The security pitfalls of social media sites offering ID-based authentication
Summary: X launched a government ID-based authentication option for its paid premium users, run through a third-party security company that keeps ID images for 72 hours and information derived from them for 30 days, while Meta Verified asks users to submit government ID photos plus a subscription fee. The newsletter notes the option is not available to business or organizational accounts, is not offered in the EU or U.K., and cites a case where Instagram denied a hacked account claim even after the owner submitted a 360-degree selfie and government ID images.
Key Takeaway: The accounts most exposed to impersonation - business and organizational ones - are excluded from the program, and the newsletter's own example shows a verified-ID submission failing to recover a hijacked Instagram account that was still sending cryptocurrency spam to family members.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Mentions
- CVE-2023-3421CVE-2023-4863CVE-2023-5129
- Related
- Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and Biz Viz Cyber Risks · Oct 27, 2026CVE-2023-4863: Google Chromium WebP Heap-Based Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Sep 13, 2023