21–30 of 528 posts
Why did they give it any of that?!
Support requests have always been the weakest link in the security chain for big corps. I've had accounts of mine turned over with 2FA disabled by humans before. I guess we shouldn't be surprised that the LLMs are doing the same thing. The simple fact that 2FA can be removed by low level support staff drives me mad. It defeats the whole purpose of the process.
recovery is always the weakest link in any authentication system
Earlier quoted context omitted.
recovery is always the weakest link in any authentication system
It's a tough problem, because people forget passwords, change phones, lose access to 2FA devices, but still need to use their accounts.
https://pages.nist.gov/800-63-4/
I think Meta just does not care if they're enabling AI attack surface and vulnerabilities into these customer journeys. It's...certainly a choice, versus deterministic journeys with hard guardrails. They could make different choices.
It's insane the AI has been provided the tooling to send emails to arbitrary addresses like that. Like, getting it to send a 2FA code at a user's request is one thing. But it should only be able to "hit a button" to send a 2FA email to the address attached to the account, all run with hand-written code. It shouldn't have access to the 2FA code itself, or the message subject, or body, or the recipient address, etc. Wh…
Earlier quoted context omitted.
It's a tough problem, because people forget passwords, change phones, lose access to 2FA devices, but still need to use their accounts.
I manage customer identity and access management ("CIAM") for a financial services firm. Passkeys are primary, recovery can be performed by providing a government credential remotely (which costs us ~$2-3 per recovery). I do not think it is hard, based on what we have built and spent to enable these capabilities. NIST Special Publication NIST SP 800-63 Digital Identity Guidelines is a helpful resource on this topic.…
Always a bit illuminating to me how many exploits seem to so dumb I'd never even bother to attempt them. You're telling me I can just...ask for the password? And that works?
We really need similar rules to other engineering disciplines. If your building falls with people inside, you killed them.
Earlier quoted context omitted.
recovery is always the weakest link in any authentication system
fair enough, but what's the actual point of 2FA if it's so easy to override?