31 ms·

Librarian's Letter to Google Security

• m25n 4y ago
  Since HN is an entrepreneurial group, this feels like a business opportunity. Probably not a Y-combinator unicorn darling, mind you. Figure out how to help libraries help their patrons get secure reliable access to email and other internet services.
• aurizon 4y ago
  Google, we know a river of $$ flows from G-Mail - do you not feel any need to create a useable account recovery mechanism, all it would need is a few drops from that river?
  • kubb 4y ago
    Nah, they're good, lol.
    • aurizon 4y ago
      Yes, the cash register works fine!!
• wizwit999 4y ago
  Someone needs to tell this librarian Google has 2FA backup codes you can just write on a piece of paper.
  • iscoelho 4y ago
    You do not need to enable 2FA to be affected by this issue, so IIRC it is possible you never received the 2FA backup codes to begin with. "Suspicious" logins will prompt 2FA from your connected phone.
  • samsa 4y ago
    I used to work as a librarian and ran into the issues the author writes about. Less than she did - but it being a community that skewed older I have plenty of experience shepparding older and/or low income individuals through basic online tasks such as applying for unemployment etc. If you have never done this kind of work then it is very easy to take for granted how low the baseline technology competency of certain folks is. Telling someone they will need a working phone number, a password, and recovery codes to access their email when "it used to just work" will simply not fly for them. This side steps the issue that often these are scenarios where the patron is already locked out of their account and coming into a library as a last resort - so lecturing them on backup codes will be of no avail.
    • 0x53 4y ago
      Obviously, it would be better if Google would do something, but they won’t. A temporary solution could be something like a sign that encourages people to print out backup codes and the librarian could help them with it. Maybe the librarians could even store them in a folder and retrieve with ID. Not saying these are good solutions, but they could maybe help a bit.
    • Mezzie 4y ago
      To give a sense of the level of tech literacy samsa is talking about, I've had to teach multiple people how to use a mouse and keyboard + had to explain to dozens of people that the icon called 'Internet' on the library computer will let them go to Facebook just like the 'Internet Explorer' icon at home or the 'Facebook' app will.
  • zinekeller 4y ago
    Google has basically made 2FA mandatory if you have set-up an Android phone, which doesn't even prompt to back up recovery codes.
    • Mezzie 4y ago
      And this is more likely to happen to the poor since they're going to have Lifeline Assistance phones, which are all shitty Android phones. (I had a couple and keep them as burners but they're crap.)
  • ajsnigrutin 4y ago
    Does your grandma have printed out backup codes?
    • dsr_ 4y ago
      My father was a statistician and programmer for most of his career. He's switched to a new gmail account three times, at least, when he couldn't remember a password. So, no, nobody has printouts of backup codes except the people who are already aware of Google's reliability problem.
    • refurb 4y ago
      My grandma just creates a new google account whenever she gets locked out and it doesn't matter because she doesn't use email for anything important. I'm starting to wonder if she's the smarter one.
      • ajsnigrutin 4y ago
        This is great, until you're locked out of a service that you actually need, and the only password-reset way is to send a reset link to the e-mail account she never uses anymore.
  • MatthiasPortzel 4y ago
    Something that I don’t think has been mentioned yet is that Google requires a phone number attached to every account (not just a 2FA method). This is to prevent scammers from making an infinite number of Gmail accounts. (With a max of 5 accounts per phone number if I remember correctly.) This means that people without phones are unable to even set up an email account—backup code or not.
  • dredmorbius 4y ago
    I've attempted this multiple times through the years. As of my most recent attempt, the OTP flow still mandates input of a phone number. Those who lack phones cannot request OTP.
• PaulHoule 4y ago
  With 2FA it is a matter of time until you are locked out. I picture a world in 2050 where there is no more Google because everybody got locked out or banned.
• sha256sum 4y ago
  On one hand, you have the perspective of this and other librarians where users are locked out of their accounts by Google in a (debatable) measure to secure them. On the other hand, you have the perspective of computer repair people who routinely field calls and service computers due to the elderly (mostly, but also everyone, including tech literate folks) getting scammed, account takeovers, downloading malware, and worse! So maybe the solution here is not to *force everyone and their literal grandma* to be using these machines for all of their business??
  • lupire 4y ago
    Better that elderly folks stuck at home should be shut out of major activities of life?
  • Gigachad 4y ago
    It’s an impossible situation. Account security reset processes are the number one target for most account takeovers.
• acdha 4y ago
  About a decade ago, a broken iPhone caused me to experience how bad Google's MFA reset process was — there were multiple _years_ where the “hard landing” form triggered a flow which sent an email to an internal mailbox which didn't exist! — and while I was able to use printed backup codes after I returned home the experience left me concerned enough that I went to one of their identity group's public meetings here in DC. One of the things which I was struck by was how unseriously they appeared to view their role in modern life. People were generally very casual about the need and were especially uninterested in anything which required them to work with outside parties. My suggestion was that they consider a protocol where trusted civic authorities could be allowed to confirm someone's identity, which sounds like it would be useful for this case: let the person initiate a mediated reset flow where someone like a librarian, police officer, etc. could authenticate in their official capacity and check a box saying that they've confirmed the photo ID for the person standing in front of them. Most of the benefits from MFA are preventing things like phishing attacks which are also stymied by limiting it to people in your geographic area, although you might want to disable this for high-risk people enrolled in Google's Advanced Protection Program.
  • _wldu 4y ago
    I agree with your suggestion. I think Post Offices, DMVs, and large reputable retailers (Walmart, Target, Cellular Phone companies, etc.) could verify our identities for a small fee and help us reset our social accounts when needed. I arrived at the same conclusion and wrote a blog post about it a few years ago: https://www.go350.com/posts/now-they-have-2fa-problems/ https://www.go350.com/posts/now-they-have-2fa-problems/
    • lesuorac 4y ago
      Aren't half of those things you listed (Walmart, Target, Cellular Phone companies, etc.) also exactly how people get unauthorized access? You convince the employee to port "your" number and they do so and then you reset that accounts password? https://www.wptv.com/money/consumer/phone-porting-leads-to-stolen-identity-and-bank-funds https://www.wptv.com/money/consumer/phone-porting-leads-to-s...
• fio_ini 4y ago
  I got locked out of various MFA sites when I got a new device and had to redownload my Authenticator app it wasn’t linking to the accounts anymore and I could not get in. It became a chicken and the egg problem. Eventually going through support channels for each site I was locked out of I was able to get back in but it was a giant headache. I vaguely remember someone posting about a hypothetical scenario where their house burnt down and they lost all their physical devices and couldn’t get into anything etc.
  • asicsp 4y ago
    >I vaguely remember someone posting about a hypothetical scenario This one? "I've locked myself out of my digital life": https://news.ycombinator.com/item?id=31652650 https://news.ycombinator.com/item?id=31652650
• vivegi 4y ago
  It looks like the librarian's letter is from July 2021. So, the frustrated librarian raised this issue more than a year ago. Has GOOG done anything about it in the past year? There needs to be a better way.
  • Mezzie 4y ago
    This has been an issue for years. (I've worked in libraries, including public ones, on and off since 2004). It's not just a GOOG problem. In fact, Yahoo makes me want to show up and yell at some business people: They lock people out of their accounts and then CHARGE THEM TO CALL IN and fix it. Another general issue is how much of this population uses/sticks with old products: There is a large number of Yahoo, AOL, and Hotmail addresses still being used, as well as old ISP mailboxes.
    • pseudo0 4y ago
      Agreed on Yahoo and ISP emails being awful, but Microsoft migrated all the hotmail users over to Outlook years ago. At this point, there is only a cosmetic difference between a hotmail.com email and a outlook.com email. I'm normally not a big Microsoft fan, but that was one change they handled reasonably well.
      • Mezzie 4y ago
        Oh yeah, it was just an example of how this population stays with familiar products far beyond their usual lifespan. So they often want support for products and services that are old or unsupported. And why changes really screw them over: A lot of these people just have GMail accounts from when they were easier to use. MS did well on this one, I agree. (And I also hate MS but credit where credit is due.)
      • BlueTemplar 4y ago
        Considering my experience with the migration and merging of various Microsoft accounts, I find this statement very surprising...
• a-dub 4y ago
  i suspect that basic digital identity and messaging services will eventually be operated by governments. similar to how many major urban transportation systems were adopted and then glued together to provide subsidized public services.
• lupire 4y ago
  Weird to blame Google for the government's refusal to provide basic services like telephony to its residents. Why doesn't the library provide a SIM with every library card, and store it at the front desk? Or, you know, an email account with its own security policies? I got my first ever Unix shell account from a library.
• mcherm 4y ago
  Another solution to this problem would be competition. If there were a workable alternative to Gmail that had account recovery mechanisms better suited for this population than the librarian could simply recommend that for their patrons. Can anyone suggest what a good alternative to Gmail would be for this population?
  • deleted 4y ago
    [deleted]
  • hyperionplays 4y ago
    Outlook.com/Hotmail.com?
    • macrolime 4y ago
      Hotmail once deleted all my emails because I hadn't logged in through the web interface for 30 days, instead used another client. Then one day I got a weird message and logged into the web interface to find all my emails from more than a decade gone.
  • FerretFred 4y ago
    Maybe a Government-supplied email address that is only accessible from libraries? I would hope that libraries would have fixed IP addresses, so surely that could be factored into the authentication process? Some FIDO keys used to be able to be bought for as little as $5 (https://wiert.me/category/power-user/security/u2f-fido-security-keys/ https://wiert.me/category/power-user/security/u2f-fido-secur...) so it shouldn't be beyond the budget of any self-respecting town/county/state?
