News for hackers. Stuff that matters.

A comment on Google announces passwordless by default: Make the switch to passkeys. Parent comment

Re:Google announces passwordless by default: Make the switch... by kube-system on Tuesday October 10, 2023 @11:38AM (#37833510)
Other businesses have humans on staff which will verify your identity documents. Google simply chooses not to do this, because it is expensive, and their "users" are not their customers.
[ Parent | on HN ]
Re:Google announces passwordless by default: Make the switch... by threatofrain on Tuesday October 10, 2023 @11:46AM (#37833648)
Right, then you can just pay for Google's rather affordable non-free business version. Then you'll get reasonable support, well-reputed support.
[ Parent | on HN ]
Re:Google announces passwordless by default: Make the switch... by cube00 on Wednesday October 11, 2023 @03:29AM (#37841873)
I get a call from Google One Support. I explain the situation. They tell me to go to g.co/recover to recover my account (I already did this on my own). Same thing happens as before - same two options are given.

Then I'm told Google has a very strict security policy, and accounts cannot be changed in any way by support. So going through the recovery process is the ONLY way back into my account. So the call ends with them saying "I'm so sorry I can't help you." [1]

[1]: https://www.linkedin.com/pulse/when-you-get-locked-out-your-...

[ Parent | on HN ]
Re:Google announces passwordless by default: Make the switch... by px43 on Tuesday October 10, 2023 @11:47AM (#37833667)
They have offered this since 2017, in response to the Podesta email hack. It's free, but it's not the default, because traveling to a Google site is prohibitively expensive for the vast majority of their users.

https://landing.google.com/advancedprotection

[ Parent | on HN ]
Re:Google announces passwordless by default: Make the switch... by kube-system on Tuesday October 10, 2023 @12:04PM (#37833937)
Is there something there that explains how the recovery process is different? The only thing I see in the FAQ is somewhere that they link to the normal account recovery page, and say that you'd have to order another hardware token.
[ Parent | on HN ]
Re:Google announces passwordless by default: Make the switch... by lxgr on Tuesday October 10, 2023 @03:53PM (#37836641)
That is not without risk either:

Many more people have a copy of my passport than have access to my Yubikey or recovery phone number.

[ Parent | on HN ]
Re:Google announces passwordless by default: Make the switch... by kube-system on Tuesday October 10, 2023 @07:45PM (#37839225)
Yes, remotely accepting a copy of an identity document from the other end of a wire is not a good authentication method. That's because they're not intended for remote digital authentication. Photo IDs are intended to be validated in-person, using the original document, and the photo visually compared to the person holding it.
[ Parent | on HN ]