Re:Post a boarding pass on Facebook, get your account stolen
by ubernostrum on Saturday September 23, 2017 @10:02AM
(#15319760)
As noted in another comment, the attack on this of "oh I forgot, it's random characters" requires the attacker to know you do this. So if you do this, don't go disclosing it on public websites.
[ Parent
| on HN ]
Re:Post a boarding pass on Facebook, get your account stolen
by always_good on Saturday September 23, 2017 @11:15AM
(#15320093)
>requires the attacker to know you do this
Nah, "well, it kinda looks like random characters" is information a support rep will give you.
Welcome to social engineering and info escalation.
Re:Post a boarding pass on Facebook, get your account stolen
by ubernostrum on Saturday September 23, 2017 @02:08PM
(#15320913)
If the support rep is just giving away enough info to figure this out, there is nothing you can do to protect yourself against the company's policies.
Re:Post a boarding pass on Facebook, get your account stolen
by always_good on Saturday September 23, 2017 @05:27PM
(#15321834)
Yes, which is why social engineering is going to get a whole lot worse before it gets better.
Re:Post a boarding pass on Facebook, get your account stolen
by whiddershins on Saturday September 23, 2017 @10:21AM
(#15319856)
As another commenter mentioned, a help desk rep once gave the clue "it's really weird" over the phone, which would easily indicate to an attack to try the mash the keyboard line.
The random character thing isn't great for this use, it seems, as a result.
Re:Post a boarding pass on Facebook, get your account stolen
by ubernostrum on Saturday September 23, 2017 @02:08PM
(#15320916)
If support reps give enough information away over the phone to let someone guess a security question, there is nothing you can do to protect yourself from them.