• ChrisMarshallNY 4y ago
  Great letter. Wanna bet it was completely ignored? Glad to see it here. Maybe it won't be ignored. Librarians rock. There's even a show about them[0], Starring Number One. I can't access the gMail account I set up, because I made a mistake, when setting the password, and did not save the one I used. It will not allow me to access the account I set up. After a while, I just gave up. I am satisfied that someone can't use my gMail address to impersonate me (because even I can't get it). I have plenty of other eMail accounts. [0] https://www.imdb.com/title/tt3663490/ https://www.imdb.com/title/tt3663490/
  • JustSomeNobody 4y ago
    > Wanna bet it was completely ignored? I just tweeted it to @Google. Maybe if enough people ping Google about it?
    • ocdtrekkie 4y ago
      It's important to understand that Google is, as an organizational body, psychopathic in nature. (Many corporations are, but Google especially, through well-indoctrinated concepts like being solely data-driven and putting scale first, combined with a belief that Google hires the best people and hence is already doing the best possible thing.) Google does not care. You cannot make Google care. Employees who care get fired, or burn out trying to make the company care, and inevitably quit. Google is Google, and the only thing that's going to make it change is regulation.
      • surajrmal 4y ago
        This is an extremely bleak perspective. Individuals care, but most are powerless to make a difference if they don't work in the area of concern. It's often a knowledge sharing game of making sure the right people hear about it which can be hard. They are intentionally shielded from direct feedback to keep them focused, but that is a double edged sword. I honestly believe the reason viral stories get resolved is because the information gets to the right people, not because of a desire to avoid bad PR. Google is a collection of largely independent tiny organizations.
• fredsted 4y ago
  Which email service should one recommend in these cases? ProtonMail?
  • kurupt213 4y ago
    Losing a password would lock them out of all previous emails but they would be able resume use of the account
  • politelemon 4y ago
    To the target audience of the library? Outlook.com as it's the simplest to use. Their immediate concern is their livelihood so they need a free email account and not have to think about anything else including its lifetime. To a techie audience? ProtonMail, FastMail, Tutanota, GMail, Postfix...
    • washbrain 4y ago
      Gmail sounds like an odd recommendation as a replacement for Gmail.
      • zinekeller 4y ago
        Gmail but the Workspace version so that you have a better customer support*. * Relatively better, but still lower than what I expect.
• thenoblesunfish 4y ago
  So, what should Google do, here?
  • TheChaplain 4y ago
    Google employs the smartest minds on the planet and also have full insight on how Google works and what tools they have, so it shouldn't be hard for them to come up with a viable solution I believe.
    • izacus 4y ago
      HackerNews is a collection of brightest minds of software engineering who all know better than incompetent Googlers. So asking for how the brightest and bestest of HN engineers handle these security cases is educational for everyone.
      • politelemon 4y ago
        It's indeed proving very educational and insightful so far. Several of us are convinced that Yubikeys will solve all their problems, which makes it evident that we have not read the letter. A majority of us are bashing on Google for other reasons. I'll print out all the comments and forward them on to the Free Library. The next time a patron gets stuck, the librarian can read one of our comments out to them.
    • UncleMeat 4y ago
      I think it is a good question that isn't well answered by "they are smart so just figure it out". Credential stuffing is a big problem. It is a really big problem for email accounts, which often are all you need to reset a password for other critical accounts. 2FA, even SMS-based 2FA observably reduces the rate of account theft. 2FA also fundamentally requires access to some extra thing that you posses, often a computing device. So it also adds friction and can lock people out (as can losing passwords). I think in part because 2FA appeared later, we seem to be okay with people getting locked out of accounts if they lose their password but not okay with people getting locked out of accounts because they cannot access their second factor. Library computers are also untrusted devices. They are also not the only untrusted devices that people want to use to login to their accounts. As for solutions. Printable access codes are supported in gmail. This is a pain to do over and over but does permit 2FA without any additional computing device. You can let people disable 2FA (which is possible), though you can expect another letter pointing at the suffering this causes and arguing the opposite. You could enroll the library in a "Bob uses this library to authenticate, don't ask for 2FA here" mechanism that does not use cookies but I'm not sure what this would actually be given that the library is deliberately resetting state on the machine after each session. Perhaps there is some acceptable state that the library could keep around? A solution in this vein requires coordination between email providers and libraries but is maybe the most promising approach. Or you could do something like a family account that permits the librarian's account to tell gmail to temporarily permit 2FA-less logins for a particular account/device pair. You could recognize that 2FA most protects against stuffing and not let people choose their own passwords to guarantee uniqueness, but I suspect you'll get an equal number of people who fail to remember their long password of random characters and get locked out, leading to a similar letter complaining that Google is harming people who need memorable passwords.
• frays 4y ago
  Can the library set up Google authenticator codes for all of their emails and look after the authenticator codes on behalf of their users? Or is SMS the only possible second factor authentication method?
  • acdw 4y ago
    No. This suggestion is, I'm sorry, utterly ridiculous. Even if it were possible---which it isn't due to the fact that many patrons have their emails long before they come to the library---but it would amount to get another public subsidy of a private mega corporation in the way of free tech support and data storage. Not to mention the security concerns, though to be honest I think that's secondary in the face of losing access to housing and benefits.
• insomniacity 4y ago
  “The reasonable man adapts himself to the world; the unreasonable one persists in trying to adapt the world to himself. Therefore all progress depends on the unreasonable man.” s/man/woman, in this case of course.
• naboonga 4y ago
  Why is the US so far behind the rest of the world when it comes to technology? State IDs/Driving Licenses already exist. These should have chips on them that could be used for authentication.
  • jrockway 4y ago
    Getting an ID in the US is more difficult than this account recovery procedure that the letter complains about.
    • zaphar 4y ago
      Especially for the the specific demographic that this letter is referring to. It's so easy to get caught in a catch-22.
  • BlueTemplar 4y ago
    Making these (and especially electronic ones) mandatory is a baaad idea : <insert random dystopian example>
    • rbetts 4y ago
      I used to feel the same. But in reality, we prove our identity daily - every credit card transaction, banking, electronic tolling, bill payment, health care visit, tax payment, legal proceeding, employment opportunity, voter registration … What protects us from invasive search is not lack of a uniformly accessible system for identification - its due process. And if the government chooses to compel you against your will and without due process - whether or not you have a laminated ID in your pocket will be irrelevant.
      • 0xbadcafebee 4y ago
        Most of those are optional. You can use cash, you don't need a bank account, nor electronic tolling, or bill payment, emergency room visits are free and there's free clinics. Other various things like legal proceedings, voter reg, and taxes are not things that are "tracked", that's just basic citizenship requirements. A national ID would make the few cases where you need to hide your identity (like you're a 10 year old girl who was raped and needs an abortion, or the doctor that needs to perform it - https://www.seattletimes.com/nation-world/10-year-old-rape-victims-doctor-speaks-out-on-abortion-pays-a-price/ https://www.seattletimes.com/nation-world/10-year-old-rape-v...) much harder. Until our government decides not to be so fucking crazy, we need to push back on its ability to unjustly track and then punish its citizens.
• phkamp 4y ago
  This is what happens when private for-profit companies through monopoly become public infrastructure with no oversight and no obligations but turning a profit.
• TheMagicHorsey 4y ago
  Google, hopefully, will not ignore this again.
• davb 4y ago
  Perhaps the solution is for libraries or local authorities to setup their own email providers. An email address “for life” with your library card, with the necessary support and in-person reset verification that their patrons need. I’m not suggesting this would be an easy or inexpensive undertaking, but maybe that’s just the next step in service evolution for a public information service like a library group.
  • BlueTemplar 4y ago
    Indeed, but this will then going to face the issue of Gmail (et al.) refusing to accept e-mail sent from small providers.
    • phpisthebest 4y ago
      I am sure a another huge vendor like Amazon, facebook, or Microsoft will step in to provide the email services :)
      • hoosieree 4y ago
        This is where regulations can step in, to require email providers to accept mail from essential service providers.
        • phpisthebest 4y ago
          I will pass on that, no one should be required to accept messages from anyone
          • hoosieree 4y ago
            How about "required to not mark as spam"?
            • phpisthebest 4y ago
              I am not a fan of regulation in general But SPAM should be resolved with strict adherence to standards like SPF, DKIM, etc. and where those fail it should be improved Today many companies, large and small, as well as government agencies, large and small do SPF and DKIM very very very wrong. Unless we can get this right I fail to see how regulations would do anything other than make things worse Some of the biggest SPAM abusers are not the small providers but the Large companies like Gmail and Microsoft who do not vet their customers very well
• kurupt213 4y ago
  How do they get away with not having a support number. Even Amazon has humans you can eventually talk to as you go through the customer service interface
  • vxNsr 4y ago
    Many people pay well over $100/yr to Amazon they expect a certain amount of support. Google by contrast doesn’t have nearly as many paying customers, and thus doesn’t feel the need to support them.
• baisq 4y ago
  I hate, hate, hate how so many web services have started to force 2fa on us. I have many accounts that I don't care that much about and I use bitwarden so it is extremely unlikely that I will get hacked and if I do I don't really care. Still, they force me to open my email account every time I log in because my cookies or ip address do not match my last login so I can input a stupid code. Big offenders in this regard are google, amazon, twitch, outlook, twitter (rarely). I know 2fa exists. If I don't enable it it is because I don't want to.
• makach 4y ago
  Shelly Rosen is a hero, and should be recognized as one. It is not very often I get to read business requirements that are so clearly defined. Kudos. This letter should be obligatory reading in schools.
