7 ms·

Support requests have always been the weakest link in the security chain for big corps. I've had accounts of mine turned over with 2FA disabled by humans before

• spullara 4mo ago
  recovery is always the weakest link in any authentication system
  • SoftTalker 4mo ago
    It's a tough problem, because people forget passwords, change phones, lose access to 2FA devices, but still need to use their accounts.
    • toomuchtodo 4mo ago
      I manage customer identity and access management ("CIAM") for a financial services firm. Passkeys are primary, recovery can be performed by providing a government credential remotely (which costs us ~$2-3 per recovery). I do not think it is hard, based on what we have built and spent to enable these capabilities. NIST Special Publication NIST SP 800-63 Digital Identity Guidelines is a helpful resource on this topic. https://pages.nist.gov/800-63-4/ https://pages.nist.gov/800-63-4/ I think Meta just does not care if they're enabling AI attack surface and vulnerabilities into these customer journeys. It's...certainly a choice, versus deterministic journeys with hard guardrails. They could make different choices.
      • macintux 4mo ago
        I’d wager your range of tech literacy/capabilities for your firm is much narrower than big tech.
        • toomuchtodo 4mo ago
          Range != value, depending on use case. Doing more poorly does not make something better. Our customer identity capabilities are very close to login.gov (we don't have to support hundreds of agency customers and common access cards), and if its good enough for ~342M Americans, its good enough for our customer base. Broadly speaking, work for the sake of work is not valuable work. Show me outcomes for resources and time invested, and compare accordingly. Value is, again broadly speaking (there is always nuance), what you deliver. If you bring me an AI solution for a high risk high value customer journey, data flow, or code path, that is an anti pattern. If you, as a colleague or a stakeholder, put forth that we must use AI in situations that require a high degree of determinism (due to potential high cost failure modes), you will need to prove this extraordinary claim with evidence. Choose Boring Technology - https://news.ycombinator.com/item?id=9291215 https://news.ycombinator.com/item?id=9291215 - March 2015 (212 comments) ["Am I using this project as an excuse to learn some new technology, or am I trying to solve a problem?"] I get paid to manage risk efficiently, including being measured on time and budget spent against the success criteria, ymmv; my comp and budget is not dependent on how much AI I shove into security systems. "What am I optimizing for?" Amazon scraps AI leaderboard to stop workers chasing usage scores - https://news.ycombinator.com/item?id=48315583 https://news.ycombinator.com/item?id=48315583 - May 2026 (19 comments)
          • fn-mote 4mo ago
            > [login.gov] if its good enough for ~342M Americans I am very curious about the actual number of users of login.gov. I am a US citizen and my experience was … negative to the point of actively avoiding it.
            • toomuchtodo 4mo ago
              > I am very curious about the actual number of users of login.gov. "Login.gov has surpassed 100 million registered user accounts. The platform facilitates over 300 million sign-ins annually and sees more than 10 million monthly active users, acting as a secure single sign-on solution across nearly 50 federal, state, and local agencies." https://www.login.gov/partners/faq/ https://www.login.gov/partners/faq/ (It is the primary identity provider for Social Security Administration, IRS will eventually adopt it [1]) [1] IRS to adopt Login.gov as user authentication tool - https://news.ycombinator.com/item?id=30430851 https://news.ycombinator.com/item?id=30430851 - February 2022 (182 comments)
      • toast0 4mo ago
        > recovery can be performed by providing a government credential remotely That only works because you presumably do KYC when you open accounts, so you have an identity to match to. Most internet accounts don't do real KYC, so a government credential doesn't really work for recovery --- they didn't know who you were, so proving who you are doesn't help anything. That doesn't mean that letting anyone sweet talk support or an AI into taking over an account is acceptable, of course.
