4 ms·

This passwordless signin process sounds neat, but will it increase Google’s power to lock people out of things? I don’t understand why Google doesn’t have an om

This passwordless signin process sounds neat, but will it increase Google’s power to lock people out of things? I don’t understand why Google doesn’t have an ombudsman - consumers have no recourse when Google locks them out, and it seems the consequences of Google locking you out are ever increasing. I think we’re going to need legislation to force Google to make a proper appeals process.

moritonal 4y ago
At some point (unless you're an Android dev) you have to accept a bit of responsibility. If you use Gmail, Drive and Android and then decide to use Android as your preferred implementation of FIDO (when YubiKeys ect, exist) I struggle to see how if you're locked out it's not partially the consumer's fault. You choose to use Google, and can attest to the fact it's not that difficult not to.
ThunderSizzle 4y ago
Don't use Google Drive. Don't use Gmail. That solves half the horror stories already.
CyberRage 4y ago
how FIDO has anything to do with google in particular? log in with google is not FIDO authentication...
judge2020 4y ago
Google's power to lock people out of their website is already here with Oauth2. This standard is unrelated; it works by having the browser/device itself sync the virtual security keys[0], much in the same way they sync passwords currently. That's the only thing changing here, giving people the choice (and encouraging them) to sign in via "what you have" instead of "what you know", but along with that they want to alleviate the UX concerns of people not being ready to carry around a separate physical security key. 0: https://developer.apple.com/documentation/authenticationservices/public-private_key_authentication/supporting_passkeys https://developer.apple.com/documentation/authenticationserv...
- bcatanzaro 4y ago
  Thanks, I appreciate this.
avianlyric 4y ago
> I don’t understand why Google doesn’t have an ombudsman - consumers have no recourse when Google locks them out Coming soon to an EU country near you! The EU digital markets act address this issue directly, by requiring “gatekeepers” to provide human customer response, and clear processes for appealing bans etc and generally forcing companies to provide something akin to due-process.
deleted 4y ago
[deleted]

moritonal 4y ago

At some point (unless you're an Android dev) you have to accept a bit of responsibility. If you use Gmail, Drive and Android and then decide to use Android as your preferred implementation of FIDO (when YubiKeys ect, exist) I struggle to see how if you're locked out it's not partially the consumer's fault. You choose to use Google, and can attest to the fact it's not that difficult not to.

ThunderSizzle 4y ago

Don't use Google Drive. Don't use Gmail. That solves half the horror stories already.

CyberRage 4y ago

how FIDO has anything to do with google in particular? log in with google is not FIDO authentication...

judge2020 4y ago

Google's power to lock people out of their website is already here with Oauth2. This standard is unrelated; it works by having the browser/device itself sync the virtual security keys[0], much in the same way they sync passwords currently. That's the only thing changing here, giving people the choice (and encouraging them) to sign in via "what you have" instead of "what you know", but along with that they want to alleviate the UX concerns of people not being ready to carry around a separate physical security key. 0: https://developer.apple.com/documentation/authenticationservices/public-private_key_authentication/supporting_passkeys https://developer.apple.com/documentation/authenticationserv...

bcatanzaro 4y ago
Thanks, I appreciate this.

avianlyric 4y ago

> I don’t understand why Google doesn’t have an ombudsman - consumers have no recourse when Google locks them out Coming soon to an EU country near you! The EU digital markets act address this issue directly, by requiring “gatekeepers” to provide human customer response, and clear processes for appealing bans etc and generally forcing companies to provide something akin to due-process.

deleted 4y ago

[deleted]