I would expect your IP to not change as drastically as some VPN IP being your only evidence that you're you.

You mean

  admin

  Administrator

Horrific, people should be jailed for cyberattacks when they carelessly just give out this word.

The experiences I meant were mostly

- password reset requests (admittedly, we had a protocol even then to strictly require a "physical signature", normally meaning Fax or internal snail mail)

- medical protocols: don't wanna go into too much detail here, but:

1) Windows requires a lot of maintenance, often even hard restores, to function normally, even when sold as the UI for physical ICU monitors

2) Medical personell often is severely overworked, especially people in important, but not formally highly-qualified roles. And things like Surgery rooms and ICUs often have very slim time slots.

With the former, you should not enter into them without wearing appropriate clothing.

It doesn't prevent people working there from requesting you to finally come over and make that UEFI-Windows-Crapware-Kiosk-PC which was sold as a medical device boot... of course especially not when there is an ongoing surgery nearby. And of course, your higher-ups will be there to help you sort out these issues without violating protocols...

thankfully I didn't do careless things there and haven't witnessed IT-related disasters there. But still, I gave these examples for a reason :D

there was a healthy culture but some of the situations encountered in medical IT support should really require specialized, short-term training.

Keeping up rigorous hygiene protocols requires dedicated work by professionals, especially in a large hospital.

And the same argument can be made for account protection and user support for large software providers.

> your bank could shut phishers down cold by requiring wire transfers to be authorized in person but they don’t want to pay staff or risk you being upset by a transaction taking an extra hour so they don’t.

Isn't this essentially what just recently happened to the Pope? Then there were people here doing the rest of your comment for him saying how egregious it was for them to ask for an in person authorization. It sounded like all he was trying to do was update his address, but changing your address from one in Chicago to one in a European country absolutely sounds like something a phisher would be trying to do.

for a while facebook had the ability to recover your account by having them ask several of your friends if the recovery was legitimate but it was turned off. my guess is that not enough people added trusted contacts to bother running it.

https://www.theverge.com/2013/5/2/4292744/facebook-trusted-c...

The amount of hassle involved with regular physical checks is why it's not implemented, regardless of attack prevention.

The cost of hiring a person is part of it but not really the core reason. People were sold on the Internet with "you can do things online conveniently" and reintroducing the need to physically go somewhere negates that angle entirely.

Then you get trusted parties selling account access. Even if you remove them for a single false positive they will do it. A bit like a % packages "vanishing".

The least terrible seem digital id.

It's worse than "forgetting." Having seen older folks just set up new accounts for a move, they make zero attempt to even try to keep them! Oh, the phone company needs a login/pass? Just type in anything, don't write it down. If something goes wrong, they're going to call in anyway, not use the website.

I had to go through the account recovery on my Facebook account once and the proof they demanded was that I match a bunch of pictures of friends to their names. I think it took 3 tries over multiple days to actually get it unlocked because it turns out I such really remember a lot of the people I met 20 years ago and friended on Facebook.

I don’t recall why I had to go through this song and dance. Very plausibly the account was still associated with an old school address that I could no longer access. So yeah, account recovery is hard. How do you prove someone owns an account when they’ve lost the things they are supposed to use to prove ownership?

I manage customer identity and access management ("CIAM") for a financial services firm. Passkeys are primary, recovery can be performed by providing a government credential remotely (which costs us ~$2-3 per recovery). I do not think it is hard, based on what we have built and spent to enable these capabilities. NIST Special Publication NIST SP 800-63 Digital Identity Guidelines is a helpful resource on this topic.

https://pages.nist.gov/800-63-4/

I think Meta just does not care if they're enabling AI attack surface and vulnerabilities into these customer journeys. It's...certainly a choice, versus deterministic journeys with hard guardrails. They could make different choices.

Simple, you don't. This is all going to seem quaint in a few years when old accounts started getting deleted for inactivity.

the alternative is people losing their accounts and people aren't willing to allow that. i do think that apple does this a little better where they try everything to contact you in every way they know and it takes a week to get access. at a minimum to change your email it should require a week of waiting to see if the user can access the original mail to the hand off.

In some cases, checkbox-compliance with customer requirements.

Completely unrealistic. Stuff happens. Email accounts get closed for no reason. People lose their phones, or have them stolen. Lots of reasons why someone might need an exceptional account recovery process.

Not saying it should be easy or routine, it should not be. But it must be possible.