        • toomuchtodo 4mo ago
          It's a fair point, and can be solved for as part of the "Verified" offerings Meta offers. This binds IRL identity to the digital identity at verification for future identity assurance step up (including if and when recovery is required). Failing that, TOTP, SMS, and even mailing an OTP to a mailing address remain low friction auth factors (with, of course, various levels of security). My point is that while this is not easy, there are obvious very bad ways to implement this that should not be done (chatbot or other generative AI interface vulnerable to the usual suspects of AI inherent attack surface). Don't build the bad way, the right away is known and straightforward.
    • dpark 4mo ago
      I had to go through the account recovery on my Facebook account once and the proof they demanded was that I match a bunch of pictures of friends to their names. I think it took 3 tries over multiple days to actually get it unlocked because it turns out I such really remember a lot of the people I met 20 years ago and friended on Facebook. I don’t recall why I had to go through this song and dance. Very plausibly the account was still associated with an old school address that I could no longer access. So yeah, account recovery is hard. How do you prove someone owns an account when they’ve lost the things they are supposed to use to prove ownership?
    • StilesCrisis 4mo ago
      It's worse than "forgetting." Having seen older folks just set up new accounts for a move, they make zero attempt to even try to keep them! Oh, the phone company needs a login/pass? Just type in anything, don't write it down. If something goes wrong, they're going to call in anyway, not use the website.
      • kijin 4mo ago
        One-time logins actually sound useful for things like setting up utilities for a house. Sign up, log in, do whatever you need to do, log out and the account is immediately locked. Nobody expects you to log back in anytime soon, anyway. If you ever need to interact with the service again, you initiate account recovery using a combination of your contact info and some codes printed on your monthly bill.
      • throwaway173738 4mo ago
        A lot of utility companies including Comcast used to not have a flow for “moving” and so you’d get a brand new account with a comcast email every time you moved to a new address. In a lot of cases the techs would just set it up for you as part of the install and give you the password. It’s only in the last 10 years they added anything like that. I have 3 or 4 different obsolete accounts with them where my actual email is the contact email from that time and some of their online systems will reset the wrong password and stuff like that.
  • jgalt212 4mo ago
    fair enough, but what's the actual point of 2FA if it's so easy to override?
    • spullara 4mo ago
      the alternative is people losing their accounts and people aren't willing to allow that. i do think that apple does this a little better where they try everything to contact you in every way they know and it takes a week to get access. at a minimum to change your email it should require a week of waiting to see if the user can access the original mail to the hand off.
    • deleted 4mo ago
      [deleted]
    • recursive 4mo ago
      In some cases, checkbox-compliance with customer requirements.
    • ttctciyf 4mo ago
      Personally it seems mostly about prizing the phone number out of my cold clammy hands. I recently tried to access my google account on a new browser install. Google did not believe my login/password was sufficient, and insisted on me surrendering my phone number: > To help keep your account safe, Google wants to make sure it’s really you trying to sign in [...] > Enter a phone number to get a text message with a verification code. I have never given my phone number to Google for that account (I have a separate account on my Android phone). So how on earth this will "make sure it's really you" I have no idea. I am unable to access Google from my new browser install so am stuck with using my old one for anything which requires a Google login. I guess at some point I'll try and resolve it by adding a recovery email or something, but.. my inclination is to throw Google and the account in the trash right now.
      • jazzyjackson 4mo ago
        I deleted my Google account but I’m pretty sure you can configure a Passkey on the device that lets you log in, and have that passkey in a password manager you’ve logged into on the new device and that will be considered good enough. Setting aside my opinion that it’s asinine to upload passkeys to the cloud :)
  • acdha 4mo ago
    This is not wrong but what’s really missing is cost: Meta did this so they can avoid paying people to do it. Lots of companies follow that decay spiral: your bank could shut phishers down cold by requiring wire transfers to be authorized in person but they don’t want to pay staff or risk you being upset by a transaction taking an extra hour so they don’t. Imagine an alternate universe where big tech companies worked with various trustworthy third-parties where something like this would generate a challenge you could take to your local notary, post office, library, police station, etc. where someone would check ID before approving it. How many phishing attacks would be prevented annually by a physical presence check?
