This is not wrong but what’s really missing is cost: Meta did this so they can avoid paying people to do it. Lots of companies follow that decay spiral: your bank could shut phishers down cold by requiring wire transfers to be authorized in person but they don’t want to pay staff or risk you being upset by a transaction taking an extra hour so they don’t.

Imagine an alternate universe where big tech companies worked with various trustworthy third-parties where something like this would generate a challenge you could take to your local notary, post office, library, police station, etc. where someone would check ID before approving it. How many phishing attacks would be prevented annually by a physical presence check?

▲

dylan604 4 hours ago | parent | next [-]

> your bank could shut phishers down cold by requiring wire transfers to be authorized in person but they don’t want to pay staff or risk you being upset by a transaction taking an extra hour so they don’t.

Isn't this essentially what just recently happened to the Pope? Then there were people here doing the rest of your comment for him saying how egregious it was for them to ask for an in person authorization. It sounded like all he was trying to do was update his address, but changing your address from one in Chicago to one in a European country absolutely sounds like something a phisher would be trying to do.

	▲	throwaway85825 4 hours ago \| parent [-]
		Its perfectly acceptable for a security model to make things difficult for extreme edge cases like the pope. After all if the situation warrants it such rare events can always be escalated.

▲

spullara 4 hours ago | parent | prev | next [-]

for a while facebook had the ability to recover your account by having them ask several of your friends if the recovery was legitimate but it was turned off. my guess is that not enough people added trusted contacts to bother running it.

https://www.theverge.com/2013/5/2/4292744/facebook-trusted-c...

▲

parable 4 hours ago | parent [-]

I actually quite like this solution. Beats asking users to add a "recovery selfie" (something Meta actually does now) - I'd rather choose 3 of my friends and have them approve some notification in-app. Seems like better UX and preserves privacy a slight bit more, but we all know Meta's not in the privacy business.

	▲	spullara 29 minutes ago \| parent [-]
		honestly I can't think of a better solution that would require a far more coordinated attack to pull off. it should work on any system where trusted folks are likely to have accounts.

▲

3 hours ago | parent | prev | next [-]

[deleted]

▲

ronsor 5 hours ago | parent | prev | next [-]

The amount of hassle involved with regular physical checks is why it's not implemented, regardless of attack prevention.

The cost of hiring a person is part of it but not really the core reason. People were sold on the Internet with "you can do things online conveniently" and reintroducing the need to physically go somewhere negates that angle entirely.

	▲	acdha 2 hours ago \| parent \| next [-]
		To be clear, I was thinking cost as more than just payroll - e.g. my bank can do this because they have paid for a branch near my house, Facebook does not - but another way to look at it is that many of the costs due to errors have been shifted to the user. I do think friction causes a reflexive resistance to the idea but I think that might be an overreaction. This is a rare thing people should be doing no more than a few times in their life.
	▲	anonymars 4 hours ago \| parent \| prev [-]
		> People were sold on the Internet with "you can do things online conveniently" and reintroducing the need to physically go somewhere negates that angle entirely But how often does one need to do recovery procedures like this? How much less convenient is it for everyone else to be at risk of their account being taken over?

▲

econ 4 hours ago | parent | prev [-]

Then you get trusted parties selling account access. Even if you remove them for a single false positive they will do it. A bit like a % packages "vanishing".

The least terrible seem digital id.

	▲	acdha 2 hours ago \| parent [-]
		> Then you get trusted parties selling account access How many bank tellers or USPS employees do that, though? It’s possible but quite rare because people know they’ll be running a big risk of being caught and no individual transaction is worth that much.