this post was submitted on 14 Feb 2024
228 points (88.8% liked)
Technology
59135 readers
6622 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I get what you're saying, but it's not about getting locked out. It's about other people using recovery methods to take over your account. Why would anyone try to break through durable public-key encryption when you can just phish a victim's email account password?
And it's not like real-time phishing for 2FA/MFA isn't widespread—it's just not automated to the same level as other methods. That said, two- or multi-factor is going to stop 99% of automated hacks. It's the determined ones that I'm concerned about.
In regards to the Apple thing... Apple passwords can be reset using a recovery email. That means the security of the account leaves Apple's ecosystem and relies on the email provider. So, if I'm a cybercriminal determined to hack your account, I start there.
Then, if you've got your keychain all set up, it's time for a SIM swap. I clone your SIM or convince your mobile carrier to give me a SIM with your number. And even if recovery contacts and keys are alternatives, the use of SMS is problematic. If you really can turn it off, then I'm all for it. But if you can't be sure, neither can I.
SMS is a very low-security option that is showing its age. It was never intended to be a secure verification method, yet it's become incredibly popular due to its availability. Unfortuantely, telecom companies are simply not interested in upping their security.
All SIM swap protection is opt-in at this point. Verizon and the gang might wise up considering the lawsuits leveled at them by victims—many of whom lost millions in cryptocurrency due to the carriers' negligence—but it's not likely.
The point here isn't that passkeys are bad for consumers. They're convenient and about as secure as existing methods. The problem is that they're being sold on average folks as a security upgrade even though they're more of a sidegrade. PKI/FIDO already existed before the whole passkeys buzz did, and it had the same limitations. This is mostly just branding and implementation.
If you enable advanced data protection apple cannot recover your account. You need your recovery keys or a designated recovery contact.
The apple doc implies (to me) that a SIM swap only works after you authenticate on an apple device (e.g. using your password) even without advanced data protection. I have never tested that.
You can use the long process (many days) to recover an account assuming you haven’t enabled advanced data protection. I’m okay with that as it is perfect for my grandparents (I had an older relative who got their account back through this method).
I get that you could SIM swap to recover other accounts (not Apple) if they have SMS as a recovery method. That sucks and it really sucks for people who don’t get that an email or SMS recovery can be a giant hole in security.
Gotcha, point taken. Ultimately, I think there needs to be a better identity proofing process overall. But that may rely on a total infrastructure overhaul, which seems unlikely.