6 ms·

recovery is always the weakest link in any authentication system

SoftTalker 4mo ago
It's a tough problem, because people forget passwords, change phones, lose access to 2FA devices, but still need to use their accounts.
- toomuchtodo 4mo ago
  I manage customer identity and access management ("CIAM") for a financial services firm. Passkeys are primary, recovery can be performed by providing a government credential remotely (which costs us ~$2-3 per recovery). I do not think it is hard, based on what we have built and spent to enable these capabilities. NIST Special Publication NIST SP 800-63 Digital Identity Guidelines is a helpful resource on this topic. https://pages.nist.gov/800-63-4/ https://pages.nist.gov/800-63-4/ I think Meta just does not care if they're enabling AI attack surface and vulnerabilities into these customer journeys. It's...certainly a choice, versus deterministic journeys with hard guardrails. They could make different choices.
  - macintux 4mo ago
    I’d wager your range of tech literacy/capabilities for your firm is much narrower than big tech.
    - toomuchtodo 4mo ago
      Range != value, depending on use case. Doing more poorly does not make something better. Our customer identity capabilities are very close to login.gov (we don't have to support hundreds of agency customers and common access cards), and if its good enough for ~342M Americans, its good enough for our customer base. Broadly speaking, work for the sake of work is not valuable work. Show me outcomes for resources and time invested, and compare accordingly. Value is, again broadly speaking (there is always nuance), what you deliver. If you bring me an AI solution for a high risk high value customer journey, data flow, or code path, that is an anti pattern. If you, as a colleague or a stakeholder, put forth that we must use AI in situations that require a high degree of determinism (due to potential high cost failure modes), you will need to prove this extraordinary claim with evidence. Choose Boring Technology - https://news.ycombinator.com/item?id=9291215 https://news.ycombinator.com/item?id=9291215 - March 2015 (212 comments) ["Am I using this project as an excuse to learn some new technology, or am I trying to solve a problem?"] I get paid to manage risk efficiently, including being measured on time and budget spent against the success criteria, ymmv; my comp and budget is not dependent on how much AI I shove into security systems. "What am I optimizing for?" Amazon scraps AI leaderboard to stop workers chasing usage scores - https://news.ycombinator.com/item?id=48315583 https://news.ycombinator.com/item?id=48315583 - May 2026 (19 comments)
      - fn-mote 4mo ago
        > [login.gov] if its good enough for ~342M Americans I am very curious about the actual number of users of login.gov. I am a US citizen and my experience was … negative to the point of actively avoiding it.
        toomuchtodo 4mo ago
        > I am very curious about the actual number of users of login.gov. "Login.gov has surpassed 100 million registered user accounts. The platform facilitates over 300 million sign-ins annually and sees more than 10 million monthly active users, acting as a secure single sign-on solution across nearly 50 federal, state, and local agencies." https://www.login.gov/partners/faq/ https://www.login.gov/partners/faq/ (It is the primary identity provider for Social Security Administration, IRS will eventually adopt it [1]) [1] IRS to adopt Login.gov as user authentication tool - https://news.ycombinator.com/item?id=30430851 https://news.ycombinator.com/item?id=30430851 - February 2022 (182 comments)
        plasma_beam 4mo ago
        I have multiple login.gov accounts. They don’t let you change your primary email, so if you’re using corporate account and switch jobs the normal thing is to create new accounts. I’m sure this is padding their numbers.
        toomuchtodo 4mo ago
        If you must use login.gov for Social Security, and you will eventually be required to use it for the IRS (and everyone who has a US tax liability), I think the numbers are somewhat irrelevant. Almost everyone over the age of 18 will be a customer of it (for federal tax and benefits logistics). It is the idp you must use, and again, it is good enough (based on all available evidence).
    - econ 4mo ago
      Someone gained access to a Instagram account (belonging to a business by the same name) connected to a fb account (by the same name) that they still had access to. The only thing fb could do was terminate the Instagram for impersonation. It's an impressive level of incompetence.
  - toast0 4mo ago
    > recovery can be performed by providing a government credential remotely That only works because you presumably do KYC when you open accounts, so you have an identity to match to. Most internet accounts don't do real KYC, so a government credential doesn't really work for recovery --- they didn't know who you were, so proving who you are doesn't help anything. That doesn't mean that letting anyone sweet talk support or an AI into taking over an account is acceptable, of course.
    - toomuchtodo 4mo ago
      It's a fair point, and can be solved for as part of the "Verified" offerings Meta offers. This binds IRL identity to the digital identity at verification for future identity assurance step up (including if and when recovery is required). Failing that, TOTP, SMS, and even mailing an OTP to a mailing address remain low friction auth factors (with, of course, various levels of security). My point is that while this is not easy, there are obvious very bad ways to implement this that should not be done (chatbot or other generative AI interface vulnerable to the usual suspects of AI inherent attack surface). Don't build the bad way, the right away is known and straightforward.
- dpark 4mo ago
