zlacker

>>benhur+(OP)
If you've got an automated vetting process with a 99.999% success rate, but are dealing with billions of accounts, that's still tens of thousands of false positives.

At that level, "percentage" is an insufficient measure. You want "permillionage", or maybe more colloquially "DPM" for "Defects Per Million" or even "DPB".

You'll still get false positives though, so you provide an appeal process. But what's to prevent the bad actors from abusing the appeal process while leaving your more clueless legitimate users lost in the dust?

(As the joke goes: "There is considerable overlap between the intelligence of the smartest bears and the dumbest tourists" [1])

Can you build any vetting process, and associated appeal process, that successfully keeps all the bad actors out, and doesn't exclude your good users? What about those on the edge? Or those that switch? Or those who are busy, or wary?

There's a lot of money riding on that.

[1] https://www.schneier.com/blog/archives/2006/08/security_is_a...

>>AceJoh+YM1
> You can't even trust phone companies to do their job right and ensure the secure verification code is sent to the right phone! You provided some more secure ways for users to authenticate themselves,

For those that don't know, phone companies are easily susceptible to sim-swapping attacks which can make it easy for an attacker to intercept SMS 2fa: https://news.ycombinator.com/item?id=22016212

Edit: looks like OP changed their entire comment while I was replying.

>>judge2+vP1
You can totally trust phone companies to "do their job right". You need to understand what their job is though.

The Telcos never signed up to being a "secure verification code provider". Almost a decade ago, the local Telco industry group told us all:

"SMS is not designed to be a secure communications channel and should not be used by banks for electronic funds transfer authentication,"

https://www.itnews.com.au/news/telcos-declare-sms-unsafe-for...

Any company that uses SMS for 2FA is offloading risk and security to an industry that never expected it, and explicitly seeks to not provide it.

A Telco _desperately_ wants to be able to get you back up and running (making calls and spending money) on a new phone using your existing number before you walk out of the shop. And even more, they want to be able to transfer you across as a customer from a competitor - and have your existing number work on their network.

"Sim Swapping" is a valuable feature for Telcos. They have significant negative incentives to make it difficult. They don't want to secure your PayPal account, and nobody (least of all PayPal) should expect them to do a good job of it, certainly not for free...