News for hackers. Stuff that matters.

A comment on Yahoo Triples Estimate of Breached Accounts to 3B. Parent comment

Re:Yahoo Triples Estimate of Breached Accounts to 3B by osteele on Tuesday October 03, 2017 @05:57PM (#15396571)
For a consumer mail service, you to need to know enough to let them recover their account, possibly with decades of un-backed-up correspondence with and photos of since-deceased friends and relatives, when they’ve forgotten their password, and without letting someone else recover their account. This is a hard problem.

(I’m expecting some idealized “solutions” from people with idealized beliefs about mass market tech skills.)

[ Parent | on HN ]
Re:Yahoo Triples Estimate of Breached Accounts to 3B by nameless912 on Tuesday October 03, 2017 @07:38PM (#15397142)
Why don't we just <incredibly naive solution that does nothing to help, but somehow also involves the blockchain>?
[ Parent | on HN ]
Re:Yahoo Triples Estimate of Breached Accounts to 3B by abraae on Tuesday October 03, 2017 @10:54PM (#15397966)
This is such a nasty area, with such crappy solutions (name of your first pet), that it should become a service all of its own.

i.e. when I sign up with you, I can choose my own preferred vendor to handle identity recovery.

[ Parent | on HN ]
Re:Yahoo Triples Estimate of Breached Accounts to 3B by Karunamon on Tuesday October 03, 2017 @06:27PM (#15396730)
You also need a process for resolving ownership disputes. Facebook takes the tactic of having the person claiming ownership upload government-issued ID, which seems like it would be the only foolproof way to do so, yet they're constantly maligned for it.
[ Parent | on HN ]
Re:Yahoo Triples Estimate of Breached Accounts to 3B by tambienben on Tuesday October 03, 2017 @08:58PM (#15397537)
Most sites solve this problem with a combination of 2fA and at least one security question.

Having my phone number isn't even good 2fA.

[ Parent | on HN ]