  • markstos 4y ago
    It's a good letter. I'd like to see another letter drafted to other librarians recommending specific competing email providers that people who are MFA-challenged should use for anything important.
• Mezzie 4y ago
  I wish that Shelley had co-written this letter with either a tech employee or a more tech-focused librarian. The problem that she mentions is real: I've worked in her position and can confirm. But the way the letter is written makes it clear that she's not very familiar with the tech industry or how things are developed. If I were a Google engineer, this would read like one of dozens of pleas we get constantly to change X, Y, or Z for some small portion of the served population. And software devs in general find those demands annoying, particularly given some of the language that Shelley uses. I think this would have gotten more reach and been better received if Shelley had a co-writer that acknowledged the reasons for 2FA from a security standpoint and emphasized the trade-offs that are being made + suggest other security measures. Likewise, having someone with a better understanding of tech would mean being able to do things like present some solutions that don't amount to "Oh most magic of Google Oracles, please fix this." Also the suggestion that they could contact her to learn about where patrons get stuck made me cringe slightly. Basically, there's a misaimed moralizing tone throughout the letter that I think is at odds with its stated purpose, and it could have been written better, but the problem is real.
  • a-dub 4y ago
    yikes. old poor people are having their lives upended because technology has infiltrated the processes by which basic business is conducted and the designers of said technology had not bothered to consider them as a real use case, and your response is "she's not asking nicely enough." yikes*10000. cringe^inf.
    • Mezzie 4y ago
      Maybe I should have mentioned I'm a programmer and a librarian, and my suggestion is one of tactics/strategy. I care more about getting the problem fixed than the writer's feelings not being hurt, and I think that things would be more likely to change if she'd written it differently.
      • a-dub 4y ago
        sure, maybe you do get more bees with honey. or more often than not you never get seen. we live in a sad era where the only way to get real attention from large companies is to embarrass them in public. this is by their design. > I care more about getting the problem fixed than the writer's feelings not being hurt i don't really follow how the writer's feelings could be hurt in any case. you seem to have an odd perspective on all of this.
• Mandatum 4y ago
  Write to your law makers. Don’t trust companies to provide access through public shaming and media, force them all to do so.
• kouteiheika 4y ago
  Yeah, Google just doesn't give a shit. I was a gmail user since gmail was in private beta 18 years ago. I never had a phone number associated with it. And yet two or three years ago when I tried to log in Google decided to just... not let me do that, because fuck you, and started extorting me to give it a phone number. If I don't give it a valid phone number it won't let me access my email. But I can't really do that because, you see, I don't actually own a phone number. So now I'm essentially locked out of my almost two decades old email account, for no good reason whatsoever except the fact that Google is a bully. Fortunately I've long since migrated to another email address on my own domain as my main address, so it doesn't really matter. Do not depend on any Google-provided service. They don't care about you, and they will screw you over sooner or later. You're just a number to them. Most importantly, pay for any critical service you need (like email). Do not wait until it's too late. Do it NOW.
  • xxs 4y ago
    I also have it since beta -- and no phone associated.
    • jjoonathan 4y ago
      How did you manage that?
  • _fat_santa 4y ago
    It's not just Google, many corporations are starting to make "assumptions" about their customers, and these assumptions totally exclude entire groups of people. A great example I use is there are a ton of restaurants and fast food places around me. I used to walk to get lunch every day but eventually had to stop, these places realized most customers went through the drive through so they closed the lobby. Now even though this place is a 5 minute walk from me, it's no longer accessable if I'm not in a car. Same thing with my TV and Router, both of which required an app to just setup. The TV required an internet connection to "activate" and I realized that if some family saved up and bought this TV but didn't have an smartphone or internet connection, well they just bought a $500 brick. And that's why authentication standards like FIDO scare me. To me it almost seems that the standard was written by a bunch of out of touch tech bros thinking to themselves: "Well of course EVERYONE has a phone these days"
• Apreche 4y ago
  The best solution I can think of that doesn't compromise security is hardware keys. GMail has very good FIDO support. The keys are easier to use than TOTP and vastly more secure than SMS. They do not depend on any phone or phone service, and there is no transferring necessary at any time. The librarian would just need to get the person logged in successfully one time, get the key attached to the person's account, and get the key onto the person's physical keychain. The librarian would also print out the backup codes, laminate them, and put them in the person's wallet. Once that's done, this particular library patron should have few authentication issues going forward. Assuming lots of repeat clientele, the auth night mare will largely end once everyone is setup. Yeah, the key and codes might get lost, broken, or stolen, but that's the best you can do. If the person lost their actual keys and wallet, they've got bigger problems. The question really is who is going to pay for these keys? They're a lot cheaper than phones at least, but not cheap enough.
  • BlueTemplar 4y ago
    The government should, *especially* if they are requiring mandatory access (though this should be illegal anyway). But this isn't going to solve the issue of Google being too far gone (too big) to be worth saving : just shut them down.
  • eddieroger 4y ago
    Reading this comment, I thought Yubikeys, which aren't /expensive/, but aren't cheap either. I was pleased to see they have a key targeted at this specific use case now - the Security Key Series [0]. At $25, that is not too bad a price, and something I'd buy for the members of my family without much hesitation. The hangup with this, which I think the librarian in question will feel, is what happens when someone loses their key? How can I set up a trust relationship that my local librarian can reset my grandma's Yubikey, but a bad actor can't? And, $25 isn't so bad once, but if we have to replace it every month, that's less fun. Maybe that's just agreeing with you and lamenting the state of things, but maybe someone will read this and think $25 isn't so bad and write a grant to pilot this program. 0. https://www.yubico.com/store/#for-individuals https://www.yubico.com/store/#for-individuals
• aposm 4y ago
  This is one of those situations that make it incredibly clear that even Google, with all its resources, never considers the use case or life experience of anyone besides a wealthy Bay Area tech worker when designing their products. I can't help but wonder how this blind spot got so big - and why they still don't address things like this even with all the user testing & A/B trials they do for ruthless optimization. Is it just because usability has no correlation with profit, and so the feedback loop is broken?
  • izacus 4y ago
    So how does your company handle these cases while defending against social engineering attacks to steal all private data? The security wisdom I've always seen was to use 2FA and prevent other attempts at authentication, but if Google is evil for doing this security... what's the answer?
    • hedora 4y ago
      I get the impression Apple stores handle this reasonably well (though you lose data after a last-ditch password reset if and only if that data is unavailable to law enforcement warrants). Anyway, I think the the common case is that most data is recoverable with an ID or whatever they require. FWIW, searching HN for: “locked out of icloud” doesn’t produce much.
  • deleted 4y ago
    [deleted]
  • asciimov 4y ago
    This blind spot got so big because the vast majority of wealthy Bay Area tech workers have never been poor or homeless. It is difficult for those that have never lived in poverty to understand the struggles that it brings. Just look at his thread, see how many people fail to comprehend that if someone is using the library computers they aren't going to be able to afford a $25 key-chain verifier.
    • daniel_reetz 4y ago
• Digit-Al 4y ago
  I've been saying for a while now that the big tech companies have a strong desire to embed themselves into all our lives, and become a central part of our lives: but the all seem to forget that "with great power comes great responsibility" and none of them want to provide the level of support required to prevent people losing everything important in their life due to a stupid technical problem. It's well overdue time they realised that if you want to be the sole way people communicate with each other, pay their bills, communicate with the government, and hold cherished memories, that they have a strong responsibility to provide a very strong level of support to prevent people from losing their entire online identity - and thus their entire offline identity as well.
  • zmgsabst 4y ago
    They don’t care because you’re an underclass to be milked for profit. I think that Silicon Valley talks big on social issues precisely because they know they walk in the wrong direction.
    • protomyth 4y ago
      Its interesting how wrong they are when dealing with the daily lives of the lower class or people who don't have a big voice. There's no ROI in helping an elderly person maintain their dignity nor cancelling a couple of Native American accounts because their names don't seem correct to them. What really bugs me is that the employees of the Google seem to have their own political agenda, but none of that includes the people the company is actually ill serving. I guess that's just not cool or edgy. Its the company they work for that has become a tyrant.
• RektBoy 4y ago
  Ehm, don't use Gmail then? I know I know, they're Americans...
  • dan_mctree 4y ago
    It's not like most people will know they might lose everything if they sign up with google. Most rightfully expect that google, like most other companies, has customer service. By the time they realize, they're too late We need to start seriously spreading the word that Google cannot be trusted to hold anything important to you
    • Dracophoenix 4y ago
      I'm pretty sure this isn't a Gmail-only issue. This letter could have been written to any other email provider, but it just so happens to be Gmail due to popularity. Email is an inherently insecure service. Security professionals had been clamoring for default 2fa, E2EE, etc. due to various breaches, leaks, and security issues that have occurred over the years. Remedying the aforementioned security issues necessitates certain practices to be phased out and the people who relied upon them to be caught up to speed or left behind.
• LocalPCGuy 4y ago
  It does seem like the library's (and really, anyone who helps the aged with their accounts) first order of business for those that have access to their email should be to get them setup with a secondary account at a different service. I'm aware of a number of problems though - this is a lot of cognitive load to add to someone who just barely understands how to get to the mail in the first place. And obviously it doesn't help someone who is already locked out and seeking assistance getting back in. It opens another (likely less secure intentionally) way of phishing the seniors. And there is not really a good way to transfer all of your email history from one account to another that I'm aware of. So while I believe the best "market solution" would be for folks to use some sort of alternative, I'm not sure it's a realistic ask. So Google needs to take this seriously and realize how devastating this can be. It's not "just a free email address" to many people, it's their lifeline to everything. Heck, even myself as a tech savvy person worries about getting locked out of my Google account given I use an Android phone and have 2FA setup through that device for a large number of services, including my password manager. Note to self, get on that physical version of the digital black book that provides physical copies of anything needed to get back into accounts (2FA codes, backup codes, etc.)
