321–330 of 528 posts
I'm among the first 6000 users of Instagram and my first name username was stolen a few years ago. Support for verified accounts acknowledged the issue, but couldn't do anything about it. This turn was an AI exploit, in my case was an outsourcing support 'exploit', where someone paid for my username to be manually changed and given to another user. There will always be a way to get access to accounts if human account…
Earlier quoted context omitted.
This is not true. Well, it kinda is, but nobody will be stupid enough to hand-code an account recovery where you get to type any email address. The reason it worked there is that the designers of the system didn't anticipate that the AI will agree to accept any email (maybe they even put guardrails against it in the system prompt, we don't know). It's more like social engineering than bad-security-code, except that l…
"nobody will be stupid enough to hand-code an account recovery where you get to type any email address." I can think of several pre-2000s chat rooms that did EXACTLY this. It is how I lost several chat accounts as a teenager.
Earlier quoted context omitted.
Clickwrap terms of service are worth the paper they're printed on. You may still be able to sue.
At which point you are going to be competing in court with a company that has a current market capitalization of $1.6 trillion dollars.
Then you will be competing in an American Arbitration Asssociation's 'Alternative Dispute Resolution', which is even less favorable for the consumer :D
Earlier quoted context omitted.
A flow can either fail safe or fail secure. Fail secure: if you lose your email, your account is forever locked. Fail safe: if you lose your email, your account is not forever locked. But, someone else might be able to get your account by pretending you lost your email. There are no other choices. When the electronic door controller loses power, either the door stays locked, or the door stays unlocked. In case of a f…
There are no other online choices. If my Bank login goes totally Kaput, though, I can take my ID down to the Branch to get it sorted. Same with my telecom provider. I try to only depend on services which have this property. I don't succeed.
Earlier quoted context omitted.
Sounds great until you have an aging parent with a problem who can't get there. Get a power of attorney you say.. great but they won't accept unless parent comes to the branch. This comes back to haunt you in the future.
On the other hand, the best anti-scam feature for older relatives is to tell them to "go there in person". Get a call from the bank, they simply tell them "ok, I'm coming to the bank tomorrow, in person", and they're done. Scam call? Legit call? Doesn't matter, they'll sort it out at the bank. There's a whole wide age and knowledge/competence where older people can still fall for scams (or can't know if it's legit or…
Every time someone calls to say there's a problem with your account, you ask for their name and/or extension number, because recontacting through the institution is your only good way of verifying their identity.
Earlier quoted context omitted.
> your bank could shut phishers down cold by requiring wire transfers to be authorized in person but they don’t want to pay staff or risk you being upset by a transaction taking an extra hour so they don’t. Isn't this essentially what just recently happened to the Pope? Then there were people here doing the rest of your comment for him saying how egregious it was for them to ask for an in person authorization. It sou…
Its perfectly acceptable for a security model to make things difficult for extreme edge cases like the pope. After all if the situation warrants it such rare events can always be escalated.
I expect his Holiness might agree.
Support requests have always been the weakest link in the security chain for big corps. I've had accounts of mine turned over with 2FA disabled by humans before. I guess we shouldn't be surprised that the LLMs are doing the same thing. The simple fact that 2FA can be removed by low level support staff drives me mad. It defeats the whole purpose of the process.
We needed to delete a storage volume to urgently free up space, and apparently this was locked in a way the storage vendor was required to act as a "second key" to ours to make the destructive action. We had never properly set this up, and I never had even logged into my "support" account with them before. They required two authorized contacts on our end for them to confirm the action.
The process was effectively my colleague handling the sev1 incident asking me to join their Zoom call. They asked for my 2FA and I said I never had one configured and obviously did not receive it since my e-mail was not setup with them. The (obviously outsourced) support rep decided just pasting the code into Zoom chat and then having me read it back to them was Good Enough(tm) and the process continued.
I was a little too surprised at this at the time to think about it too much. But the fact they could see the expected generated code, and type it in themselves into their system was at least interesting to me. Not quite sure how I feel about it, since this did indeed save us from a sev1 going sev0 - but overall it's obviously quite vulnerable to both social engineering and insider attack.
It's certainly a difficult tradeoff. Not sure I would hand that sort of "override" capability to someone who was was clearly a Tier 1 or 2 support rep - I'd probably bury it (but in a different manner) somewhere that required escalation to a higher authority but still could be done in timely (minutes, not hours) manner. Who knows though, as organizations scale this gets harder and harder.
Meta somehow determined the two accounts are the same person.
Earlier quoted context omitted.
You said it, instagram is not life-critical
Someone being able to take over your account, read your DMs, and impersonate you is pretty serious. Should be treated as a data breach with serious penalties.
Other engineering disciplines have different rules, because for example a bridge or building with a fault might cause the loss of life of hunderds of people.
Support requests have always been the weakest link in the security chain for big corps. I've had accounts of mine turned over with 2FA disabled by humans before. I guess we shouldn't be surprised that the LLMs are doing the same thing. The simple fact that 2FA can be removed by low level support staff drives me mad. It defeats the whole purpose of the process.
I highly advise that you download and backup any of your personal data on all your social media accounts for yourself and your loved ones. These large companies do not care about you beyond showing you ads for dropped shipped garbage from China and AI slop tiktoks.