    • ronsor 4mo ago
      The amount of hassle involved with regular physical checks is why it's not implemented, regardless of attack prevention. The cost of hiring a person is part of it but not really the core reason. People were sold on the Internet with "you can do things online conveniently" and reintroducing the need to physically go somewhere negates that angle entirely.
      • anonymars 4mo ago
        > People were sold on the Internet with "you can do things online conveniently" and reintroducing the need to physically go somewhere negates that angle entirely But how often does one need to do recovery procedures like this? How much less convenient is it for everyone else to be at risk of their account being taken over?
      • acdha 4mo ago
        To be clear, I was thinking cost as more than just payroll - e.g. my bank can do this because they have paid for a branch near my house, Facebook does not - but another way to look at it is that many of the costs due to errors have been shifted to the user. I do think friction causes a reflexive resistance to the idea but I think that might be an overreaction. This is a rare thing people should be doing no more than a few times in their life.
    • dylan604 4mo ago
  • UltraSane 4mo ago
    It depends. Some like AWS take it deadly seriously and it takes a long time to recover root access to an account.
  • mr_mitm 4mo ago
    It's a hard problem. How do you prove you own an account if you lost all proof of ownership? Especially so if an account was never tied to your real name, in which case you could at least rely on government ids.
    • throwaway85825 4mo ago
      Simple, you don't. This is all going to seem quaint in a few years when old accounts started getting deleted for inactivity.
    • MichaelZuo 4mo ago
      Well the obvious solution is to prevent accounts not using a real name or registered organization name from being recovered.
• moritzwarhier 4mo ago
  100% Urgency. Emotions. It's all there, and high-stakes environments with no proper protocol are most vulnerable. Source: used to work part-time in IT support at a hospital, by now 10+ years ago, so it was routinely requested to circumvent regulations and security protocols, even medical ones (cough Windows in ICU monitors and other medical "kiosk" PCs that should absolutely not run Windows)
  • Krasnol 4mo ago
    I love those admin passwords which a tech will give you at some point because he doesn't want to do the work himself. If they even have passwords... Unfortunately Siemens woke up.
    • moritzwarhier 4mo ago
      You mean admin or Administrator ? Horrific, people should be jailed for cyberattacks when they carelessly just give out this word. The experiences I meant were mostly - password reset requests (admittedly, we had a protocol even then to strictly require a "physical signature", normally meaning Fax or internal snail mail) - medical protocols: don't wanna go into too much detail here, but: 1) Windows requires a lot of maintenance, often even hard restores, to function normally, even when sold as the UI for physical ICU monitors 2) Medical personell often is severely overworked, especially people in important, but not formally highly-qualified roles. And things like Surgery rooms and ICUs often have very slim time slots. With the former, you should not enter into them without wearing appropriate clothing. It doesn't prevent people working there from requesting you to finally come over and make that UEFI-Windows-Crapware-Kiosk-PC which was sold as a medical device boot... of course especially not when there is an ongoing surgery nearby. And of course, your higher-ups will be there to help you sort out these issues without violating protocols... thankfully I didn't do careless things there and haven't witnessed IT-related disasters there. But still, I gave these examples for a reason :D there was a healthy culture but some of the situations encountered in medical IT support should really require specialized, short-term training. Keeping up rigorous hygiene protocols requires dedicated work by professionals, especially in a large hospital. And the same argument can be made for account protection and user support for large software providers.
• basisword 4mo ago
  >> The simple fact that 2FA can be removed by low level support staff drives me mad. It defeats the whole purpose of the process. The fact it can be removed by anyone is the problem. If you lose access to your 2FA (and recovery codes) then you should lose access to your account. Having it removable by anyone (other than a logged in account holder) defeats the entire point.
  • MarleTangible 4mo ago
    In theory there is no difference between theory and practice, but in practice there is. Well, it gets complicated quickly when a wide range of users involved.
  • robinpie 4mo ago
    I always thought the entire concept of even password resets was absurd. Email is a huge SPOF for basically everyone. If you lose your password or 2FA, you should lose your account, too bad so sad.
