3 ms·
Perhaps what they need here is an optional 24-hour password reset delay. A user could only adjust this setting when properly logged in. Even if Apple gets soc
by libria 14y ago
Perhaps what they need here is an optional 24-hour password reset delay. A user could only adjust this setting when properly logged in. Even if Apple gets social engineered, the user has 24 hours to notice the difference.
Although it's extremely inconvenient to wait 1 full day to get back in, forgetting a password should be a rare circumstance .
- ralfn 14y agoNo. They just need to implement one of the common protocols. For example, they could just require ID.
- wallawe 14y agoIf you are willing to take the time to social engineer a CSR to get a password, you are likely willing to take the time to acquire a fake ID. They aren't hard to come by.
- ceol 14y agoThey still require additional effort. Right now, in my pajamas, without leaving my house or spending money, I can do exactly what that hacker did. I probably wouldn't even try it if I knew I would have to get a fake ID just to punish some Gizmodo employee for shits.
- ralfn 14y agoBesides: banks videotape their customers. We would have the culprit on video.
- ralfn 14y agoThe security of an ID is protected by the state. Screwing around with that is a federal, put your ass in prison, kind of breach, irregardless of your intention or the context.
- r00fus 14y agoJurisdiction is an issue - what if the attacker is from outside the USA (especially those countries w/o an extradition treaty)? ID is not a panacea, especially in this case. Apple is probably best to roll out some form of multi-factor auth.
- mikeash 14y agoSpending a few minutes tricking a CSR on the phone isn't even close to the difficulty of obtaining a workable fake ID. Barriers are useful even if they can be crossed with sufficient effort.
- PeterisP 14y agoWhile it's hard to make a fake ID, it's trivial to make a fake image of ID. Checking a physical ID would be a somewhat effective barrier. Checking an emailed or faxed image of an ID? Useless.
- mikeash 14y agoThat depends greatly on what kind of checking is done on the other side. For example, if they can cross-check your driver's license number with the rest of your info, then making a fake image of an ID that will pass muster will be tough.