🟡 Medium | Source: The Hacker News
Google has introduced selfie video verification as an additional account recovery option for users locked out of their accounts, supplementing existing methods such as recovery email and phone number. The feature uses biometric video matching to confirm identity during the recovery process. Whilst designed to improve legitimate user access, it introduces a new biometric attack surface that security teams should be aware of.
Security Architect’s Take: Review your organisation’s Google Workspace account recovery policies to assess whether selfie video recovery can be enabled or restricted at the admin level, and evaluate the risk of deepfake or presentation attacks being used to bypass recovery controls for privileged accounts.
Original advisory: Google Adds Selfie Video Recovery for Users Locked Out of Their Accounts