He could have said it, instead of leaving it vague.
In this case, reference to Yubikey is not so relevant, since it was 2FA code that was hacked. If he wanted to use Yubikey with no fallback, he should have used Advanced Protection plan to force Yubikey.
Why do you expect a victim of digital crimes to know and explain how it was done? Or to know about some "advanced protection plan?" Or to pedantically differentiate between hacking of 2FA code versus hacking of Yubikey? This is just a type of victim blaming based on a technical just-world narrative.
How do you even know that he is a victim? I am curious, because that was my question.
He is the one claiming he has been a victim, despite using a Yubikey (presumably indicating that even Yubikeys are not enough to protect accounts). The onus is on him to provide some details.
For example, he could have clarified his account set up for audience to be able to meaningfully react, and perhaps provide directions, for instance, pointing him out to Google’s Advanced Protection Plan.
Because I have no reason to presume he, or most people, come on Twitter randomly to complain about a crime unless they've actually been victims of a crime.
I don't understand what more details can a victim of digital fraud give in such cases than what he's given in that thread.
A person has setup 2FA with Yubikey and assumes their account's safe, an assumption even I, a software engineer with passing knowledge of security, make.
One morning, they get up and find a recovery mail. They take common sense steps but still end up losing the account. With no other recourse like proper customer service, they ping the YT Twitter helpline.
It wasn't meant for any "audience" - a public shout for help isn't the same as playing to the gallery.
7 comments
[ 3.1 ms ] story [ 14.8 ms ] threadHow did the wrongdoer bypass Yubikey?
In this case, reference to Yubikey is not so relevant, since it was 2FA code that was hacked. If he wanted to use Yubikey with no fallback, he should have used Advanced Protection plan to force Yubikey.
He is the one claiming he has been a victim, despite using a Yubikey (presumably indicating that even Yubikeys are not enough to protect accounts). The onus is on him to provide some details.
For example, he could have clarified his account set up for audience to be able to meaningfully react, and perhaps provide directions, for instance, pointing him out to Google’s Advanced Protection Plan.
I don't understand what more details can a victim of digital fraud give in such cases than what he's given in that thread.
A person has setup 2FA with Yubikey and assumes their account's safe, an assumption even I, a software engineer with passing knowledge of security, make.
One morning, they get up and find a recovery mail. They take common sense steps but still end up losing the account. With no other recourse like proper customer service, they ping the YT Twitter helpline.
It wasn't meant for any "audience" - a public shout for help isn't the same as playing to the gallery.