• fn-mote 4y ago
  Gmail is locked up tight. I like it that way. People who need _really_ security like it that way. I'm confident that I will not lose my email account to a social engineering scam. It's much safer than my phone number. Not everybody needs this level of security. In fact, as the article and most responses demonstrate, the high security is not desirable for a large number of people. Honestly, this sounds like the space for some kind of "non-profit startup" -- email services for the at-risk population. Of course part of the solution is non-tech, but there needs to be some real service involved. Interesting.
• II2II 4y ago
  I suspect that this is yet another situation where public libraries are going to have to step up to the plate and provide services to fill in the gap. In this case, it would be email services to patrons. The Googles of the world exist because they provide inexpensive services through automation and at scale. They are poorly positioned to provide services that cannot be automated at scale. Chances are that any attempt to do so would likely bankrupt them even though we are talking about extremely wealthy corporations. (Keep in mind that we only hear of a fraction of the complaints about Google. Few people have the reach or ability to have their voices heard.) On the other hand, libraries are already embedded in the community. They already have personnel who can better understand and respond to situations that Google would regard as edge cases. They are also much smaller organizations that have less bureaucracy to deal with and a mission that aligns with the needs of the community. I am not saying that they have to provide the actual email servers. They could contract that out, perhaps even to Google (though I suspect they would try to find another organization). They would be managing the email accounts themselves, including authentication and recovery.
• tomjen3 4y ago
  This is well meaning and shows an unfortunate side of 2f-auth, but she seems to think that google is in the business of helping people. They are in the business of selling ads. True their search engine has greatly helped a lot of people, as has gmail. But they are in the business of selling ads, and they are not selling enough ads to people who both a) cannot continuously afford a phone number b) are unable to afford an internet connection at home to be worth dealing with the complaints, manual verification and prevent fraud. Google is in the business of making money. You make very little money from poor people, and you lose money if they cost even more to service. This does not mean that it doesn't suck for the homeless lady, but this is reality.
  • dredmorbius 4y ago
    Regulation can change that.
    • tomjen3 4y ago
      Well yes, but then a) regulation can also cause more damage and b) you should be writing to your senator, not google.
      • dredmorbius 4y ago
        Points being that: 1. Overcoming business incentivisation requires some external influence. 2. Individual action alone won't accomplish this. 3. We're part of that larger conversation. Writing Google first shows a good-faith effort. Google's failed to respond to that. HN is upping the ante. Regulatory action is another level. These are not exclusive or independent actions.
• maram 4y ago
  >> There simply must be a way to change how Google handles two-factor authentication which does not constantly lock out poor people who use the public library to access their email. It must be possible to make it so we do not constantly reach these dead-ends where Google tells patrons to endlessly loop through “I don’t have my phone” and “Try another way” until their account becomes locked permanently due to too many failed attempts. Why is Google making it hard for the poor to access their email in these times? it’s not like google just launched today. They have the data of these users, who use internet from public libraries.
• afiori 4y ago
  • washbrain 4y ago
    She/her covers 3 of the 4 you mention, and the fourth form always ends in an s. So it's not really necessary to hit all 4 in a signature line. Additionally, the common pronouns (he, she, they) only really need a mechanism to tell a speaker which set to use - "he/his" is a label for a set, not the set itself. For neo pronouns, I agree, it's probably best to lay them all out to reduce ambiguity.
    • afiori 4y ago
      the point of doing it for non-neopronouns is to have neopronouns be less of an exception. > he/his" is a label for a set, not the set itself. I did not think of this. It makes a lot of sense.
  • deleted 4y ago
    [deleted]
• avra 4y ago
  > This elderly woman, looked to be in her 70s, might lose the roof over her head, due to being unable to log into her Google account, because she lost her old phone and with it, her phone number. I think the real issue is outside of Google's reach. You shouldn't have to lose the roof over your head just because you don't have access to your emails. Sure, it sucks that Google doesn't care if these people lose their access to Gmail. But I don't see how Google has a greater responsibility than the state/government in this.
  • eli 4y ago
    I agree that social services should be administered in a way that helps people succeed instead of constructing barriers to benefits... But is your position really that losing access to your email isn't a big deal with real-world consequences? Forget government services, nearly everything you do online requires access to an email address.
  • hermannj314 4y ago
    We don't want to address the real issue that a democratic government of 350 million people is slow and ineffective, so we demand that private industry make up for the failings of our government. I dont think it is unreasonable for the 22 trillion dollar a year, 250 year old institution of the US government to solve the problem of why it is denying welfare to its own citizens. Or maybe the US government monopoly should be broken up into smaller governments to foster a spirit of competition in the marketplace if it can't meet the needs of its customers.
    • EricE 4y ago
      >Or maybe the US government monopoly should be broken up into smaller governments You mean state/local governments? Federalism? It's how the country started by as each decade passes we willingly cede more and more and more control to the horror of a central government our founders were set on avoiding. It's been nice to see some recent trends back towards states rights and downsizing the federal government - I hope for all of our sake the movement picks up steam.
• dotchloe 4y ago
  I have an idea: 1. When creating a Google account, you can choose that the account will be owned by a specified library (or other institution). This can also be done for already created accounts. 2. When that account is then locked out due to missing 2FA, the library holds the backup codes and can be provided upon identification. This is similar to how Google accounts can be managed by a company that you are employed at.
• dereg 4y ago
  More than all the antitrust regulations being thrown at Google, I'd like to see regulators force Google to provide users customer support.
  • pid_0 4y ago
  • amadeuspagel 4y ago
    Customer support that has access to google accounts, that can give everyone telling a sob story to some customer service rep access to your account?
    • dereg 4y ago
      It certainly beats having to send an email to a faceless "support" address that ends up sending me the same 4 boilerplate questions when I try to figure out why my business locations' rule-compliant map listings were suspended from My Business even when I spend $15k per month on Google ads, sure. It hurts my business (there hasn't been a resolution since when the issue arose four years ago), but it's not nearly the hurt that the folks the librarian is helping are feeling. Maybe, just maybe, if people are sobbing, maybe there's a good reason why! And maybe, just maybe, if you don't want to receive such support, you can advocate for a system in which you could opt out of all such processes entirely, instead of arguing that any form of account remediation shouldn't exist.
    • nick__m 4y ago
      Your concern while valid seems solvable. They could preauthorize a random token amount on credit card with matching details, have you call the number on the back of your card to figure out that amount and then you have to input that number to authorize the access in an oath like flow. Please tell me if you see something wrong with my procedure? edit: I saw something wrong, I have forgotten about the vast unbanked population in the rest of the world as we don't have that problem in Canada¹ 1) https://www.gfmag.com/global-data/economic-data/worlds-most-unbanked-countries https://www.gfmag.com/global-data/economic-data/worlds-most-...
• bravoo 4y ago
  I
  • politelemon 4y ago
    You?
• gumby 4y ago
  If a large percentage of computer users who use the library exclusively have ID, the library could purchase a MF device or cheap android phone running an MFA app and use the same device for every user or many users: show your ID, librarian verifies that you're registered, and then come over and log you in with key + username (user still enters password). Would it be possible for some nefarious person to grab these keys? Yes, but essentially you're reducing the MFA back down to SFA, a cost I think likely worth it for this group.
  • asciimov 4y ago
    Forcing public libraries to use a workaround to fix a problem Google created isn't an ideal solution.
    • gumby 4y ago
      I'm not sure what an ideal solution might look like. Do you have a thought on that? OTOH this library use case is a specific kind of outlier: I imagine this issue occurs in most/all libraries; it's a situation where changing the level of security is worth the tradeoff; it doesn't affect the security of anyone else; it's relatively inexpensive. I don't consider this a "blame the victim" solution to the problem. I see it as an accommodation for people with specific but special needs.
• exabrial 4y ago
  The Silicon Valley model is establish a monopoly, then offer zero support. Treat fellow humans with zero empathy. Ranchers treat their cattle better if they’re in distress.
• annoyingnoob 4y ago
  I've always viewed Google's lack of support as irresponsible.
• paganel 4y ago
  The silent majority of us in the tech world knew (and know) that 2fa is a mess, will always be a mess, but for whatever reason the security-obsessed people have taken over the industry in the last few years and here we are, elderly people actually: > losing their welfare benefits, their housing, and struggle to find work. because of technical decisions centered on security. I'm not sure what would be the best way forward, for the moment I'm in the "less tech is the best" camp, especially when it comes to interactions between citizens and the State, probably that tendency will only grow.
  • deleted 4y ago
    [deleted]
  • hedora 4y ago
    > security-obsessed people More like “incompetent, self-proclaimed security experts.” The three pillars of security are availability, integrity and confidentiality. Google’s auth flow aggressively face plants on the first requirement.
• 1970-01-01 4y ago
  This letter earned an upvote. GMail was created to make email better. Ignorance of a significant, life-changing problem with it's availability can not be acceptable. Any Fortune top 10 with billions in their pockets must do better.
• planetafro 4y ago
  Perhaps hardware keys are the answer? Seems like a lower cost alternative.
