4 ms·

This is not wrong but what’s really missing is cost: Meta did this so they can avoid paying people to do it. Lots of companies follow that decay spiral: your ba

by acdha 5mo ago

This is not wrong but what’s really missing is cost: Meta did this so they can avoid paying people to do it. Lots of companies follow that decay spiral: your bank could shut phishers down cold by requiring wire transfers to be authorized in person but they don’t want to pay staff or risk you being upset by a transaction taking an extra hour so they don’t. Imagine an alternate universe where big tech companies worked with various trustworthy third-parties where something like this would generate a challenge you could take to your local notary, post office, library, police station, etc. where someone would check ID before approving it. How many phishing attacks would be prevented annually by a physical presence check?

ronsor 5mo ago
The amount of hassle involved with regular physical checks is why it's not implemented, regardless of attack prevention. The cost of hiring a person is part of it but not really the core reason. People were sold on the Internet with "you can do things online conveniently" and reintroducing the need to physically go somewhere negates that angle entirely.
- anonymars 5mo ago
  > People were sold on the Internet with "you can do things online conveniently" and reintroducing the need to physically go somewhere negates that angle entirely But how often does one need to do recovery procedures like this? How much less convenient is it for everyone else to be at risk of their account being taken over?
- acdha 5mo ago
  To be clear, I was thinking cost as more than just payroll - e.g. my bank can do this because they have paid for a branch near my house, Facebook does not - but another way to look at it is that many of the costs due to errors have been shifted to the user. I do think friction causes a reflexive resistance to the idea but I think that might be an overreaction. This is a rare thing people should be doing no more than a few times in their life.
dylan604 5mo ago
> your bank could shut phishers down cold by requiring wire transfers to be authorized in person but they don’t want to pay staff or risk you being upset by a transaction taking an extra hour so they don’t. Isn't this essentially what just recently happened to the Pope? Then there were people here doing the rest of your comment for him saying how egregious it was for them to ask for an in person authorization. It sounded like all he was trying to do was update his address, but changing your address from one in Chicago to one in a European country absolutely sounds like something a phisher would be trying to do.
- throwaway85825 5mo ago
  Its perfectly acceptable for a security model to make things difficult for extreme edge cases like the pope. After all if the situation warrants it such rare events can always be escalated.
  - Terr_ 5mo ago
    To frame it another way: Better to inconvenience the pope once every few years than have tens of thousands of "little person" account compromises every year. I expect his Holiness might agree.
- acdha 5mo ago
  Yes, there were people here criticizing that but also plenty of people saying it was a reasonable trade off. Making exceptional things harder to make everyday security better is not a bad decision even if it upsets techies who’d like everything to be automated.
spullara 5mo ago
for a while facebook had the ability to recover your account by having them ask several of your friends if the recovery was legitimate but it was turned off. my guess is that not enough people added trusted contacts to bother running it. https://www.theverge.com/2013/5/2/4292744/facebook-trusted-contacts-account-security-launch https://www.theverge.com/2013/5/2/4292744/facebook-trusted-c...
- parable 5mo ago
  I actually quite like this solution. Beats asking users to add a "recovery selfie" (something Meta actually does now) - I'd rather choose 3 of my friends and have them approve some notification in-app. Seems like better UX and preserves privacy a slight bit more, but we all know Meta's not in the privacy business.
  - spullara 5mo ago
    honestly I can't think of a better solution that would require a far more coordinated attack to pull off. it should work on any system where trusted folks are likely to have accounts.
econ 5mo ago
Then you get trusted parties selling account access. Even if you remove them for a single false positive they will do it. A bit like a % packages "vanishing". The least terrible seem digital id.
- acdha 5mo ago
  > Then you get trusted parties selling account access How many bank tellers or USPS employees do that, though? It’s possible but quite rare because people know they’ll be running a big risk of being caught and no individual transaction is worth that much.
  - sparqlittlestar 5mo ago
    Interstingly, since 2008 Dutch bankers need to take an oath and whilst I don't think that in itself deters fraud, being fired for fraud would preclude going back to work for another bank (tuchtrecht / disciplinairy law)
deleted 5mo ago
[deleted]

by acdha 5mo ago

ronsor 5mo ago

The amount of hassle involved with regular physical checks is why it's not implemented, regardless of attack prevention. The cost of hiring a person is part of it but not really the core reason. People were sold on the Internet with "you can do things online conveniently" and reintroducing the need to physically go somewhere negates that angle entirely.

anonymars 5mo ago
> People were sold on the Internet with "you can do things online conveniently" and reintroducing the need to physically go somewhere negates that angle entirely But how often does one need to do recovery procedures like this? How much less convenient is it for everyone else to be at risk of their account being taken over?
acdha 5mo ago
To be clear, I was thinking cost as more than just payroll - e.g. my bank can do this because they have paid for a branch near my house, Facebook does not - but another way to look at it is that many of the costs due to errors have been shifted to the user. I do think friction causes a reflexive resistance to the idea but I think that might be an overreaction. This is a rare thing people should be doing no more than a few times in their life.

dylan604 5mo ago

> your bank could shut phishers down cold by requiring wire transfers to be authorized in person but they don’t want to pay staff or risk you being upset by a transaction taking an extra hour so they don’t. Isn't this essentially what just recently happened to the Pope? Then there were people here doing the rest of your comment for him saying how egregious it was for them to ask for an in person authorization. It sounded like all he was trying to do was update his address, but changing your address from one in Chicago to one in a European country absolutely sounds like something a phisher would be trying to do.

throwaway85825 5mo ago
Its perfectly acceptable for a security model to make things difficult for extreme edge cases like the pope. After all if the situation warrants it such rare events can always be escalated.
- Terr_ 5mo ago
  To frame it another way: Better to inconvenience the pope once every few years than have tens of thousands of "little person" account compromises every year. I expect his Holiness might agree.
acdha 5mo ago
Yes, there were people here criticizing that but also plenty of people saying it was a reasonable trade off. Making exceptional things harder to make everyday security better is not a bad decision even if it upsets techies who’d like everything to be automated.

spullara 5mo ago

for a while facebook had the ability to recover your account by having them ask several of your friends if the recovery was legitimate but it was turned off. my guess is that not enough people added trusted contacts to bother running it. https://www.theverge.com/2013/5/2/4292744/facebook-trusted-contacts-account-security-launch https://www.theverge.com/2013/5/2/4292744/facebook-trusted-c...

parable 5mo ago
I actually quite like this solution. Beats asking users to add a "recovery selfie" (something Meta actually does now) - I'd rather choose 3 of my friends and have them approve some notification in-app. Seems like better UX and preserves privacy a slight bit more, but we all know Meta's not in the privacy business.
- spullara 5mo ago
  honestly I can't think of a better solution that would require a far more coordinated attack to pull off. it should work on any system where trusted folks are likely to have accounts.

econ 5mo ago

Then you get trusted parties selling account access. Even if you remove them for a single false positive they will do it. A bit like a % packages "vanishing". The least terrible seem digital id.

acdha 5mo ago
> Then you get trusted parties selling account access How many bank tellers or USPS employees do that, though? It’s possible but quite rare because people know they’ll be running a big risk of being caught and no individual transaction is worth that much.
- sparqlittlestar 5mo ago
  Interstingly, since 2008 Dutch bankers need to take an oath and whilst I don't think that in itself deters fraud, being fired for fraud would preclude going back to work for another bank (tuchtrecht / disciplinairy law)

deleted 5mo ago

[deleted]