  I had to go through the account recovery on my Facebook account once and the proof they demanded was that I match a bunch of pictures of friends to their names. I think it took 3 tries over multiple days to actually get it unlocked because it turns out I such really remember a lot of the people I met 20 years ago and friended on Facebook. I don’t recall why I had to go through this song and dance. Very plausibly the account was still associated with an old school address that I could no longer access. So yeah, account recovery is hard. How do you prove someone owns an account when they’ve lost the things they are supposed to use to prove ownership?
- StilesCrisis 4mo ago
  It's worse than "forgetting." Having seen older folks just set up new accounts for a move, they make zero attempt to even try to keep them! Oh, the phone company needs a login/pass? Just type in anything, don't write it down. If something goes wrong, they're going to call in anyway, not use the website.
  - kijin 4mo ago
    One-time logins actually sound useful for things like setting up utilities for a house. Sign up, log in, do whatever you need to do, log out and the account is immediately locked. Nobody expects you to log back in anytime soon, anyway. If you ever need to interact with the service again, you initiate account recovery using a combination of your contact info and some codes printed on your monthly bill.
  - throwaway173738 4mo ago
    A lot of utility companies including Comcast used to not have a flow for “moving” and so you’d get a brand new account with a comcast email every time you moved to a new address. In a lot of cases the techs would just set it up for you as part of the install and give you the password. It’s only in the last 10 years they added anything like that. I have 3 or 4 different obsolete accounts with them where my actual email is the contact email from that time and some of their online systems will reset the wrong password and stuff like that.
jgalt212 4mo ago
fair enough, but what's the actual point of 2FA if it's so easy to override?
- spullara 4mo ago
  the alternative is people losing their accounts and people aren't willing to allow that. i do think that apple does this a little better where they try everything to contact you in every way they know and it takes a week to get access. at a minimum to change your email it should require a week of waiting to see if the user can access the original mail to the hand off.
- deleted 4mo ago
  [deleted]
- recursive 4mo ago
  In some cases, checkbox-compliance with customer requirements.
- ttctciyf 4mo ago
  Personally it seems mostly about prizing the phone number out of my cold clammy hands. I recently tried to access my google account on a new browser install. Google did not believe my login/password was sufficient, and insisted on me surrendering my phone number: > To help keep your account safe, Google wants to make sure it’s really you trying to sign in [...] > Enter a phone number to get a text message with a verification code. I have never given my phone number to Google for that account (I have a separate account on my Android phone). So how on earth this will "make sure it's really you" I have no idea. I am unable to access Google from my new browser install so am stuck with using my old one for anything which requires a Google login. I guess at some point I'll try and resolve it by adding a recovery email or something, but.. my inclination is to throw Google and the account in the trash right now.
  - jazzyjackson 4mo ago
    I deleted my Google account but I’m pretty sure you can configure a Passkey on the device that lets you log in, and have that passkey in a password manager you’ve logged into on the new device and that will be considered good enough. Setting aside my opinion that it’s asinine to upload passkeys to the cloud :)
acdha 4mo ago
This is not wrong but what’s really missing is cost: Meta did this so they can avoid paying people to do it. Lots of companies follow that decay spiral: your bank could shut phishers down cold by requiring wire transfers to be authorized in person but they don’t want to pay staff or risk you being upset by a transaction taking an extra hour so they don’t. Imagine an alternate universe where big tech companies worked with various trustworthy third-parties where something like this would generate a challenge you could take to your local notary, post office, library, police station, etc. where someone would check ID before approving it. How many phishing attacks would be prevented annually by a physical presence check?
- ronsor 4mo ago
  The amount of hassle involved with regular physical checks is why it's not implemented, regardless of attack prevention. The cost of hiring a person is part of it but not really the core reason. People were sold on the Internet with "you can do things online conveniently" and reintroducing the need to physically go somewhere negates that angle entirely.
  - anonymars 4mo ago
    > People were sold on the Internet with "you can do things online conveniently" and reintroducing the need to physically go somewhere negates that angle entirely But how often does one need to do recovery procedures like this? How much less convenient is it for everyone else to be at risk of their account being taken over?
  - acdha 4mo ago
    To be clear, I was thinking cost as more than just payroll - e.g. my bank can do this because they have paid for a branch near my house, Facebook does not - but another way to look at it is that many of the costs due to errors have been shifted to the user. I do think friction causes a reflexive resistance to the idea but I think that might be an overreaction. This is a rare thing people should be doing no more than a few times in their life.
- dylan604 4mo ago
UltraSane 4mo ago
It depends. Some like AWS take it deadly seriously and it takes a long time to recover root access to an account.
mr_mitm 4mo ago
It's a hard problem. How do you prove you own an account if you lost all proof of ownership? Especially so if an account was never tied to your real name, in which case you could at least rely on government ids.
- throwaway85825 4mo ago
  Simple, you don't. This is all going to seem quaint in a few years when old accounts started getting deleted for inactivity.
- MichaelZuo 4mo ago
  Well the obvious solution is to prevent accounts not using a real name or registered organization name from being recovered.