• rossdavidh 4y ago
  I fully sympathize with the librarian's concerns, but there's this: "Many government welfare forms, housing applications, and jobs applications these days require the use of the internet exclusively with no option to fill things out in person." Why is this? Really, this does not seem like a problem Google caused, but rather a problem caused by the government when they made it mandatory to have internet access to get the benefits they should get. Would they have made it mandatory to call them on the phone, back when phone access was not yet universal? If they had, would AT&T have been at fault? The government caused this problem. I'm all in favor of finding a non-government solution (charity sponsored by HN people to get people Yubikey or equivalent, maybe). But this is not really a problem caused by Google, and if these people were having their benefits scammed away from them because their email accounts were hacked, people would be excoriating them for not instituting 2FA.
  • hugh-avherald 4y ago
    It's cheaper.
  • nfriedly 4y ago
    You're right, that online-only access is definately a government problem. But this: > Even when we clicked “I don’t have my phone” it asked her to open the Google app from the phone that she does not have. That's a google problem. Google fixing their problem would lessen the impact of the government problem. (And, more generally, make gmail a better service for lots of people.)
    • jeffbee 4y ago
      Well, you can see the problem, right? Allowing attackers to bypass 2FA just by saying their phone is lost makes 2FA worthless.
      • nfriedly 4y ago
        Yeah.. but an "I don't have my phone" button that just tells people to use their phone is equally worthless. I don't know what the right answer is, but that certainly isn't it.
• jhanschoo 4y ago
  I lost my phone just this week, and in setting up another device, I noticed that I was able to authenticate using the Google app in yet another (signed-in) device that was not connected to the internet, a la 2FA authenticator code apps. I'm not sure how recent this authentication mode was introduced, or if it's available only in select situations, but it would have completely resolved the librarian's complaint.
• timcavel 4y ago
• tmpz22 4y ago
  Googles AI first approach to so many things is completely opposed to their own D&I initiatives.
• 0xbadcafebee 4y ago
  Classism via Internet. When Uber and Lyft became popular and you still needed a smartphone and mobile connection to use it, it basically became a way to keep poor people segregated in transportation. If you couldn't afford a smartphone, or a data plan, or only sporadically, you were relegated to the public transportation options which are slowly defunded as Lyft and Uber lobby governments to become the "more affordable" alternative to public transit. As a result, 'hacks' (illegal taxis) are widely used in many cities because you don't need a smartphone or data plan and they are cheaper, yet are more dangerous. Mega-corporations that design for "the 80% of users" implicitly make life harder for vulnerable and poor people. It's time for us to not only hold Government accountable to treat people well, we have to hold Corporations accountable to the same standards (at minimum). (as an aside: I love the Free Library of Philadelphia. they get out in the city and meet all kinds of people, help them get access, always generous with their time and friendly. they are a vital service to the community and I hope Google listens to them)
  • tetromino_ 4y ago
    > When Uber and Lyft became popular and you still needed a smartphone and mobile connection to use it, it basically became a way to keep poor people segregated in transportation. Uber and Lyft were a massive, widely praised improvement specifically for poor people because for the first time ever, poor people got access to a taxi service that was not bigoted against them. Before Uber, bigoted taxi drivers routinely refused to pick up passengers with the wrong skin color and refused to drive to poor, outlying neighborhoods. Uber and Lyft did away with that nonsense. Doesn't matter what you look like or what you are wearing or where you live, if you can get a phone, you get a ride.
  • markstos 4y ago
    My town now as "app-only" parking spots. (Maybe there's some fine print on the sign about another way to pay, but it's not clear from 10 feet away if so).
    • jackson1442 4y ago
      All the ones I've seen allow you to call a number to pay. I'm sure the UX is terrible though.
• russfink 4y ago
  Well, this is a tricky situation. At what point did Google agree to become the world's free email provider? We have to decide where their social obligation outranks their share holder obligation. And by "we," I include everyone from users, technology providers, and especially governments that require email addresses to get basic services, everyone. A modest proposal. Can one YubiKey serve several email accounts? Ask patrons to sign up for a library card. Register each library card with one key, such that one key can serve many patrons. Help them enroll with multi-factor authentication. Whenever they need it, simply request the token from the librarian desk. (Put the token on a giant brick or yardstick, so that it never leaves the library. Sort of like how they do at gas station bathrooms.)
  • mehlmao 4y ago
    >At what point did Google agree to become the world's free email provider Maybe they shouldn't have offered email for free to the world if they didn't want to be the world's free email provider.
  • blfr 4y ago
    > Can one YubiKey serve several email accounts? Yes. I use the same YubiKey with at least three Google accounts.
• joeyh 4y ago
  One thing that the library could do is store the cookies of their patrons, and restore those next time they use a library computer. This would avoid the most common case of the problem. I suspect this is the only feasible solution; Google is certianly never going to bother with these people.
  • Jaruzel 4y ago
    This would be a massive security risk, holding that information on the machines, or even in a central location (as roaming profiles which not even MS recommend anymore).
• jwilk 4y ago
  "JavaScript isn't enabled in your browser, so this file can't be opened. Enable and reload." This works without JS enabled: https://docs.google.com/document/d/1f6HPQbUjslcbjVHkJkAgYmQmBV3PRRHEcx4WL5rxuE8/export https://docs.google.com/document/d/1f6HPQbUjslcbjVHkJkAgYmQm...
• apeace 4y ago
  PSA: If you are low-income, or you know low income people who do not have internet at home, you should check out ACP, the Affordable Connectivity Program[0]. It is a federal program that provides up to $30/month, paid directly to your ISP so that they can take that amount off your bill. I work for an ISP[1] that offers a $30/month, 200Mbps plan which is free when using ACP (we don't even take your credit card). Most ISPs now have an ACP section of their web site if you search for it. Having worked extensively on implementing this program at my company, I have seen exactly what this librarian is talking about. The people who need programs like ACP are also disproportionately people who have low tech literacy, and often poor literacy/education in general, and the existing systems don't work for them. I wrote about that recently in another thread[2]. When a customer is locked out of their ACP account, luckily the ACP support line is able to reset their password over the phone. But it's not always an easy process. Often, we need to have multiple, in-person meetings with these customers in order to get pictures of their ID, and often ACP will not do anything to an account unless the customer is physically on the phone or in person with us asking them to. If our customers could always get access to their Gmail, it wouldn't be nearly as big of an issue. They could reset their password the way you'd expect. But as the article is pointing out, if you're locked out of your Gmail there is absolutely no way in. It's really striking just how much work it is to be poor. Google needs to fix this, and remove one more barrier to people who need to use email with government services. [0] https://www.fcc.gov/acp https://www.fcc.gov/acp [1] https://www.flumeinternet.com/ https://www.flumeinternet.com/ [2] https://news.ycombinator.com/item?id=32086589 https://news.ycombinator.com/item?id=32086589
• qpiox 4y ago
  The only solution to this is that state authorities learn how this is a systemic problam and start to reject email addresses from operators like Gmail for all their services (and all email operators that do not have a real support and where one's identity is not actively checked and can not be proven and taked back via a real support line).
• shadowgovt 4y ago
  The author is 100% not wrong, but the problem is that, unfortunately, it is entirely possible that Google cannot have an authentication system that is correct for use by the elderly in a shared-machine environment while being correct for everyone else at the same time. There are options to fix this, but they're social, not technical. To get there, let's start with the technical side of why the author's proposed fix won't work. Google has no idea who anyone is. The only way they can know is the authentication process. And that process is under perpetual, high-investment attack by basically everyone because Google is a valuable target. Everyone from script kiddies to state actors have tried every method to not only compromise individual accounts but to build frameworks for systemic compromise, because when you focus on a single target you can invest the resources to, for example, set up a server that mimics the Google login page or a phone bot that sounds like it's making calls from Google Security. Our author bemoans the lack of a back-channel to recover one's account, but that back-channel is (a) perpetually overloaded with requests to access accounts (b) one of the major vectors for attempting to steal an account, because the back-channel is just one more interface on the systematically-attacked system. (Source: I know someone who used to be in the loop on the back-channel. Scammers would call crying about kidnapped children who were going to die in a couple of hours unless they could get into a GMail account to get an address in a ransom note. Google had to train their phone crew to understand that probability was heavily skewed in the direction that if they capitulated, they were, within a statistically-negligible margin of error, never saving a kid and they were always letting an abusive significant other into their former partner's account so they could ransack it for passwords and vulnerable 1FA access codes and fuck up someone's life. Truly sick, heartbreaking stuff). So that's the system under attack. How to address the problem that the elderly and impoverished can't afford to keep up with Google's security measures? There are a couple of options here. In the short run, the cheapest is "Don't use Google." Use an email provider under less persistent threat, and one small enough to offer high-touch technical support. This is one of those situations where free may be the enemy of "cheap but affordable," and to bridge the gap someone could even start fundraising to pay for accounts on a service like that. There may even be meat on the bones of someone being a non-profit high-touch email provider of that sort, who can secure a person's account by having them log in from a specific, privileged machine within sight of an operator who knows them personally. Go back to the old days of how the DARPANET was actually secured by "every node is locked behind a door." Another option is that a service libraries could provide (at possibly great expense to themselves, but options on the table) would be to serve as a credentials broker for their users. Have the library keep track of the 2FA side of things. Risky and adds expense to the library, but for this userbase that local service is the missing piece of the puzzle. Unfortunately, this isn't something Google is set up to provide; they're too centralized, they aren't actually in the communities where the need lies.
• ridgered4 4y ago
  Is it even possible to use a google account without a phone number? Google (and about everyone else) demands them for tracking. I've steadfastly avoided giving out my number for most trivial things but it's becoming harder and harder. The recent dark pattern is to setup your account and then claim there was suspicious activity on first login so they need to verify your (brand new) account by having you enter a (completely new) phone number. Microsoft recently extorted it out of me by forcing me to convert my mojang account to a Microsoft account and then pulling the verification stunt. Twitter, facebook, etc all do this. Another annoyance is if you enter a landline number most of these things just assume it's a cell and then ask you for the verification code that they just sent into the ether.
