Tell HN: It is impossible to disable Google 2FA using backup codes

Re:Tell HN: It is impossible to disable Google 2FA using bac... by Nextgrid on Thursday January 19, 2023 @02:07PM (#34444226)

> Allowing customer service to bypass customer auth requirements is just weakening your system

I disagree, in regulated industries such as banking this is a solved problem. A combination of onshore staff, good career prospects, pay and working conditions and audit logs means I haven't heard stories of bank insiders breaching into accounts to steal. I'm sure it happened but nowhere near as frequently as fraudulent SIM swaps for example.

TLDR: don't outsource your customer service to the third world and you're already 80% of the way there.

[ Parent | on HN ]

Re:Tell HN: It is impossible to disable Google 2FA using bac... by londons_explore on Friday January 20, 2023 @05:19AM (#34451042)

I suspect that the level and sophistication of attacks on the banking sector is far lower than equivalent attacks for data/accounts.

In general, if you break into someones bank account and transfer money out, that money can be traced by authorities. In almost all cases, that money is recoverable by the government, even if individual banks like to shrug and tell the customer it isn't recoverable.

If you break into someone's email and steal their private info, it can't be traced. That makes the latter much more attractive.

[ Parent | on HN ]