I was reading this answer on a question.
Recently, at the OWASP AppSec 2010 conference in Orange County, Bill Cheswick from AT&T talked at length about this issue.
Allow a trusted party to vouch for the user, so he can change his password.
Granted, I know this is 6 years old at this point, but....
I was curious, is there really any added security to this? By "trusted party" is that assumed to be a friend, or someone else who is already authorized, or is it a site/app admin?
If someone is locked out of their account so much that they cannot use their email, or even the backup email for their main email, then how would their password be reset to begin with? Would it be given by this "Trusted source" to another email, or possibly over the phone/text (if friend).
So is there any way a hacker could hack Account A, which vouches Account B, and then do something malicious to Account B? It says "Trusted-party" so if the party ends up not being trusted, what's the worst that could happen?
I know some games implement "Vouchers" which you gained stuff if you vouch a friend and bring them to the game, but I've never seen a voucher responsible in case their friend is locked out...
Any comments towards this? Thanks.