Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: If I get locked out of everything, please try to help me

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 350 posts

Re: Ask HN: If I get locked out of everything, please try to help me

#71

Post by [deleted] »

Gigachad wrote: post #15
crooked-v wrote: post #13

Earlier quoted context omitted.

The solution to that is to make the increasingly intrusive security processes an opt in, not to completely write off anyone who can't reliably keep a particular physical device on their person and working indefinitely.

It used to be opt in until the icloud hacking saga where the public demanded something be done. So it was decided users want mandatory security by default. Almost all of these services provide backup codes you can write down on paper as well. Sure, some people are going to lose their only device and the bit of paper, but at that point if you have literally nothing to identify yourself with, it's going to be hard to p…

[deleted]

Re: Ask HN: If I get locked out of everything, please try to help me

#72

Post by [deleted] »

valenterry wrote: post #70
jrmg wrote: post #50

I have long wondered if two factor authentication actually causes more economic harm than it solves - it just doesn’t cause that harm to be noticeably all in one place (the harm is spread to millions of users who will lose access at some point during their lives rather than concentrated on the company that implements TFA dealing with fraud). It feels like it might. This isn’t counting the productivity that’s lost to…

In the current state, I believe it indeed causes more economic and personal harm. Properly executed MFA by both the provider and the user are great, but we have a long way to get there.

[deleted]

Re: Ask HN: If I get locked out of everything, please try to help me

#73

Post by marcus_holmes »

Gigachad wrote: post #8
crooked-v wrote: post #6

There was a post a while back around poor and homeless people encountering exactly this problem on a regular basis. Lots of people in the comments were incredibly dismissive and sometimes actively malign about it. Edit: One suggestion from me would be to try and start the dead phone connected to power but with the battery physically removed (assuming it's removable). That might bypass whatever issue it's having and l…

Problem is that support people mistakenly resetting account auth when the attacker calls up and social engineers them is a bigger and more common issue than people’s only device dying. Not to say that’s not a thing that happens, but it’s a smaller of the two problems.

Tying someone's identity to their phone number is not the answer, though.

I have this at the moment - I'm travelling, moving country every few weeks, so I need a new SIM card and phone number every few weeks. My phone number is temporary at best.

I'd massively prefer to take the risk of my identity being stolen than constantly fighting security measures that assume people never change their phone number (or country of residence, etc).

Re: Ask HN: If I get locked out of everything, please try to help me

#74

Post by [deleted] »

actionfromafar wrote: post #33
DoreenMichele wrote: post #25

Earlier quoted context omitted.

I'm in a small town. I have no car. I no longer drive. I don't see well enough. I work from home due to my medical situation. I have no friends locally who can drive me someplace. Etc etc etc. This is a non-starter for me. I need Google to fix this. I can't do anything about the busted phone at this point.

On HN you might get access to someone at Google, or someone from here might drive TO you. Any takers? I’m on the wrong continent.

[deleted]

Re: Ask HN: If I get locked out of everything, please try to help me

#75

Post by zavertnik »

If you're in LA and need a computer to use or an environment with wifi and power and what not to trouble shoot this, you're welcome to use my apartment. I have a spare ATT phone if you need something to act as a intermediate device (if your son wants their phone back :p).

If I worked in tech I'd offer you access to a solution but this is all I've got. I hope this problem doesn't last long for you.

Re: Ask HN: If I get locked out of everything, please try to help me

#78

Post by modeless »

A lot of people treat printable recovery codes as something that should be protected, locked in a safe, etc. As a result they don't bother to use them as it seems like too much effort to secure them.

Please do not treat them this way. They do not grant access to your account. Print many copies of your recovery codes and spread them around. Wallet, home, car, parents' house, etc. It doesn't matter if they get stolen or whatever, again they don't grant access to your account, and they can be revoked at any time.

I know that educating people about this is not a scalable solution to the problem of people getting locked out of their accounts. But maybe it could help you, reader of this comment, if you someday need recovery codes.

Re: Ask HN: If I get locked out of everything, please try to help me

#79

Post by toomuchtodo »

valenterry wrote: post #70
jrmg wrote: post #50

I have long wondered if two factor authentication actually causes more economic harm than it solves - it just doesn’t cause that harm to be noticeably all in one place (the harm is spread to millions of users who will lose access at some point during their lives rather than concentrated on the company that implements TFA dealing with fraud). It feels like it might. This isn’t counting the productivity that’s lost to…

In the current state, I believe it indeed causes more economic and personal harm. Properly executed MFA by both the provider and the user are great, but we have a long way to get there.

The recovery user flow, at the end of the day, should provide an option for identity proofing through a service that can consume a government provided identity credential. Login.gov, Stripe Identity, ID.me, whatever, something that can attest that you are you when provided a sanctioned credential.

You should be given the option to opt out of this, have your data E2E encrypted, and if you lose your creds your data loss is on you. But for everyone else, they can then provide ID and get their digital identity and data back (at a very low cost to the service provider, proofing is usually $1-2/request in bulk; if you want to charge the user that cost, that’s palatable).

(corp|customer identity governance and proofing is a component of my work at a fintech)

https://media.fidoalliance.org/wp-content/uploads/2019/02/FI... ("Recommended Account Recovery Practices for FIDO Relying Parties", Page 3)

https://doi.org/10.6028/NIST.SP.800-63a NIST SP 800-63A Enrollment and Identity Proofing

Re: Ask HN: If I get locked out of everything, please try to help me

#80

Post by walrus01 »

crooked-v wrote: post #6

There was a post a while back around poor and homeless people encountering exactly this problem on a regular basis. Lots of people in the comments were incredibly dismissive and sometimes actively malign about it. Edit: One suggestion from me would be to try and start the dead phone connected to power but with the battery physically removed (assuming it's removable). That might bypass whatever issue it's having and l…

I think a part of the problem is that the US doesn't have a vast and widespread ecosystem of cheap, relatively simple, slightly rugged android phones like a developing nation market does.

Go look at what you can buy for an Android phone if you exchange 100 USD to rupees in Rawalpindi Pakistan for instance.

Now imagine you drop your phone or screw up its hardware somehow and want to get it repaired, you can probably fix it at a local repair shop (some 1-man operation in a tiny retail stall) for $20-30 max with basic hand tools. Those guys might have a collection of pieces of the same model phone you have, or the ability to take 4 dead phones and mix/match pieces to make 2 working ones out of them and then re-sell them, etc.

Post reply on HN