It's a tough problem, because people forget passwords, change phones, lose access to 2FA devices, but still need to use their accounts.

toomuchtodo 4mo ago
I manage customer identity and access management ("CIAM") for a financial services firm. Passkeys are primary, recovery can be performed by providing a government credential remotely (which costs us ~$2-3 per recovery). I do not think it is hard, based on what we have built and spent to enable these capabilities. NIST Special Publication NIST SP 800-63 Digital Identity Guidelines is a helpful resource on this topic. https://pages.nist.gov/800-63-4/ https://pages.nist.gov/800-63-4/ I think Meta just does not care if they're enabling AI attack surface and vulnerabilities into these customer journeys. It's...certainly a choice, versus deterministic journeys with hard guardrails. They could make different choices.
- macintux 4mo ago
  I’d wager your range of tech literacy/capabilities for your firm is much narrower than big tech.
  - toomuchtodo 4mo ago
    Range != value, depending on use case. Doing more poorly does not make something better. Our customer identity capabilities are very close to login.gov (we don't have to support hundreds of agency customers and common access cards), and if its good enough for ~342M Americans, its good enough for our customer base. Broadly speaking, work for the sake of work is not valuable work. Show me outcomes for resources and time invested, and compare accordingly. Value is, again broadly speaking (there is always nuance), what you deliver. If you bring me an AI solution for a high risk high value customer journey, data flow, or code path, that is an anti pattern. If you, as a colleague or a stakeholder, put forth that we must use AI in situations that require a high degree of determinism (due to potential high cost failure modes), you will need to prove this extraordinary claim with evidence. Choose Boring Technology - https://news.ycombinator.com/item?id=9291215 https://news.ycombinator.com/item?id=9291215 - March 2015 (212 comments) ["Am I using this project as an excuse to learn some new technology, or am I trying to solve a problem?"] I get paid to manage risk efficiently, including being measured on time and budget spent against the success criteria, ymmv; my comp and budget is not dependent on how much AI I shove into security systems. "What am I optimizing for?" Amazon scraps AI leaderboard to stop workers chasing usage scores - https://news.ycombinator.com/item?id=48315583 https://news.ycombinator.com/item?id=48315583 - May 2026 (19 comments)
    - fn-mote 4mo ago
      > [login.gov] if its good enough for ~342M Americans I am very curious about the actual number of users of login.gov. I am a US citizen and my experience was … negative to the point of actively avoiding it.
      - toomuchtodo 4mo ago
        > I am very curious about the actual number of users of login.gov. "Login.gov has surpassed 100 million registered user accounts. The platform facilitates over 300 million sign-ins annually and sees more than 10 million monthly active users, acting as a secure single sign-on solution across nearly 50 federal, state, and local agencies." https://www.login.gov/partners/faq/ https://www.login.gov/partners/faq/ (It is the primary identity provider for Social Security Administration, IRS will eventually adopt it [1]) [1] IRS to adopt Login.gov as user authentication tool - https://news.ycombinator.com/item?id=30430851 https://news.ycombinator.com/item?id=30430851 - February 2022 (182 comments)
        plasma_beam 4mo ago
        I have multiple login.gov accounts. They don’t let you change your primary email, so if you’re using corporate account and switch jobs the normal thing is to create new accounts. I’m sure this is padding their numbers.
        toomuchtodo 4mo ago
