Hacker News Reader

And once that happens, I then steal the target's phone.

If we're talking about deactivating someone's account via email, we are already talking about a targeted attack.

I'm not sure how relevant that threat model is (OS level security would probably be enabled for people susceptible to be targeted in such a way. Support could advise to do it before toggling the flag, etc.), but anyway the hypothetical flag would only be about making sure the automation doesn't happen and the ticket goes to support. Support can then manually handle the rare edge case and place more burden on the person attempting to deactivate the account.

Reply on news.ycombinator.com