undefined | Better HN

0 pointsIncRnd3y ago0 comments

> Here's the solution: Since OP is regularly in contact with 30+ homeless people, he can offer to be their backup email account. He can then confirm the identity of people if they lose access to their account and help them get it back.

> Or, he can safely store their 2FA backup codes in his house.

Why even have security? Your solution practically screams for those 30+ people to be taken advantage of.

Just use a different email provider whose procedures align with how you regularly change your phone number.

0 comments

googlryas3y ago

Why would Chad Loder take advantage of them? Yes, it gives him the ability to, but that doesn't mean he will.

Why have security? So some random, untrusted person can't compromise the account. If Chad holds the codes, then only he can compromise the account, and maybe their relationships are good enough that they would trust him.

Using a different email provider also works, but I assumed there would be some reason that doesn't work - android effectively has a built in gmail client, non-tech people might just autocomplete "@gmail.com" and mess up someone's address if it is a non-expected domain, etc.

IncRndOP3y ago

> Why have security? So some random, untrusted person can't compromise the account.

I know why there should be security. I was pointing out that what you suggested would degrade security.

It's not whether one specific person would do anything with 30 phones' backup codes but that such a list would exist. There are many other valid security practices that can be used.

j / k navigate · click thread line to collapse