  • thepangolino 4y ago
• unixbane 4y ago
  I quit gmail 10 years ago because of this fucking bullshit (which mainly was brought to status quo by people like HN users and programming blog posters for the last 2 decades). This is a direct consequence of garbage cultures that have been left uncontended: - UN*X, for not providing sane protocols that anyone would want to use (email is garbage in the first place. aside from the other 10000 problems with it, you should be able to generate addresses on the fly for each contact you interact with, which also solves spam and removes the need to have a "super smart" central "trusted" server with spam filter created with 10000 man hours of work that you can never create yourself). SQL injection was a UN*X braindamaged phenomena; no sane protocol would require embedding strings in the concrete syntax by hand, except when you have a bunch of idiots following the "everything is text" and "text is the lowest common denominator" mantra - (continued) The email end game from the beginning (due to the spam problem) is that anyone who tries to make their own email provider will be blocked temporarily or permanently. There are already only a few remaining email services in existence. Due to UN*X braindamage, your email address is tied to a domain name, which will also be blocked as this is the natural meta of such a system: Admins get to look at the pointless string at the end of your address and decide if they don't like a substring of it, or only allow a set of known domains. Of course, if a sane protocol was in use, your address would just be a long string of meaningless bits and there would be no location or English word to discriminate on. - Webshit, for allowing corpos to create interactive nonsensical applications instead of forcing them to use well established protocols with static pages describing the address of said services. Why in the hell can a website run code? Immediately the first thing I thought of when I heard of that was, "oh but wait what about all the stupid people who will make crap code that will freeze your browser?". This is such a terrible nonsense idea. And all the web standards are crap too. The web is a relic like Flash player. - Infosec, for floating this idea that the user is an absolute idiot, and cannot be trusted to manage his credentials, not even with an "I'm an infosec expert, opt me out" option (ironically, anyone in infosec probably _can't_ manage their credentials). The only reason they are partially right is because of UN*Xy practices which make the most trivial tasks insecure (for instance, you could just dump the database of 99% of websites between 2000 and 2010 due to SQL injection, so for casual/lazy users who use the same login on multiple pages, you could login to all their services). - Login voodoo, this started with "frequent flyer number" bullshit, where you could never tell if someone could use your stupid questions to get into your account without your password (they could), and password reset, which means your email address is essentially the public key for your account, and stuff like the Steam vuln where you could literally just press "i forgot my password" and it would let you into whatever account you wanted - Hyperstatism, the narrative will eventually shift (if it hasn't already) to "you have to have a complex login mechanism because you need to be identified [by cell phone, government ID]" This thread is a good example of how you are all helping nothing. We need real solutions to technical problems. Not solutions for people who don't know how to do anything properly. We can trivially have a cell phone that stores private keys, and public keys of other people and maps names to them, and is trivial and intuitive to use by lay people, but instead you will pander the dumbest possible thing like "biometrics", or some other forced 2FA crap, because poor people are supposedely too stupid to use anything else, like even a simple password which would still be better that what companies like google do. That's not how it works, you implement a PROPER solution and let the user friendly amendments to it trickle down. We even see now the capability folks reusing UN*X and javascript, the two worst OS and language to try and appeal to get uptake of their projects. Literally no solution the hacker has put forth today solves the problem, they just want to pander to specific nonsense that makes them feel pragmatic about themselves.
• mato 4y ago
  Here's an idea: Why not allow the owner of a Google account to delegate a trusted third party who can handle MFA/otherwise approve logins on their behalf. I kind of do this already by setting the recovery emails for family members (especially aged parents) Google accounts to those that I control, but to my knowledge it is not possible to do the same for the mobile number used to secure the account. This way, at least as I imagine the authors scenario, the library's regulars could delegate them as the trusted third party, problem solved. Oh yes, and also what they write -- add an on/off setting for "Be less anal about logins from unrecognized devices".
  • ocdtrekkie 4y ago
    So the biggest problem is that every optional feature you offer up does not help when someone walks into the library already locked out. The vast majority of society will never be aware of available options and features for their Google account, so it's only the default behavior that matters. Most people locked out of their account could've set up some sort of way to get in (like backup codes), if hindsight was 20/20 and they knew a lot about Google accounts. You could add a feature like this, and maybe it helps one out of every hundred people who try to log in at this library, and that's optimistic at best.
    • mato 4y ago
      > So the biggest problem is that every optional feature you offer up does not help when someone walks into the library already locked out. The vast majority of society will never be aware of available options and features for their Google account, so it's only the default behavior that matters. Fair enough. I live in the EU, we all have state-issued ID cards and no cultural problem with using them, so presenting those via some channel to Google would work here, but I can't imagine it working in the states.
    • Karunamon 4y ago
      At what point is it reasonable to start assuming basic security/computer literacy on the part of the public (to the point where, if you screw up, it is your fault for screwing up and not the computer/companies fault for not telling you something)? This is an open question. We are not there yet, but at the same time I don't think it's tenable in the long term to be in the state of assuming the user can't be trusted to know what 2FA is.
• hedora 4y ago
  It looks like it is possible to use totp for your backup second factor, which would let the libraries store the secrets on paper and require ID for a password reset: https://webapps.stackexchange.com/questions/127464/enabling-2fa-on-a-google-account-how-to-get-totp-secret https://webapps.stackexchange.com/questions/127464/enabling-... It looks like it is a pain in the neck, but also possible to use it as the main second factor, for people without phones. This reminds me, I need to move 100% off google’s ecosystem.
  • markstos 4y ago
    Google only recently made MFA mandatory, so most of these impacted users didn't really opt into MFA, they just didn't opt-out by closing their Google account. Likely the first time they realized they might need a backup option would be when they were locked out at the library and it was too late.
    • rurp 4y ago
      It is so incredibly heartless on Google's part to spring this on unsuspecting users, without any sort of customer service support. Most people having their accounts suddenly bricked aren't the type that can raise a twitter mob loud enough to actually get on the company's radar.
      • markstos 4y ago
        Google did provide some advance warning that was coming. Also, accounts without MFA were also also causing harm. Some vulnerable populations also didn't realize how easily a non-MFA'ed account could be taken over remotely due to a weak password. And then due to "password reset" functionality, a Gmail account takeover can pivot to cause greater harm. This is a classically difficult problem: improving security often reduces convenience. The trade-off Google chose to mandate for all users was not the best for users without stable phone access.
• sdbrown 4y ago
  I feel like fingerprint/iris/retinal scanners would be a reasonable stop-gap here if only there was some way to deploy them cheaply. Does anyone know if such add-ons exist that might be made compatible with a 2FA system?
  • Jaruzel 4y ago
    Serious Question: Do iris/retinal scanners work on people with severe cataracts[1] ? --- [1] People with these are part of the demographic being discussed.
    • sdbrown 4y ago
      Huh! https://biomedical-engineering-online.biomedcentral.com/articles/10.1186/1475-925X-3-2 https://biomedical-engineering-online.biomedcentral.com/arti...
• ocdtrekkie 4y ago
  > Today I decided I would try to change Google. Many have tried. Many have failed. The best the author can do is encourage people to move to alternative providers.
• antgiant 4y ago
  If the US government created its own SSO system and mandated that all government website used it as primary while allowing third parties to use it too this could become a solved problem. It would be a credential that could be accessed via existing paper based systems. Places like Google allowing it as a sign in method would actually solve this case. Sadly I think the tech world in general is so allergic to losing privacy that even something optional like this would get lobbied out of existence just by tech companies alone.
  • zie 4y ago
    login.gov exists. It's not mandated, nor does it currently allow non-government users(last I checked), but otherwise it generally solves the technical problems fine.
    • dtertman 4y ago
      It's used to manage your Global Entry membership.
    • jackson1442 4y ago
      You can sign-in as a non-government user (though they also have CAC support for federal govt users). There's built-in document/identity proofing as well but there are some extra requirements to get that enabled on an application. You do need to be working with the government to integrate with Login.gov though (but it's just OIDC on the backend)
    • antgiant 4y ago
      That is perfect! Just need it to be opened up a little so that places like Google can enable it as a Lyn optional primary login.
• thadt 4y ago
  All the anger toward Google misses the larger point – this isn’t only Google's problem. If I get locked out of my Apple account, or my Amazon account, or my <insert online service here> account, how do I prove that I am me? A password? I’m glad your memory is much better than mine, because I'm terrible at remembering 1000 passwords that aren’t trivially cracked. Use a password manager? Oh yeah! I do, thanks. On my computer and phone along with... my 2FAs. What I need is a way to get into my personal accounts when I find myself naked and alone on the street (don’t judge, you don’t know how I got there). And the only way to do that is to be able to physically present myself at some place and have them verify my identity, allowing me access to my digital life again – and hopefully let me to call my wife to being me some clothes. Basic identity verification is the type of function that everyone will need at some point as a common public service. The kind I would expect a government to provide.
