I actually had a similar issue recently where I forgot my PayPal password and I didn't know the answers to my security questions. PayPal then sent me a pin through snail mail to the address they had on file. IMO, this bit of inconvenience is worth the added security.
It's called "human error". And it happens. A lot. I don't know how much training Apple provides to it's customer service reps (does Apple even run their own CS or is it farmed out?); but nothing can prevent "human error".
Re:The weakest link by far is Apple
by prof_hobart on Tuesday August 07, 2012 @05:11PM
(#4352323)
Nothing can prevent human error. But systems can be set up in such a way that limits the risk of that human error causing failure. If the agent has to actually enter the answers before being able to issue a temporary password, then (assuming the author is correct) this particular problem wouldn't have happened.
"Human error" doesn't explain continuing the process after failing the security questions, unless by human error you mean merely that "someone did it."
Re:The weakest link by far is Apple
by jasonlingx on Tuesday August 07, 2012 @09:51PM
(#4353455)
It's not human error. Their policy allowed for password resets given these 2 bits of information. Wired retried it and verified that it was indeed the case.
There's this joke about hiring the cheapest security guard to watch over your most prized possession. I'm not only talking about the wages being paid to the Apple CSR, but also of their technical ability to know the value of the data they possess.
Sure, if I was a facebook db admin I'd be semantically satiated with the data, but that doesn't mean it isn't important.
You're right, but that is essentially Marco's point. My view is that Amazon did the same thing (let hackers add an email account, to which it sent the password reset), and required slightly less information to do so.
From Honan's post:
"In response, Apple issued a temporary password. It did this despite the caller’s inability to answer security questions I had set up. And it did this after the hacker supplied only two pieces of information that anyone with an internet connection and a phone can discover."
Sounds like Apple support needs some lessons on social engineering prevention.