News for hackers. Stuff that matters.

A comment on The FastMail Security Mindset. Parent comment

Re:The FastMail Security Mindset by ilikepi on Tuesday December 05, 2017 @03:50PM (#15855799)
Just curious...was this incident before or after they re-architected their authentication system? I believe that was done last July[1]. The new system is really nice, now implementing separate app-specific passwords as well as new emergency recovery mechanisms. I wonder if they updated their internal support policies with respect to assisted account recovery when they implemented the new system...seems like they should have made the bar higher...

[1]: https://blog.fastmail.com/2016/07/25/two-step-verification-a...

[ Parent | on HN ]
Re:The FastMail Security Mindset by ghouse on Tuesday December 05, 2017 @03:56PM (#15855869)
The incident was late July, 2016, but before the date on that blog post.
[ Parent | on HN ]
Re:The FastMail Security Mindset by ilikepi on Tuesday December 05, 2017 @04:11PM (#15856033)
I don't actually recall when the new system went live for all users, but the old system was live simultaneously for at least a couple months to ease the transition. I wonder if customer support actually lowered the bar during the transition because of a perceived or actual increase in customers locking themselves out.
[ Parent | on HN ]