  • Edman274 4y ago
    The specific anger towards Google comes from the fact that they're an overwhelmingly popular email provider, and email is what a lot of paperless processes (including account resets) assume the existence of. If you get locked out of Amazon, or Facebook, or Instagram, or TikTok, or Reddit, or Twitter, or Netflix, you won't lose the ability to receive welfare benefits, or tax information, or rent / utility bills, or statements from your bank, or whatever. Everyone takes for granted that you have an email address that you can receive statements at, and that you'll use email as the central hub of communication, and sometimes the communication is legally mandated. Also, it's considered sufficient for all those non-google tech services to just use your email address to get you back into their system. Netflix can send you an email. Facebook can send you an email. Twitter can send you an email. Netflix can send one, too. Gmail can't send you an email to authenticate you. You can never use email to get access to email. Using a Gmail account to try to unlock a Gmail account is an absurdity, like Baron Munchausen pulling himself out of a swamp by his own hair. You can use a cell phone to unlock email, but cell phone service will always cost money, and phones can be lost, broken, stolen, or sold for emergency funds. No library anywhere provides access to phones that make texts, and even if they did it wouldn't work because they'd be shared by people which would make them unsuitable for identification. That's the reason for the focus. Fixing Gmail sort of "does the heavy lifting" for all the other services that need to get you to prove that you're you.
• lifeisstillgood 4y ago
  This is not really Google's "fault". (trust me I'm not a fan of their cavalier attitudes to beta services and lack of customer support) They are working "in the future" where every human has access to the virtual world by "right". You cannot cut off someone's gas or phone without huge regulatory hurdles. And we will see something similar for access to internet We just aren't there. And that's the problem. And this conversation should not be about "google should reduce its security" it should be about how do we regulate ISPs and google and facebook and Email providers so that they are on par with the gas company? Is access to http a basic utility? Access to an email inbox? In short Internet access is a necessity for access to civil society, and now we work out who pays for it. it's going to be a fun decade
  • lifeisstillgood 4y ago
    I think at some point we will move to something like a drivers license for the Internet - a government backed assertion that you are person X. A photo ID, a hash of that .png and meta data against a key pair (ie the key pair assigned to the person behind the desk at the DVLA) I am guessing this is what a bunch of companies offering the "photo of you and your id" services are waiting for. Which to me implies it should never be a proprietary solution - anyone know of a FOSS version of this out there? Anyone want to start one ?
• lofatdairy 4y ago
  Would it be possible for libraries to provide email addresses through their own mail servers? Certainly Google has an enormous number of issues, but I can't see them weighing in favor of the elderly and less fortunate over the high profile users whose accounts are constantly targeted. I also have doubts that any bypass solution would succeed due to necessarily requiring users to both know their existence and properly set them up; not everyone has technical competence nor the experience to know for which resources to seek.
  • Miraste 4y ago
    Yes, and Google will immediately blacklist those mail servers for being small just like they do with everyone else.
• spicymaki 4y ago
  I am reminded of this every time I support an elderly person. Us techies are just not equipped to deal with the needs of everyday people. I used to get upset with them due to their lack of competence, but now I just feel embarrassed at how Kafkaesque all of this just is.
• m348e912 4y ago
  I don't particularly love gmail and I'm personally trying to switch to fastmail over time, however I am on google's side this time around. There are reasonable approaches that can address this librarian's concern. Backup codes, backing up the MFA seed. She talks about patrons having cell service shutoff, but that doesn't affect google authenticator. There are good reasons why google went to an MFA only model and yes there are some downsides, but they're not unmanageable.
  • blackboxlogic 4y ago
    MFA is a great option to provide, and I would even suggest it should be default on, but what's the harm in allowing the user to opt out of MFA? If available, it seems to me it would be the best option for this demographic.
    • zie 4y ago
      At least one reason: cyber-security insurance policies are starting to mandate MFA, because they are tired of paying out on insurance claims.
• emjoes1 4y ago
  Rich and poor (young and old) have this in common. Most people I work with are college educated and utterly fail when it comes to managing passwords or multi-factor auth.
• emjoes1 4y ago
  Rich and poor, young and old, have this in common. I know many college educated and affluent people that can't manage passwords or multi-factor authentication. Oh and don't ask them to save recovery codes because they will put them in highly insecure places... and then forget where they put them.
• kwhitefoot 4y ago
  That was heartbreaking. Surely this problem is of a scale that warrants government action?
• SamuelAdams 4y ago
  First, needs a (2021) in the title, the body references “Today, July 19, 2021”. Second, while Gmail is popular, they are not the only contenders in the space. Can these users not also have an outlook, AOL, or yahoo email address? I understand switching email providers is not an easy thing, but it is not impossible.
  • deleted 4y ago
    [deleted]
• BrainVirus 4y ago
  The insistence that mandatory phone-based 2FA is for your security is a lie. For large companies it's all about tracking: https://odysee.com/@RobBraxmanTech:6/twitter-2fa:d https://odysee.com/@RobBraxmanTech:6/twitter-2fa:d
• schaefer 4y ago
  I had a gmail lockout scare recently for my custom domain. And I deeply want to change providers. google is currently both my e-mail provider and my domain registrar. The only thing holding me back is I have a custom domain, I'm not specialized in the web, and it's not super intuitive how to set up my hosting with one company, name registration with another, and e-mail with a third. All for the same custom domain.
  • unixhero 4y ago
    Get a brick and mortar Internet shop to help you
• sneak 4y ago
  This letter seems to assume that Gmail is the only email provider. If you think Gmail is bad, stop using it. They aren't the only game in town.
• bastardoperator 4y ago
  My mother is 70 years old and recently had a stroke. Every week we're dealing with password issues which are mostly Google related. The good news is I've been able to switch most of her stuff over to Apple based tools and that's helped significantly, but getting over the hump of new technology was a pretty big hurdle, and costly to me in terms of time and money. My mom is in the same situation, and I shudder to think how she would navigate this without help from her family. Not everyone is as fortunate as my mom is, but what this librarian is describing really touched a nerve because I know if it's happening to my mom, a former Sun Microsystems employee, I know it can happen to anyone.
• mensetmanusman 4y ago
  My good friend recently had a heart attack and tried to login to his Google account at the hospital but was interrupted. Google consider this flagged as a suspicious fake account and he was never allowed back in to his email.
• ineptech 4y ago
  We need a Federal Dept of SSO. There is one (1) foolproof way to tell someone is who they say they are, and it involves opening and staffing a real brick-and-mortar office in every town in America. No tech company will ever do that, and the government already has.
• drewrem11 4y ago
  Librarian has updated the document to say this issue was resolved and overblown: STOP EMAILING ME AND CALLING THE LIBRARY ABOUT THIS This was shared without my permission. This was not supposed to be public. It was meant to be shared internally to Google. It was not an open letter. It went directly to the security team and we had a conversation about it and it’s over. This is from well over a year ago and we no longer are having this issue as often as before due to various improvements. Please delete this from HN. You are essentially DDOS’ing my work email and the library branch phone number making it very difficult for us to perform our duties as civil servants today. I do not know how this made it onto HN. Someone must have leaked it. If they need to work that out internally then I’m leaving this here for their reference. But I do not want news reporters or random HN readers contacting me or the Free Library over this.
  • cinntaile 4y ago
    Flag the submission.
  • deleted 4y ago
    [deleted]
  • omoikane 4y ago
    I wish mods would pin this comment.
• _zfxr 4y ago
  !!! PSA : I emailed the author of this this morning while on the toilet and got an email back thanking me for my kind words, but ALSO made it very clear that this was meant to be PRIVATE communications between her and Google, and that it was never meant to be posted here or elsewhere, ESPECIALLY with her private contact information exposed and she has very politely asked that people stop sharing this with her PRIVATE INFORMATION for all to see. She said all the incoming communications are essentially DDOSsing her servers at work and make it hard to do her job. Idk if mods or anyone wants to do anything about that, but yeah we have a case of someone being doxxed here, and even without malicious intent - its causing her issues in her day to day life.
  • deleted 4y ago
    [deleted]
• balentio 4y ago
  She's correct, but Etsy is also doing similar stuff.
• eternalban 4y ago
  "Please delete this from HN. You are essentially DDOS’ing my work email and the library branch phone number making it very difficult for us to perform our duties as civil servants today." @dang
• dijonman2 4y ago
  Posted on the page now: > Please delete this from HN. You are essentially DDOS’ing my work email and the library branch phone number making it very difficult for us to perform our duties as civil servants today.
• alsetmusic 4y ago
  New heading on the doc. Please don’t try to contact the author. Quoting: STOP EMAILING ME AND CALLING THE LIBRARY ABOUT THIS This was shared without my permission. This was not supposed to be public. It was meant to be shared internally to Google. It was not an open letter. It went directly to the security team and we had a conversation about it and it’s over. This is from well over a year ago and we no longer are having this issue as often as before due to various improvements. Please delete this from HN. You are essentially DDOS’ing my work email and the library branch phone number making it very difficult for us to perform our duties as civil servants today. I do not know how this made it onto HN. Someone must have leaked it. If they need to work that out internally then I’m leaving this here for their reference. But I do not want news reporters or random HN readers contacting me or the Free Library over this.
  • deleted 4y ago
    [deleted]
• KennyBlanken 4y ago
  @dang why is this still up and on the front page (you can at least suppress the story to the second page..)? It's clear the document was shared without her permission and she's being harassed by HN and press: > STOP EMAILING ME AND CALLING THE LIBRARY ABOUT THIS > This was shared without my permission. This was not supposed to be public. It was meant to be shared internally to Google. It was not an open letter. It went directly to the security team and we had a conversation about it and it’s over. This is from well over a year ago and we no longer are having this issue as often as before due to various improvements. > Please delete this from HN. You are essentially DDOS’ing my work email and the library branch phone number making it very difficult for us to perform our duties as civil servants today.
  • ericpruitt 4y ago
    > @dang why is this still up and on the front page (you can at least suppress the story to the second page..)? It's clear the document was shared without her permission and she's being harassed by HN and press: That was added well after the document was posted to Hacker News, so I don't think this is a fair question. Also, I'm sure dang has a life outside of Hacker News, so I don't think it's reasonable to expect everything to be acted upon immediately.
