Hacker News Reader

Comment by ramm110 | Hacker News Reader

I had a similar thing happen with my Battle.net account. I forgot to transfer over my authenticator backup code when I switched password managers last time. I had to send them a photo of my driver's license next to my face and another one of it next to a physical newspaper with the date on it. This seems like a much better process for recovering accounts that matter.

View on HN

So what do you think happened to those photos?

Some people would be happy to pay for a leaked copy of those photos, for use with any other company that would accept only the "face/license" photo as sufficient proof.

I think having a recent date on the newspaper prevents reuse of the images. I'm not a Photoshop expert, so maybe that's trivial to change. When I look at my support ticket history on the website, the ticket attachments are gone, so hopefully they're shredded after the support person views them.

The way I fix this is to save the images that you get for 2FA and store them offline in a password manager like KeyPass.

This seems very easy to bypass.

Very easy? I'd say "possible" at best. And now you've got access to a battle.net account. Took a heck of a lot more work than asking someone for username/pass in a live chat, and what you gained access to is worth a heck of a lot less. Plus Blizzard actually does keep backups and records and will be able to fix the situation for the account owner.

I'd be surprised if ever a Blizzard account was compromised by someone sending in a false picture.

>Very easy? I'd say "possible" at best.

I think you are a little confused here. There's no way for Blizzard to authenticate those pictures, you can take literally anyones passport and just swap the name on it.

> Took a heck of a lot more work than asking someone for username/pass in a live chat

This might be true in a world without photoshop, but that's not the world we live in.

>I'd be surprised if ever a Blizzard account was compromised by someone sending in a false picture.

In my personal experience, they'll very rarely insist upon receiving those photos. My battle.net account isn't even under a real name and despite that I've had the authenticator added and removed several times.

It seems like a general principle that the less important something is, the better the security probably is. Steam, for example, is really paranoid, constantly asking for verification whenever it thinks I'm logging in from a new computer, bugging me nonstop to set up 2FA, e-mailing me with alerts, etc. Meanwhile my bank does straightforward username/password authentication, with the bonus that the password is case insensitive and silently truncated to eight characters.

It's not that Steam is paranoid for no reason. People keep virtual items on their accounts which attackers can sell for real money, potentially yielding hundreds to thousands of dollars from one account, and so attempted Steam account hacking is rampant. Of course, that's nothing compared to the amounts stored in bank accounts...

Not to mention an account with saved billing info could be used to sell "extra copies of games I can gift you for a few bucks" since Steam allows gifting. What, you mean you didn't mean to buy 10 copies of "DARK SOULS III Deluxe Edition + Steam Controller Bundle" for $115 each to gift to all your friends and family?

I don't know what battle.net is so I was speaking generally. Since pictures don't have security features on them it wouldn't be too difficult to photocopy your own id, change the name/address, print it out and glue it on a plastic card. You now have an Id that looks good enough for photo verification. It's a lot of work but if the steaks are high then it will be done. There's also the case when these pictures get leaked, there's a lot of people who have scans of my id. Or just photoshop the pic after its taken.

There's services on the darknet where you can buy these fake Id picture/scans as well.

Reply on news.ycombinator.com