4 ms·

> My mom forgot her gmail password and no longer had the same mobile number for a reset, the secondary reset option was set to my email but would not send a res

> My mom forgot her gmail password and no longer had the same mobile number for a reset, the secondary reset option was set to my email but would not send a reset despite this. I've seen this before too. A huge problem right now is the massive tech companies want an unreasonable view into your life. They want your identity, phone number, photo id, location history, credit history, etc. before they'll treat you like a real person. If you think I'm joking, spin up a transient environment, connect to a VPN, and try to participate online without linking all of your accounts to a piece of real world identity information that, in turn, can be linked to all the other things I listed above. You can't even get an email address without a phone number. Part of the issue there is the huge tech companies are abusing their market positions to assign bad reputation to the IP blocks owned by everyone else. You can't use a VPS for ANYTHING but incoming connections because the IPs are flagged all by Google et al. How do you run an API server that needs to make any outbound connections if Google, Facebook, Microsoft, etc. all consider the IP block tainted? I guess you just need to buy your IPs from Google, right? That's exactly the same tactic Google used with GMail. The original spam filtering was super aggressive and shitty and the solution, according to Google, was to use GMail instead of other providers. "Get a big provider" is a very poor answer to a question that has a technical solution IMO. > My mailserver is marked as spam by gmail Have you tried GSuite (or whatever they're calling it these days)? /s

Hnrobert42 6y ago
Not to take away from your larger point, but you can get an email address without a phone number from ProtonMail. In the past, gmx.com also let you register privately, but I didn’t know anymore. Also, there are lots of sites that let you receive an SMS in their number.
- ev1 6y ago
  On many (most) VPN connections, Protonmail prompts for another email or a SMS (due to abuse, presumably) or a non-disposable email (depending on severity)
hertzrat 6y ago
Speaking of con troubles, I think Bell (in Canada) blocks Firefox VPN. I can’t connect to anything when not on wifi.
cwyers 6y ago
Flip it around for a second. You sign up for online banking. You use your GMail account as your e-mail address. You get banking statements in your e-mail, you can reset your password to the bank with that e-mail address, etc. Now, a scammer is trying to access your e-mail account. What level of proof do you want them to have to offer Google to get ahold of that e-mail? These tech companies are not asking for an "unreasonable view" into your life as long as people are using these products to interact with the real world. They are trying to strike a balance between convenience and security that meets real-world needs. And they are trying to set that balance point somewhere where it works reasonably for the majority of their non-technical users, not for the edge-cases and not for people who think LARPing as a 90's cyberpunk novel is the most important usecase. So, yes, so long as the vast majority of GMail users are using their GMail account in a number of ways that intersect with the real-world financial system, they are going to want some way to verify your real-world identity if you lose the log-in credentials to your account.
- PeterisP 6y ago
  "you can reset your password to the bank with that e-mail address" - wait, what? That's not plausible at least where I live, since (a) this would be massively abused to drain people's banking accounts and (b) the bank would be fully on the hook for compensating these losses (above an initial 50 eur risk IIRC), so none of the banks would even consider permitting a risk like that, since that would cost them so much money. If you need to reset your bank credentials (not solely a password - some form of second factor is universally required), it can't happen electronically without involving the real world; either you come to a branch with proper ID or you get mailed them to your registered physical address.
  - criddell 6y ago
    How would online-only banks work there?
    - PeterisP 6y ago
      The standard solution for local online-only fintech services would involve piggybacking off of the existing secure electronic ID i.e. digitally signing the agreements (and the request for credential change) with the electronic signature key on your gov't ID chipcard. I mean, no matter what you do, you have to have some root of trust / root of identity, and it needs to be backed by (and verified in) the physical world - so you either have to do it yourself or delegate it to someone whom you'd trust a lot (i.e. not a random email provider). If a trustworthy universal government ID is available (which is a problem in some places, like USA) then that is a natural solution to that. Alternatively, an institution is free to trust people remotely, putting effort into fraud monitoring, and taking on whatever risk their trust and processes enable - e.g. we've had some financial institutions verifying passports over videochat in such cases; I have no strong opinion on how safe or risky that is, but presumably the institution has considered the risks very carefully and found them both acceptable and necessary (in that case, sending a scan/photo/picture of the same document was not allowed, it was specifically about live videochat) - which is the key part of the whole thing, the alignment of incentives and responsibility for that risk. If the consequences of these security risks fall on the users, then the users have to worry about security while financial institutions just wiggle their ears and blame "identity theft". If the consequences fall on the institutions, then the users can stop worrying about the things they mostly can't influence, and the institutions magically design their processes and workflows carefully so that they actually prevent fraud (since it's their own money at stake) and they're forced to implement decent solutions to any tradeoff between usability and security, since their profits depend on both.

