guarantee I never lose access" If I lose the key to my house, I can change the lock, it's my property. If I lose the key to my Post Office box, the Post Office will charge me money to set up a new key. I have RIGHTS to my physical property and physical business relationships. What happens when I lose my Fastmail key? Currently the status quo is "get fucked". Which is utterly insane to me. My options in that reality are to either, set up 2fa and ensure that I lose my digital life at some point, or not have 2fa and get my shit taken instead. Google doesn't do much in that regard, other than making me confident that they won't let anyone else pollute my ad profile, but I was an actual child when I set that up, and it doesn't cost $5 a month.
- EvanAnderson 2y ago
  I have no feelings one way or the other about Fastmail, but since the offer TOTP as an option why not just archive the TOTP secret somewhere safe and offline? Put it with important papers that you'd store in a safe deposit box, with a trusted family member, etc.

brongondwana 2y ago

We have a much better account recovery process than, say, Protonmail where if you lose your encryption key then you really are screwed. Obviously, the more information we have about you, the easier it is for you to prove your identity! Often the people who lose all their credentials and can't get the account back at all are the ones who used anonymous payment methods, clear all their cookies, use a fake name. Hard to identify those! But generally, we help people regain access with a combination of payment method, backup communication methods they have registered with us like another email address or a phone number, and at the most extreme - Government ID. Provide enough of those and survive the lockout period in which we've informed the person with access to the account and given them a chance to object, we can get you back in. Seriously the "24 hour lockout while we make sure nobody is accessing the account" is a pretty key part of slowing down attacks - generally if someone's identity is stolen then the attacker's main advantage is speed rushing through all their other accounts, so the slow-down is hugely advantageous.