        If you must use login.gov for Social Security, and you will eventually be required to use it for the IRS (and everyone who has a US tax liability), I think the numbers are somewhat irrelevant. Almost everyone over the age of 18 will be a customer of it (for federal tax and benefits logistics). It is the idp you must use, and again, it is good enough (based on all available evidence).
  - econ 4mo ago
    Someone gained access to a Instagram account (belonging to a business by the same name) connected to a fb account (by the same name) that they still had access to. The only thing fb could do was terminate the Instagram for impersonation. It's an impressive level of incompetence.
- toast0 4mo ago
  > recovery can be performed by providing a government credential remotely That only works because you presumably do KYC when you open accounts, so you have an identity to match to. Most internet accounts don't do real KYC, so a government credential doesn't really work for recovery --- they didn't know who you were, so proving who you are doesn't help anything. That doesn't mean that letting anyone sweet talk support or an AI into taking over an account is acceptable, of course.
  - toomuchtodo 4mo ago
    It's a fair point, and can be solved for as part of the "Verified" offerings Meta offers. This binds IRL identity to the digital identity at verification for future identity assurance step up (including if and when recovery is required). Failing that, TOTP, SMS, and even mailing an OTP to a mailing address remain low friction auth factors (with, of course, various levels of security). My point is that while this is not easy, there are obvious very bad ways to implement this that should not be done (chatbot or other generative AI interface vulnerable to the usual suspects of AI inherent attack surface). Don't build the bad way, the right away is known and straightforward.
dpark 4mo ago
I had to go through the account recovery on my Facebook account once and the proof they demanded was that I match a bunch of pictures of friends to their names. I think it took 3 tries over multiple days to actually get it unlocked because it turns out I such really remember a lot of the people I met 20 years ago and friended on Facebook. I don’t recall why I had to go through this song and dance. Very plausibly the account was still associated with an old school address that I could no longer access. So yeah, account recovery is hard. How do you prove someone owns an account when they’ve lost the things they are supposed to use to prove ownership?
StilesCrisis 4mo ago
It's worse than "forgetting." Having seen older folks just set up new accounts for a move, they make zero attempt to even try to keep them! Oh, the phone company needs a login/pass? Just type in anything, don't write it down. If something goes wrong, they're going to call in anyway, not use the website.
- kijin 4mo ago
  One-time logins actually sound useful for things like setting up utilities for a house. Sign up, log in, do whatever you need to do, log out and the account is immediately locked. Nobody expects you to log back in anytime soon, anyway. If you ever need to interact with the service again, you initiate account recovery using a combination of your contact info and some codes printed on your monthly bill.
- throwaway173738 4mo ago
  A lot of utility companies including Comcast used to not have a flow for “moving” and so you’d get a brand new account with a comcast email every time you moved to a new address. In a lot of cases the techs would just set it up for you as part of the install and give you the password. It’s only in the last 10 years they added anything like that. I have 3 or 4 different obsolete accounts with them where my actual email is the contact email from that time and some of their online systems will reset the wrong password and stuff like that.

