Comment by treesknees | Hacker News Reader

Comment by treesknees | Hacker News Reader

During the start of the pandemic/lockdown in the US, my 90 year old grandfather was locked out of his Facebook account. He doesn't post or add friends, literally only uses it to play slot and casino games. Turns out his password was compromised and someone had gotten in and changed the name/profile and had been spamming and scamming people on FB marketplace. He hadn't noticed because he never went onto a regular FB page, he only clicked into it from offer emails from his games.

It was tough because at the time I couldn't go to help him in person. And even when I finally could, it took months of waiting and even contacting an old college roommate at FB to help get it unlocked. It was probably 8 or 10 months later that he finally received an email and could go reset his password.

I really wish these multi-billion dollar companies would at least staff a helpdesk to field these basic issues. When these "free" services lock you out, you're basically left with yelling at what feels like a wall trying to get help.

A big factor for not doing that (besides the cost of employing a helpdesk for every language that Facebook is used in) is that the helpdesk just becomes another vector for malicious account takeover. If you put it there, you're going to have sob stories about people who made their account years ago but don't have the old password, don't have access to the email, don't remember what they posted, and yet will cry, expecting the human on the other end to give their their FB account back - and if they can do that, so can a malicious actor trying to get into random peoples' accounts to scam then on Marketplace[0] or what have you.

0: https://news.ycombinator.com/item?id=28918834

I understand the business factors that require initial account creation to be frictionless, and so why proof of identity must be weak, but why can't account recovery offer an option where you prove your identity indisputably?

For example, some sort of physical storefront (possibly run by an independent company), where you go and say I am so-and-so and here's my ID and please take my picture and my fingerprints so that if I'm scamming I'll be easy to catch and here's twenty bucks for your trouble.

I'd rather do that then spend weeks or months locked out, uncertain, and talking to a wall.

Privacy advocates won't be happy, but Facebook, Google, etc. don't have the same motivations as privacy advocates.

That is essentially what mobile phone carriers do, yet "customers" provide fake/stolen IDs all the time to perform sim-swap attacks and obtain financed phones they never plan to make a payment on.

Germany has a suitable system built on an NFC chip in the federal ID (Personalausweis). When you get it (renewed), you get a transport pin, which you can use to set a regular usage pin, which you can then use to auth yourself to the NFC chip and make it provide some signed information to the remote end.

Also, they are not particularly easy to fake to a degree that passes spot checks, anyways.

Facebook does sometimes ask for a scan of government ID in the account recovery flow. Unfortunately the cost of operating the ~100,000 storefronts required to be nearby a significant fraction of its users would be absurd compared to the benefits.

That is a good argument. But what is with not having a way to put recovery email/phone back to what it was, literally minutes after it was changed by a new login in another state.

Somewhat tangential, but I, and my elderly relatives on the other side of the country and Atlantic, would love for me to have the same level of optional supervision for their accounts that I automatically have for accounts associated with my child.

Many years ago I read a Bruce Schneier blog post that posited that most computer users would prefer to have their computers strictly managed by a benevolent agent. I’ve always agreed.

When these "free" services lock you out

They may be "free" to use, but Facebook is making real money off of every account, certainly enough to fund human help for critical issues like this.

At this point, it's by design. They'll claim the opacity is needed "to prevent malicious actors from probing the system and finding the process's weaknesses", whereas my opinion is that they do this to remind people "who's in charge".

Reply on news.ycombinator.com