undefined | Better HN

0 pointshombre_fatal9mo ago0 comments

To add, services account for that failure by introducing something worse: a customer service backdoor where you can get into an account with very weak or nonexistent authentication.

With Amazon's live chat, someone was able to get into my account by providing an address in the same city as the destination of my latest Amazon order.

You see this with 2FA since "sorry lol you've lost your account forever" isn't an option, and it's trivial for users to lose their 2FA key unlike, say, access to their email.

0 comments

tzs9mo ago

Services that use passwords for login need to do that too, because people lose passwords.

Even services that use login via emailed link need to do it because people do lose email access. Far too many people use the email provided by their ISP as their only email service, which can be very bad if they move to someplace that ISP does not serve or simply want to switch to another ISP in their current area.

hombre_fatalOP9mo ago

The forgot-my-password email link has a customer support load very different from "I can't do 2fa because I lost my device".

And once you set up a customer service pipeline for it, you might accidentally create a backdoor that's far worse than forgot-my-password email verification: https://medium.com/@espringe/amazon-s-customer-service-backd...

Email account access is the closest thing we have to ubiquitous identity on the web. Users that truly lose access to their email account are in a catastrophic situation before they even think of whether they can access your service.

philistine9mo ago

The solution is what's already happening, but throughly enforced: allow designated users to restore your access to your account.

hombre_fatalOP9mo ago

Heh, that is kinda interesting and I've never heard of it before. What are some services that have this set up?

So, I guess you set up some "emergency users". And maybe if you lose access to your account, you get customer support to mark your account as lost which sends an email to the address that you have on file (in case it's an attack started by someone other than the user).

And I suppose if N days pass without any login, one of your emergency users can generate a credential that they can pass to you to recover your account?

philistine9mo ago

Apple accounts have had it for years. You can set up a legal successor if you die, and a couple of people who can vouch for you to regain access.

That and Apple will give you a very long one-time password meant to be printed that can restore access as well. This one is in a third undisclosed location for me.

j / k navigate · click thread line to collapse

0 comments

tzs9mo ago

Services that use passwords for login need to do that too, because people lose passwords.

hombre_fatalOP9mo ago

The forgot-my-password email link has a customer support load very different from "I can't do 2fa because I lost my device".

philistine9mo ago

The solution is what's already happening, but throughly enforced: allow designated users to restore your access to your account.

hombre_fatalOP9mo ago

Heh, that is kinda interesting and I've never heard of it before. What are some services that have this set up?

And I suppose if N days pass without any login, one of your emergency users can generate a credential that they can pass to you to recover your account?

philistine9mo ago

Apple accounts have had it for years. You can set up a legal successor if you die, and a couple of people who can vouch for you to regain access.

That and Apple will give you a very long one-time password meant to be printed that can restore access as well. This one is in a third undisclosed location for me.

j / k navigate · click thread line to collapse