News for hackers. Stuff that matters.

A comment on Namecheap live chat social engineering leads to loss of 2 VPS. Parent comment

Re:Namecheap live chat social engineering leads to loss of 2... by ryanl0l on Tuesday April 12, 2016 @10:42AM (#11479961)
Most will require a password reset email, I'd say that's significantly better than asking for ID scans.

Edit: Since I'm getting some downvotes I'd really like to know how one could possibly argue that asking for ID scans is better than email resets. You can't really forge the ability to receive email at an address, but you can very easily replace the name on an ID scan.

[ Parent | on HN ]
Re:Namecheap live chat social engineering leads to loss of 2... by celticninja on Tuesday April 12, 2016 @01:15PM (#11481442)
Did you read the article? I ask because one of the problems was a compromised email account.
[ Parent | on HN ]
Re:Namecheap live chat social engineering leads to loss of 2... by ryanlol on Tuesday April 12, 2016 @01:26PM (#11481575)
I did. It doesn't change anything, email is still a way better verification method than ID scans that the company will be unable to authenticate.
[ Parent | on HN ]
Re:Namecheap live chat social engineering leads to loss of 2... by celticninja on Friday April 15, 2016 @08:08AM (#11503633)
unless your email account has been compromised.
[ Parent | on HN ]
Re:Namecheap live chat social engineering leads to loss of 2... by ryanlol on Saturday April 16, 2016 @07:26AM (#11510187)
Even if the email account is compromised it's still stronger proof of identity than ID scans.

An attacker can't just pretend to be able to read your email, such ability is too easy to conclusively prove. To be able to read your email they need to hack you somehow.

But for a fake ID the attacker only needs to throw your name in a PSD and they're good to go.

[ Parent | on HN ]