Ask HN: How does your help desk verify someone before resetting MFA?

10 pointsovudus2 comments

Seeing more breaches start with a convincing call to the help desk. Curious what actually works for remote staff and contractors, where nobody can vouch for the caller.

View on HN

Security Question and Knowledge Checks are too easy to find nowadays. Caller ID, voices, and even faces get cloned now too. We have been mainly using MFA checks but also experimenting with ID + selfie, or just facial matches for remote workers.

We ask them to "see the funny" https://youtu.be/HlEJbs02wAM?is=Froy84IL8G_00ulS

Sorry, I couldn't resist.

Reply on news.ycombinator.com