Who is right? Is there a consensus in the security community?
[1] https://medium.com/@N/how-i-lost-my-50-000-twitter-username-...
> Who is right? Is there a consensus in the security community?
There might not be one best answer. There have been many other stories on HN of people loosing access to their Gmail accounts, and having no recourse with Google to regain access.
My gut feel is the best any of us can do is to set up our digital lives so that our accounts are "misaligned" to make it more difficult to use social engineering to pivot between them. For instance, in the story you linked, they key to an actual attack was a shared credit card number between Paypal and Godaddy that was used for verification. Ignoring the fact of how stupid it is to use just 4 digits for such a task, it would have made that path more difficult for the attacker if he'd used a dedicated card for Godaddy (given his domains were valuable enough to him that they could be used to extort a $50k twitter handle from him). Having different, secret, email addresses/domains attached to important accounts could also provide a stumbling block.
But it's also worth noting that much of the attacker's planned attack failed, and he only succeeded in the end through extortion.