6 ms·

I'd heard this was in the pipeline, but didn't believe it given how invasive (aka no privacy), problematic (you can't backup how you behave), and insecure (give

by nxzero 10y ago

I'd heard this was in the pipeline, but didn't believe it given how invasive (aka no privacy), problematic (you can't backup how you behave), and insecure (given a motivated attacker, I've yet to see a biometric control that can't be attacked). Why's Google doing this? It's not obvious to me, since I'm guessing they know all of this, likely already have they data on users, etc. Why's Google doing this?

dspeyer 10y ago
Because passwords are terrible. Lots of users pick guessable ones unless you have extensive password rules to stop them, and those rules are a huge pain to your users. Lots of users have terrible password hygiene, leaving them all sorts of places they shouldn't. Enough users are going to forget their passwords that you need a recovery mechanism. Which means an attacker needs to break either the password or the recovery. The most common recovery method is email, but Google often is the email provider.
- nxzero 10y ago
  My understanding is that this was deployed internally first, so the calm that "people" don't get passwords seems like a stretch. (Meaning I assume that the average person working at Google is smart enough to know how to use passwords.)
  - jsolson 10y ago
    Knowing how and putting it into practice are two different things. I know I should eat better and exercise more, and yet here I am eating a scone and not having been on my bike in nearly a month.
VLM 10y ago
Because they'll log the data of who logs into what, when, then sell it. So you want your adwords for a new website called "frameworkoftheweek.com" (which surprisingly is not registered at this instant) to only appear to people who log into HN at least once per week because they'd be the ideal target market. And google says "OK we can do that". Or you own a local supermarket and you want your adwords for "cucumbers on sale" or whatever to appear ONLY to people to log into your local hometown newspaper, because they almost certainly live there. Heck why not try the logical union operation of the local hometown newspaper, every small local bank and credit union, anything else that's local and has an account system. In a way I'm not bothered. 99% of ads are useless to me so I block them. These ads might actually be useful to me. Ads that don't suck are an interesting thing to think about. Of course we've been promised that everything from the blink tag to popups was the magic bullet that would make ads not suck, yet they sucked anyway.

by nxzero 10y ago

dspeyer 10y ago

Because passwords are terrible. Lots of users pick guessable ones unless you have extensive password rules to stop them, and those rules are a huge pain to your users. Lots of users have terrible password hygiene, leaving them all sorts of places they shouldn't. Enough users are going to forget their passwords that you need a recovery mechanism. Which means an attacker needs to break either the password or the recovery. The most common recovery method is email, but Google often is the email provider.

nxzero 10y ago
My understanding is that this was deployed internally first, so the calm that "people" don't get passwords seems like a stretch. (Meaning I assume that the average person working at Google is smart enough to know how to use passwords.)
- jsolson 10y ago
  Knowing how and putting it into practice are two different things. I know I should eat better and exercise more, and yet here I am eating a scone and not having been on my bike in nearly a month.

VLM 10y ago

Because they'll log the data of who logs into what, when, then sell it. So you want your adwords for a new website called "frameworkoftheweek.com" (which surprisingly is not registered at this instant) to only appear to people who log into HN at least once per week because they'd be the ideal target market. And google says "OK we can do that". Or you own a local supermarket and you want your adwords for "cucumbers on sale" or whatever to appear ONLY to people to log into your local hometown newspaper, because they almost certainly live there. Heck why not try the logical union operation of the local hometown newspaper, every small local bank and credit union, anything else that's local and has an account system. In a way I'm not bothered. 99% of ads are useless to me so I block them. These ads might actually be useful to me. Ads that don't suck are an interesting thing to think about. Of course we've been promised that everything from the blink tag to popups was the magic bullet that would make ads not suck, yet they sucked anyway.