• nickdothutton 4y ago
  This isn’t a terribly helpful comment, but it’s a great reason not to use gmail. I wonder what the market size would be for “silver mail”, a service for the old.
• jeffwask 4y ago
  There is a lot of valuable information in this letter my privilege would have blinded me to.
• WaffleIronMaker 4y ago
  It looks like the author is requesting this link be removed from HN: > STOP EMAILING ME AND CALLING THE LIBRARY ABOUT THIS > This was shared without my permission. This was not supposed to be public. It was meant to be shared internally to Google. > ...
  • avree 4y ago
    Yes, this one is a bit of a grey area and I'd love to hear dang's opinion on it, but personally based off the user's EDIT I have used my "flag" on this post.
    • pvg 4y ago
      You don't really need dang's opinion to flag unclearly-sourced outrage stories. There are much better places for them to be verified. It's a good idea to do that well before they potentially affect someone badly.
  • deleted 4y ago
    [deleted]
• mdavis6890 4y ago
  "Today I decided I would try to change Google." The best part for me is "try to" rather than the much more common and nonsensical "try and" that I see all the time. I think I would pay for a Chrome extension to automatically replace all occurrences of "try and" with "try to." It takes a librarian... Also, thanks for changing Google for the better, and helping those who need help the most!
  • Aulig 4y ago
    It bothers me too because the more I read it, the more it gets burnt into my brain leading me to make the mistake myself. Side note: she did unfortunately use "try and" once.
  • jwilk 4y ago
    https://www.merriam-webster.com/words-at-play/were-going-to-explain-the-deal-with-try-and-and-try-to https://www.merriam-webster.com/words-at-play/were-going-to-...
• mbar84 4y ago
  None of this is related to technology and the best Google could do is expend resources on education. For tech illiterate, maybe the least bad option is that their security is that they won't lose their wallet. I think this is one of those situations where security has to take a back seat to usability. 1. Create a passphrase with this method: https://xkcd.com/936/ https://xkcd.com/936/ 2. Write down your passphrase. 3. Write down recovery codes, and keep them in your wallet. Also: Tips to make sure you never lose your wallet.
• nabakin 4y ago
  @dang could you explain why this post is getting down ranked so hard? It's been 6 hours and I could only find this post by using the search function. We have a ~800 point post from 2 days ago and it's still on the second page Edit: it's either back on the frontpage now or I missed it somehow Edit 2: Looks like the doc was updated and it was posted without consent. I think we should delete the post now.
  • bee_rider 4y ago
    Have you read it? The author would like this post not to be shared. The situation has improved and they are getting more disruption than help from public attention at this point.
    • nabakin 4y ago
      I did read it, it's been updated since I read it. Thanks for letting me know
• syrrim 4y ago
  This can be solved unilaterally by the library system, with no extra action by google. I would furthermore argue that it should be solved by the library, rather than by google, as the library has the ability to solve this problem more completely. As a brief introduction, the goal of computer security is generally to make a computer as secure as a door lock. A door lock can be easily broken into, but to do so requires that a person show up to the door in person, and to take some illegal action. A computer, if secured naively, is much less secure than that: if I gain access to the password, I can hack a computer from anywhere in the world. Furthermore, since I have the password, it isn't even clear that I am breaking any rules. The library system can solve the problem described in the letter while maintaining door-lock level security in the following way: they would give to every library system user a library card, associated with their person. This card would be used to log in to library computers. Certain information would be preserved between logins, namely the browser cookies. Thus, the user would remain logged in to their google account as long as they had access to their library card. If they lost the card, or forget the password, the library would be able to reset the password, or issue a new card, as long as the user could prove they were the owner of the card to the satisfaction of the library employee. Google, being an internet company, cannot reasonably issue cards to all their users, but libraries regularly do so. For the same reason, Google has difficulty verifying the identity of their users, which libraries can do easily. Google is structured as a profit seeking corporation, and would need to justify charitable behaviour to shareholders. Libraries are well known to exist to provide services for free to their users, and can easily alter their operations to do so differently. Most importantly, libraries already provision physical access to computers. The most important element of our door-lock security model is that a person must appear in person in order to get around our security. The library is the organization operating the physical terminals, and so the library alone can provide this essential element of our security model.
  • hansel_der 4y ago
    nope
• branon 4y ago
  "It must be possible to [...] contact customer support" I'll stop you right there. While I feel for the folks affected by this, they're not customers. And there ain't no such thing as a free lunch. Broadband access and an email inbox aren't human rights in the US - even if they should be, we're just not there yet. And Google has no business incentive to provide customer support to the freeloaders. I think it's crappy that there's no recourse too. But like it or not, users assent to this when they sign up. The solution here is education - people need to be told outright that they have significantly reduced chances of recourse when they're using somebody's service for free. Society seems to have abetted the notion that all citizens will have Gmail accounts, down to the issue of Chromebooks in elementary schools. What exactly are we teaching people by dropping them off inside these gardens to bang on the walls? It goes further than Google or Gmail. We need processes that make actual sense. "But the government forms I need to fill out are online-only!" First mistake. Whoever signed off on that in government should be fired immediately. This isn't a Google problem, despite how easy it may seem to blame the faceless boogeyman. It's an education problem, a process problem, and a common-sense problem.
• bloppe 4y ago
  Great letter. Sorry about the unwanted publicity :/ Lots of people seem to want Google to be forced to provide customer service. It's an interesting idea, but I'd imagine it would be the end of free Gmail which may just force the very same people who can't afford permanent phones to switch to an even sketchier, unregulated free email service. Either that or the government would have to somehow provide free email, and I think there's actually a strong argument to be made there if an email address is required for welfare / parole / other government processes.
• lazyeye 4y ago
  This is not Google's concern. I recommend subscribing to "Talks at Google" on Youtube to see the kind of things that occupies the minds of people working at Google.
• GaryNumanVevo 4y ago
  @dang maybe worth removing this post? > STOP EMAILING ME AND CALLING THE LIBRARY ABOUT THIS > This was shared without my permission. This was not supposed to be public. It was meant to be shared internally to Google. It was not an open letter. It went directly to the security team and we had a conversation about it and it’s over. This is from well over a year ago and we no longer are having this issue as often as before due to various improvements. > Please delete this from HN. You are essentially DDOS’ing my work email and the library branch phone number making it very difficult for us to perform our duties as civil servants today. > I do not know how this made it onto HN. Someone must have leaked it. If they need to work that out internally then I’m leaving this here for their reference. But I do not want news reporters or random HN readers contacting me or the Free Library over this.
  • lostlogin 4y ago
    Posting a summary might be better. The discussion here is good and the points interesting.
• mixmastamyk 4y ago
  In addition to the folks mentioned, I'm no longer able to log into google accounts due them insisting on having a telephone number. Which I won't be giving. Wouldn't be surprised if they already knew it somehow. :-D
• rezna 4y ago
  You should not use gMail to access federal/state resources, but "state mail". Like DigiD in Netherlands, DataBox in Czech Republic. Both are state ran, associated with your identity. Lost password can be unlocked by going physically to office.
• 0xbadcafebee 4y ago
  The letter has now been updated today, please read: STOP EMAILING ME AND CALLING THE LIBRARY ABOUT THIS This was shared without my permission. This was not supposed to be public. It was meant to be shared internally to Google. It was not an open letter. It went directly to the security team and we had a conversation about it and it’s over. This is from well over a year ago and we no longer are having this issue as often as before due to various improvements. Please delete this from HN. You are essentially DDOS’ing my work email and the library branch phone number making it very difficult for us to perform our duties as civil servants today. I do not know how this made it onto HN. Someone must have leaked it. If they need to work that out internally then I’m leaving this here for their reference. But I do not want news reporters or random HN readers contacting me or the Free Library over this. If you want to learn more about patron privacy and support librarians advocating for patron privacy and against big tech please check out https://libraryfreedom.org/ which is a wonderful organization I am a part of that does work like this. I still firmly believe in and stand by everything that I wrote. But this particular action was not meant to be a public letter and it’s interfering with my ability to do other work. You’re welcome to read this, now redacted, letter, just please stop emailing me and sharing it around.
• winwiz 4y ago
  The library customers can install app called "Google Authenticator" provided they own a smartphone. It works without network connectivity. Just use the app to scan QR code when creating a Gmail account. Or do it anytime later. Then never use network connectivity to generate the 6-digit 2FA code.
• netanbing 4y ago
  [Edited] Removed a link to respect library's privacy
  • LanternLight83 4y ago
    As of your comment, the letter says that they're being essentially DDOS'ed over an issue that was resolved a long time ago and to very specifically NOT ask them anything; posting this link isn't moral and I think you should edit it out.
    • netanbing 4y ago
      Thank you for bringing this to my attention. Just read the disclaimer and removed the link.
• garfieldnate 4y ago
  Even owning a phone, I really hate phone-based 2FA. What happens if I lose my phone? I've lived in foreign countries for almost my entire adult life, and no phone number is permanent. When I move, I need a new phone. My Indian friends tell me it's much worse there. All of their government services are tied to a specific phone number that they must keep forever. So all of the ex-pats living here still pay for their Indian phone number back home so that they can still interact with the government when they need to.
• kazinator 4y ago
  > There doesn’t seem to be any warning given that if they fail too many times they may permanently lose access to their account. That can't actually be a thing, because it would allow a malicious person to lock out anyone's account if they just know their gmail address. Not even Google could be that stupid.