    • SoftTalker 4mo ago
      Completely unrealistic. Stuff happens. Email accounts get closed for no reason. People lose their phones, or have them stolen. Lots of reasons why someone might need an exceptional account recovery process. Not saying it should be easy or routine, it should not be. But it must be possible.
      • basisword 4mo ago
        That's what recovery codes are for. Unfortunately it seems a lot of 2FA is now implemented without recovery codes.
        • Marsymars 4mo ago
          I suspect very few people have good management of recovery codes. I just save them in my password manager. As best as I can tell, everyone I work with simply doesn't save them at all and initiates a password reset if they lose their password/2FA.
• giancarlostoro 4mo ago
  The fact that if your account has had the SAME EMAIL AND NUMBER FOR 14 YEARS OR MORE and support still thinks you got hacked is more embarrassing to me.
  • SoftTalker 4mo ago
    I used my work email for everything for 14 years, now I'm retired/fired/laid off and I can't access it anymore and I forgot to change the email linked in my Facebook account.
    • deleted 4mo ago
      [deleted]
    • giancarlostoro 4mo ago
      I would expect your IP to not change as drastically as some VPN IP being your only evidence that you're you.
      • 3form 4mo ago
        Unless you changed both job and country.
    • deleted 4mo ago
      [deleted]
    • mike_hock 4mo ago
      > I used my work email for everything Then you had it coming.
  • DSMan195276 4mo ago
    That doesn't sound that unlikely to me personally, not everybody has the best tech habits and some life events can result in losing access to both very quickly. It doesn't have to happen often for it to still be a common event in support cases.
• jeffbee 4mo ago
  Yeah. I spent years working partly for the account abuse team at Google and that is why I always shake my head (silently, because the HN groupthink disagrees) at the endless parade of stories on this site about people who lost access to their accounts and can't contact support. Under no circumstances do you want any possibility that front-line support can hand your account over to anyone. The lack of account support is a safety feature, not a flaw. If your accounts are valuable to you, act like an adult and write down the recovery codes on paper.
• ValentineC 4mo ago
  > The simple fact that 2FA can be removed by low level support staff drives me mad. It defeats the whole purpose of the process. Crazy Domains (one of the few registrars for my ccTLD) removed 2FA from my account (that was in the process of getting hijacked) despite me being on the phone with them specifically telling them not to do so [1][2]. What's worse was that my account got targeted by the same hijacker again when they seemingly changed their support system, and was hijacked for a few hours, leading to my Twitter account getting compromised (this happened around the same time fElon laid off a bunch of people and removed phone-based 2FA from accounts). Fuck Crazy Domains and Newfold Digital (formerly known as EIG). I eventually lost my OG username because fElon wanted it for his Grok nonsense anyway [3]. Fuck Elon too. [1] https://news.ycombinator.com/item?id=47913341 https://news.ycombinator.com/item?id=47913341 [2] https://news.ycombinator.com/item?id=47859496 https://news.ycombinator.com/item?id=47859496 [3] https://news.ycombinator.com/item?id=47856983 https://news.ycombinator.com/item?id=47856983
  • ipaddr 4mo ago
    I remember losing subdomain search: search.batcave.net 20+ years ago when they suddenly took it over. Batcave offered free hosting and a subdomain at the time.
  • MichaelZuo 4mo ago
    Wait… why did you continue trusting them for there to be a second time? If they didn’t care at all about your instructions the first time?
• cryptoegorophy 4mo ago
  low level support, means that they can be "bribed" to do things like this.
• pocksuppet 4mo ago
  A flow can either fail safe or fail secure. Fail secure: if you lose your email, your account is forever locked. Fail safe: if you lose your email, your account is not forever locked. But, someone else might be able to get your account by pretending you lost your email. There are no other choices. When the electronic door controller loses power, either the door stays locked, or the door stays unlocked. In case of a fire you want it unlocked so people can get out. But then a burglar can cut the power to get in. Doors that stay permanently locked in a power outage are only permitted in extreme cases where security is of the utmost importance. Obviously Instagram accounts aren't as important as doors in a fire.
