4 ms·
If you are willing to take the time to social engineer a CSR to get a password, you are likely willing to take the time to acquire a fake ID. They aren't hard t
by wallawe 14y ago
If you are willing to take the time to social engineer a CSR to get a password, you are likely willing to take the time to acquire a fake ID. They aren't hard to come by.
- ceol 14y agoThey still require additional effort. Right now, in my pajamas, without leaving my house or spending money, I can do exactly what that hacker did. I probably wouldn't even try it if I knew I would have to get a fake ID just to punish some Gizmodo employee for shits.
- ralfn 14y agoBesides: banks videotape their customers. We would have the culprit on video.
- ralfn 14y agoThe security of an ID is protected by the state. Screwing around with that is a federal, put your ass in prison, kind of breach, irregardless of your intention or the context.
- r00fus 14y agoJurisdiction is an issue - what if the attacker is from outside the USA (especially those countries w/o an extradition treaty)? ID is not a panacea, especially in this case. Apple is probably best to roll out some form of multi-factor auth.
- mikeash 14y agoSpending a few minutes tricking a CSR on the phone isn't even close to the difficulty of obtaining a workable fake ID. Barriers are useful even if they can be crossed with sufficient effort.
- PeterisP 14y agoWhile it's hard to make a fake ID, it's trivial to make a fake image of ID. Checking a physical ID would be a somewhat effective barrier. Checking an emailed or faxed image of an ID? Useless.
- mikeash 14y agoThat depends greatly on what kind of checking is done on the other side. For example, if they can cross-check your driver's license number with the rest of your info, then making a fake image of an ID that will pass muster will be tough.