jgalt212 4mo ago

fair enough, but what's the actual point of 2FA if it's so easy to override?

spullara 4mo ago
the alternative is people losing their accounts and people aren't willing to allow that. i do think that apple does this a little better where they try everything to contact you in every way they know and it takes a week to get access. at a minimum to change your email it should require a week of waiting to see if the user can access the original mail to the hand off.
deleted 4mo ago
[deleted]
recursive 4mo ago
In some cases, checkbox-compliance with customer requirements.
ttctciyf 4mo ago
Personally it seems mostly about prizing the phone number out of my cold clammy hands. I recently tried to access my google account on a new browser install. Google did not believe my login/password was sufficient, and insisted on me surrendering my phone number: > To help keep your account safe, Google wants to make sure it’s really you trying to sign in [...] > Enter a phone number to get a text message with a verification code. I have never given my phone number to Google for that account (I have a separate account on my Android phone). So how on earth this will "make sure it's really you" I have no idea. I am unable to access Google from my new browser install so am stuck with using my old one for anything which requires a Google login. I guess at some point I'll try and resolve it by adding a recovery email or something, but.. my inclination is to throw Google and the account in the trash right now.
- jazzyjackson 4mo ago
  I deleted my Google account but I’m pretty sure you can configure a Passkey on the device that lets you log in, and have that passkey in a password manager you’ve logged into on the new device and that will be considered good enough. Setting aside my opinion that it’s asinine to upload passkeys to the cloud :)

acdha 4mo ago

This is not wrong but what’s really missing is cost: Meta did this so they can avoid paying people to do it. Lots of companies follow that decay spiral: your bank could shut phishers down cold by requiring wire transfers to be authorized in person but they don’t want to pay staff or risk you being upset by a transaction taking an extra hour so they don’t. Imagine an alternate universe where big tech companies worked with various trustworthy third-parties where something like this would generate a challenge you could take to your local notary, post office, library, police station, etc. where someone would check ID before approving it. How many phishing attacks would be prevented annually by a physical presence check?

ronsor 4mo ago
The amount of hassle involved with regular physical checks is why it's not implemented, regardless of attack prevention. The cost of hiring a person is part of it but not really the core reason. People were sold on the Internet with "you can do things online conveniently" and reintroducing the need to physically go somewhere negates that angle entirely.
- anonymars 4mo ago
  > People were sold on the Internet with "you can do things online conveniently" and reintroducing the need to physically go somewhere negates that angle entirely But how often does one need to do recovery procedures like this? How much less convenient is it for everyone else to be at risk of their account being taken over?
- acdha 4mo ago
  To be clear, I was thinking cost as more than just payroll - e.g. my bank can do this because they have paid for a branch near my house, Facebook does not - but another way to look at it is that many of the costs due to errors have been shifted to the user. I do think friction causes a reflexive resistance to the idea but I think that might be an overreaction. This is a rare thing people should be doing no more than a few times in their life.
dylan604 4mo ago

UltraSane 4mo ago

It depends. Some like AWS take it deadly seriously and it takes a long time to recover root access to an account.

mr_mitm 4mo ago

It's a hard problem. How do you prove you own an account if you lost all proof of ownership? Especially so if an account was never tied to your real name, in which case you could at least rely on government ids.

throwaway85825 4mo ago
Simple, you don't. This is all going to seem quaint in a few years when old accounts started getting deleted for inactivity.
MichaelZuo 4mo ago
Well the obvious solution is to prevent accounts not using a real name or registered organization name from being recovered.