Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t...
by someguydave on Friday August 20, 2021 @06:27PM
(#28252103)
Still sounds like a significant barrier to most phishing attacks.
[ Parent
| on HN ]
Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t...
by cinntaile on Friday August 20, 2021 @07:13PM
(#28252431)
A little bit. It's mostly a time delay, since the alternatives to verify your identity seem to be a different emailaddress or a phone number and then you're back to square one imo. The phone number is still susceptible to social engineering and the alternative mail likely is too. Ideally I want something where keys gone = account gone. Now a dedicated scammer could still succeed and it sure doesn't provide any real safety for political groups which Google kind of claims it does by using testimonies from politically vulnerable people to "advertise" the Advanced Protection Program. This is a tricky situation though since your adversaries could get your keys and your password and then they control your account without any chance of getting it back, so it's definitely a double edged sword.
Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t...
by Marsymars on Friday August 20, 2021 @09:00PM
(#28253117)
> It's mostly a time delay, since the alternatives to verify your identity seem to be a different emailaddress or a phone number and then you're back to square one imo. The phone number is still susceptible to social engineering and the alternative mail likely is too. Ideally I want something where keys gone = account gone.
I can think of options less extreme than keys gone = account gone that are still very secure.
e.g. To enable "Extra Advanced Protection" you have to visit Google HQ in your region, where your DNA is sampled. If you ever need to recover your account, you have to visit Google HQ again for another DNA sample, after which you're provided with account access, in person.
Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t...
by cinntaile on Saturday August 21, 2021 @05:47AM
(#28255618)
Definitely also a good, but still very extreme option. This might actually be more secure, depending on the threats you have to take into account. It would be possible to retrieve the account after a (physical) hack.
Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t...
by someguydave on Saturday August 21, 2021 @10:05AM
(#28257109)
Just showing up in person by itself (with a stored photograph and maybe audio recording) is a pretty high barrier.
Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t...
by darkwater on Saturday August 21, 2021 @05:41AM
(#28255596)
> DNA sample
and who's gonna pay for that? Seems pricey and doesn't scale exactly well.
Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t...
by someguydave on Saturday August 21, 2021 @10:06AM
(#28257115)
I presume in this scenario you would have multiple keys and multiple backup accounts, so fallback to a likewise secured account is reasonable.