<story><title>Even with 2FA, Google accounts can be hacked with just a phone number</title><url>https://ello.co/gb/post/knOWk-qeTqfSpJ6f8-arCQ</url></story><parent_chain><item><author>bigiain</author><text>People need to be much more aware of the fact that you don&amp;#x27;t own your gmail address, or your Twitter&amp;#x2F;Facebook&amp;#x2F;LinkedIn&amp;#x2F;Instagram&amp;#x2F;whatever account. Those companies encourage people to build their reputations and networks and &amp;quot;personal brands&amp;quot; inside their walled gardens, while repeatedly demonstrating that they won&amp;#x27;t lift a finger to help protect the user&amp;#x27;s custodianship of &amp;quot;their&amp;quot; usernames.&lt;p&gt;Unfortunately - when you explain this to people there&amp;#x27;s no really good answer to their immediate &amp;quot;so what should I do?&amp;quot; question.&lt;p&gt;I no more &amp;quot;own&amp;quot; the bigiain.com domain than I own &amp;quot;bigiain&amp;quot; on HN, or &amp;quot;bigiain@gmail.com&amp;quot;. While I can ensure I keep paying for it&amp;#x27;s registration, I have no doubt that if Monsanto or Goldman Sachs or Apple launched an new thing and trademarked it &amp;quot;Bigiain&amp;quot;, my registrar would fold instantly to a legal demand from their lawyers, and I&amp;#x27;d be just as out-in-the-cold as all those people without friends-of-friends in high enough places at Instafacetwigoo to &amp;quot;fix things&amp;quot;, or with publicity platforms like @mat behind them.&lt;p&gt;I suspect in the future, there&amp;#x27;ll be a well known way to tie your online activity&amp;#x2F;reputation&amp;#x2F;network to a strong public key (with some distributed blockchain-like revocation&amp;#x2F;renewal audit trail). If anyone&amp;#x27;s working on something like that - I&amp;#x27;d love to hear about it...</text></item><item><author>andmarios</author><text>What strikes me most in these stories, is how you always have to find some higher ranking company employee through personal connections in order to get a tiny possibility to take your account back.&lt;p&gt;These companies build on their users but, when their users need them, they betray them.</text></item></parent_chain><comment><author>misternyce</author><text>I have been thinking about this quite a bit, recently, as well and I do think the future does look like something you described.  However, I do have doubts.  Outside of being worried about the big brands removing your access to your hard earned reputations (which seems unlikely on a mass scale), what would be the other common uses cases for a crypto identity key?  As we know, in order for a majority of people to adopt new technologies, there has to be a very compelling use case.  I am not sure a consolidated identity key solves any real problem or rather it is just a cool tech thing that us hackers would like to see, kind of similar to the problem that bitcoin in general is having in achieving adoption.&lt;p&gt;I am curious if you guys have any really good thoughts on products that could implement a crypto identity key that solves a real life problem.  Would love to discuss.</text></comment>
<story><title>Even with 2FA, Google accounts can be hacked with just a phone number</title><url>https://ello.co/gb/post/knOWk-qeTqfSpJ6f8-arCQ</url></story><parent_chain><item><author>bigiain</author><text>People need to be much more aware of the fact that you don&amp;#x27;t own your gmail address, or your Twitter&amp;#x2F;Facebook&amp;#x2F;LinkedIn&amp;#x2F;Instagram&amp;#x2F;whatever account. Those companies encourage people to build their reputations and networks and &amp;quot;personal brands&amp;quot; inside their walled gardens, while repeatedly demonstrating that they won&amp;#x27;t lift a finger to help protect the user&amp;#x27;s custodianship of &amp;quot;their&amp;quot; usernames.&lt;p&gt;Unfortunately - when you explain this to people there&amp;#x27;s no really good answer to their immediate &amp;quot;so what should I do?&amp;quot; question.&lt;p&gt;I no more &amp;quot;own&amp;quot; the bigiain.com domain than I own &amp;quot;bigiain&amp;quot; on HN, or &amp;quot;bigiain@gmail.com&amp;quot;. While I can ensure I keep paying for it&amp;#x27;s registration, I have no doubt that if Monsanto or Goldman Sachs or Apple launched an new thing and trademarked it &amp;quot;Bigiain&amp;quot;, my registrar would fold instantly to a legal demand from their lawyers, and I&amp;#x27;d be just as out-in-the-cold as all those people without friends-of-friends in high enough places at Instafacetwigoo to &amp;quot;fix things&amp;quot;, or with publicity platforms like @mat behind them.&lt;p&gt;I suspect in the future, there&amp;#x27;ll be a well known way to tie your online activity&amp;#x2F;reputation&amp;#x2F;network to a strong public key (with some distributed blockchain-like revocation&amp;#x2F;renewal audit trail). If anyone&amp;#x27;s working on something like that - I&amp;#x27;d love to hear about it...</text></item><item><author>andmarios</author><text>What strikes me most in these stories, is how you always have to find some higher ranking company employee through personal connections in order to get a tiny possibility to take your account back.&lt;p&gt;These companies build on their users but, when their users need them, they betray them.</text></item></parent_chain><comment><author>icebraining</author><text>&lt;i&gt;I have no doubt that if Monsanto or Goldman Sachs or Apple launched an new thing and trademarked it &amp;quot;Bigiain&amp;quot;, my registrar would fold instantly to a legal demand from their lawyers&lt;/i&gt;&lt;p&gt;That particular problem can be solved by getting a domain that nobody else would want. In my case, I&amp;#x27;ve registered my first name+last name.com, which will certainly never be considered for a trademark.</text></comment>