undefined | Better HN

0 pointszozbot23410mo ago0 comments

> I'd rather granny needs to visit the bank to get access to her account again, than someone phishes her and steals all her money.

The problem is that I can physically show up at my local bank branch or at my job's IT helpdesk to get my account back, but I can't show up at the Googleplex or at Facebook's or Xitter's HQ and do the same. Device bound passkeys are very error prone for the latter scenario, since users will fail to account for that case.

0 comments

1 comments · 1 top-level

hombre_fatal10mo ago

To add, services account for that failure by introducing something worse: a customer service backdoor where you can get into an account with very weak or nonexistent authentication.

With Amazon's live chat, someone was able to get into my account by providing an address in the same city as the destination of my latest Amazon order.

You see this with 2FA since "sorry lol you've lost your account forever" isn't an option, and it's trivial for users to lose their 2FA key unlike, say, access to their email.

2 more replies

j / k navigate · click thread line to collapse