Hnrobert42 6y ago

Not to take away from your larger point, but you can get an email address without a phone number from ProtonMail. In the past, gmx.com also let you register privately, but I didn’t know anymore. Also, there are lots of sites that let you receive an SMS in their number.

ev1 6y ago
On many (most) VPN connections, Protonmail prompts for another email or a SMS (due to abuse, presumably) or a non-disposable email (depending on severity)

hertzrat 6y ago

Speaking of con troubles, I think Bell (in Canada) blocks Firefox VPN. I can’t connect to anything when not on wifi.

cwyers 6y ago

Flip it around for a second. You sign up for online banking. You use your GMail account as your e-mail address. You get banking statements in your e-mail, you can reset your password to the bank with that e-mail address, etc. Now, a scammer is trying to access your e-mail account. What level of proof do you want them to have to offer Google to get ahold of that e-mail? These tech companies are not asking for an "unreasonable view" into your life as long as people are using these products to interact with the real world. They are trying to strike a balance between convenience and security that meets real-world needs. And they are trying to set that balance point somewhere where it works reasonably for the majority of their non-technical users, not for the edge-cases and not for people who think LARPing as a 90's cyberpunk novel is the most important usecase. So, yes, so long as the vast majority of GMail users are using their GMail account in a number of ways that intersect with the real-world financial system, they are going to want some way to verify your real-world identity if you lose the log-in credentials to your account.

PeterisP 6y ago
"you can reset your password to the bank with that e-mail address" - wait, what? That's not plausible at least where I live, since (a) this would be massively abused to drain people's banking accounts and (b) the bank would be fully on the hook for compensating these losses (above an initial 50 eur risk IIRC), so none of the banks would even consider permitting a risk like that, since that would cost them so much money. If you need to reset your bank credentials (not solely a password - some form of second factor is universally required), it can't happen electronically without involving the real world; either you come to a branch with proper ID or you get mailed them to your registered physical address.
- criddell 6y ago
  How would online-only banks work there?
  - PeterisP 6y ago
    The standard solution for local online-only fintech services would involve piggybacking off of the existing secure electronic ID i.e. digitally signing the agreements (and the request for credential change) with the electronic signature key on your gov't ID chipcard. I mean, no matter what you do, you have to have some root of trust / root of identity, and it needs to be backed by (and verified in) the physical world - so you either have to do it yourself or delegate it to someone whom you'd trust a lot (i.e. not a random email provider). If a trustworthy universal government ID is available (which is a problem in some places, like USA) then that is a natural solution to that. Alternatively, an institution is free to trust people remotely, putting effort into fraud monitoring, and taking on whatever risk their trust and processes enable - e.g. we've had some financial institutions verifying passports over videochat in such cases; I have no strong opinion on how safe or risky that is, but presumably the institution has considered the risks very carefully and found them both acceptable and necessary (in that case, sending a scan/photo/picture of the same document was not allowed, it was specifically about live videochat) - which is the key part of the whole thing, the alignment of incentives and responsibility for that risk. If the consequences of these security risks fall on the users, then the users have to worry about security while financial institutions just wiggle their ears and blame "identity theft". If the consequences fall on the institutions, then the users can stop worrying about the things they mostly can't influence, and the institutions magically design their processes and workflows carefully so that they actually prevent fraud (since it's their own money at stake) and they're forced to implement decent solutions to any tradeoff between usability and security, since their profits depend on both.