Earlier quoted context omitted.
Whoa, wait, what? What occured was a simple confidence hack, not some industrial spy escapade. Anyway, to answer your initial point, two factor authentication helps with this problem, as you have to still have the security token to authenticate. And if the "Something you have" gets stolen, then you need a manager to work through it to get you set up again, and all resets are heavily monitored and audited.
My point wasn't that this particular incident was some great case of industrial espionage. But it's a rather easy slippery slope to that outcome. But what if your website is secured behind an Amazon EC2 or Linode CSR? Isn't Instagram and Netflix run at least in part on EC2? I have no clue what the security schemes are for either of those service providers, but if they allow CSRs to change passwords, then it's the sam…
Re: Apple Support Allowed Hacker Access to Reporter's iCloud Account
#181Yea, that's all protected by multifactor authentication. Front line CSR's don't need a raise over this. Maybe they have other reasons, sure. But not this.