  • eddd-ddde 4mo ago
    What about "go see an agent in person and use your fingerprint to prove it is you"?
    • deleted 4mo ago
      [deleted]
  • HDBaseT 4mo ago
    I don't think its that binary. Using the door and fire scenario, you can have manual opening method available, just make it only available on the inside.
  • Lonestar1440 4mo ago
    There are no other online choices. If my Bank login goes totally Kaput, though, I can take my ID down to the Branch to get it sorted. Same with my telecom provider. I try to only depend on services which have this property. I don't succeed.
    • ipaddr 4mo ago
      Sounds great until you have an aging parent with a problem who can't get there. Get a power of attorney you say.. great but they won't accept unless parent comes to the branch. This comes back to haunt you in the future.
• deleted 4mo ago
  [deleted]
• karel-3d 4mo ago
  well. I lost my 2FA dongle once (left it on a different continent). Which I used to secure my domain name on which I received mail. suddenly I was happy that low level support staff could remove it. (I needed to scan my passport and photo. This was way before modern image generation.)
  • Fnoord 4mo ago
    This is why you should have at least two MFA options enabled.
• phil21 4mo ago
  The strangest/scariest and honestly in the end all that surprising one of these I had was with a major storage appliance provider that most in the space on HN would know by name. We needed to delete a storage volume to urgently free up space, and apparently this was locked in a way the storage vendor was required to act as a "second key" to ours to make the destructive action. We had never properly set this up, and I never had even logged into my "support" account with them before. They required two authorized contacts on our end for them to confirm the action. The process was effectively my colleague handling the sev1 incident asking me to join their Zoom call. They asked for my 2FA and I said I never had one configured and obviously did not receive it since my e-mail was not setup with them. The (obviously outsourced) support rep decided just pasting the code into Zoom chat and then having me read it back to them was Good Enough(tm) and the process continued. I was a little too surprised at this at the time to think about it too much. But the fact they could see the expected generated code, and type it in themselves into their system was at least interesting to me. Not quite sure how I feel about it, since this did indeed save us from a sev1 going sev0 - but overall it's obviously quite vulnerable to both social engineering and insider attack. It's certainly a difficult tradeoff. Not sure I would hand that sort of "override" capability to someone who was was clearly a Tier 1 or 2 support rep - I'd probably bury it (but in a different manner) somewhere that required escalation to a higher authority but still could be done in timely (minutes, not hours) manner. Who knows though, as organizations scale this gets harder and harder.
  • ShinyLeftPad 4mo ago
    Ubiquiti or Synology?
    • phil21 4mo ago
      Neither, large Enterprise storage name where the prices start in the six figures for the smallest boxes.
• LandenLove 4mo ago
  Additionally, they fail to recover said account when it's taken over. My father's FaceBook account was hacked (likely through phishing) and it was impossible to contact anyone to get it back. The scum who stole his account also uploaded illegal context, so the account, along with ~10 years of personal memories, was deleted without any recourse. It was impossible to talk to a real human being at Meta. Nothing but an insanely unhelpful FAQ page. I highly advise that you download and backup any of your personal data on all your social media accounts for yourself and your loved ones. These large companies do not care about you beyond showing you ads for dropped shipped garbage from China and AI slop tiktoks.
  • dainank 4mo ago
    I had a similar experience with a Microsoft Outlook account. Supposedly this is done for legal reasons. Once an account violates certain laws, companies 'allegedly' have no choice but to permanently close that account even if you can somehow prove it was 100% the hacker who violated those rules and not you.
• AtNightWeCode 4mo ago
  I don't think it is AI. Instagram had a similar issue before. Maybe it still exists. If you ever logged in on a phone you could then use that phone to reset the password.
• meszmate 4mo ago
  [dead]
• davedx 4mo ago
  I recently went through this process with Microsoft for Office365 and it was reasonably well executed: it needed escalation and three separate callbacks to first verify, then reset my password, then reset my MFA (I changed my phone and lost the lot).