3 ms·

The best solution I can think of that doesn't compromise security is hardware keys. GMail has very good FIDO support. The keys are easier to use than TOTP and v

The best solution I can think of that doesn't compromise security is hardware keys. GMail has very good FIDO support. The keys are easier to use than TOTP and vastly more secure than SMS. They do not depend on any phone or phone service, and there is no transferring necessary at any time. The librarian would just need to get the person logged in successfully one time, get the key attached to the person's account, and get the key onto the person's physical keychain. The librarian would also print out the backup codes, laminate them, and put them in the person's wallet. Once that's done, this particular library patron should have few authentication issues going forward. Assuming lots of repeat clientele, the auth night mare will largely end once everyone is setup. Yeah, the key and codes might get lost, broken, or stolen, but that's the best you can do. If the person lost their actual keys and wallet, they've got bigger problems. The question really is who is going to pay for these keys? They're a lot cheaper than phones at least, but not cheap enough.

BlueTemplar 4y ago
The government should, *especially* if they are requiring mandatory access (though this should be illegal anyway). But this isn't going to solve the issue of Google being too far gone (too big) to be worth saving : just shut them down.
eddieroger 4y ago
Reading this comment, I thought Yubikeys, which aren't /expensive/, but aren't cheap either. I was pleased to see they have a key targeted at this specific use case now - the Security Key Series [0]. At $25, that is not too bad a price, and something I'd buy for the members of my family without much hesitation. The hangup with this, which I think the librarian in question will feel, is what happens when someone loses their key? How can I set up a trust relationship that my local librarian can reset my grandma's Yubikey, but a bad actor can't? And, $25 isn't so bad once, but if we have to replace it every month, that's less fun. Maybe that's just agreeing with you and lamenting the state of things, but maybe someone will read this and think $25 isn't so bad and write a grant to pilot this program. 0. https://www.yubico.com/store/#for-individuals https://www.yubico.com/store/#for-individuals
- lynndotpy 4y ago
  I believe you can set up multiple keys. In this manner, a librarian could keep a "master key." This compromises security somewhat, since the library houses one of the second factors, but IMO it's preferable to total account lockout (and still superior to SMS verification).
  - laweijfmvo 4y ago
    if you’re using someone else’s computer, or a computer at a library, you have no security. TLS isn’t enough to be certain they haven’t intercepted the connection, installed their own root certs, or whatever else. I can’t think of any method to securely use someone else’s computer and connection unless you bring a live boot Linux USB or something, which I doubt applies to the intended audience here. Sure, having a physical key makes it easy for a non-technical librarian to steal someone’s identity, but perhaps having some kind of yubikey safe deposit box would be an appropriate compromise.
    - vxNsr 4y ago
      Also consider that the yubikey is only the 2nd factor, the user still needs to enter the password. Obviously password resets are possible but might be a bit more of tip off to the user.
- dereg 4y ago
  I wouldn't feel confident assuming that the homeless can feel secure in retaining their yubikeys from theft. The optimal solution would probably be some sort of multisig solution where a trusted party like a librarian and maybe a person's parole/benefits/welfare/etc officer hold on to keys.
phpisthebest 4y ago
>>The keys are easier to use than TOTP This has not been my experience, even for more knowledgeable people let alone normal users. >> this particular library patron should have few authentication issues going forward Until they lose or break the physical key, which will happen more often than losing or breaking their phone with the TOTP
highwaylights 4y ago
Hardware keys work well in place of a phone, and are in some ways significantly more secure depending on how U2F is implemented. Some of the problem remains: If the user forgets their password the second factor won’t help them, and that includes the backup keys. I’ve read the letter, and I see the massive problem, but I don’t think it’s been fully solved yet. Q: “How do we remotely authenticate a single user, in a way that cannot be forged, without relying on their memory?” There are solutions to every part of that sentence, but I do not know of one that solves it entirely. They could write their password down, but then they’re exposing themselves to the obvious risk of it being stolen. You could trust the librarian in a 2-of-3 system, but this seems very easy to abuse by the library staff. Genuinely not sure of how this is solved. A cryptographically-strong biometric key store at the library (e.g. finger-print or face scanner) that will only authenticate a physically present user and release a FIDO signature that could then be used in a multisig authentication?
- jacamera 4y ago
  Ctrl + F => "bio" and this comment was the only result out of 100+. Surprising! I think biometrics sounds like the best solution. YubiKeys will get lost/damaged/stolen and then you're back to square one. With biometrics you shift the burden of paying for and managing hardware onto the library and individual users don't need to be responsible for anything. Of course this doesn't solve the issue of the user who is already locked out, but librarians could at least proactively enroll users who have access to their account in order to prevent the issue from happening in the future.
lol768 4y ago
TFA mentions YubiKeys, and acknowledges that they would work, but that the barrier is paying for 450k of them.
tazjin 4y ago
> If the person lost their actual keys and wallet, they've got bigger problems Do they? Typically for those sorts of things you have recovery options. Your landlord will be able to get you a new key, your bank can issue you a new card. Looking through my wallet, the only thing that would have a significant hurdle to replacing it is my Egyptian residence permit (I'd have to travel to Egypt to re-issue it). The only significant "loss" would be my current monthly public transport ticket, but if I can produce some kind of payment proof and am willing to argue with metro staff I might even be able to get that replaced. Point being, there is a lot of recourse for offline things, but if you get into this situation with a tech company - there is none. I have a lost 10+ year old Gmail account and I could not regain access to it through any means even while working as an SRE at Google.
- dxdm 4y ago
  > Looking through my wallet, the only thing that would have a significant hurdle to replacing it is my Egyptian residence permit Maybe don't carry that in your wallet if you don't need it where you are and it's so hard to replace. :)
  - tazjin 4y ago
    You're absolutely right, I also realised that while going through stuff :) It's going to stay home tomorrow! It's one of those things you just kinda forget about when you don't need them for a while ...
cortesoft 4y ago
The unhoused are much more likely to be robbed of their possessions than others. They don't have anywhere secure to store things.

BlueTemplar 4y ago

The government should, *especially* if they are requiring mandatory access (though this should be illegal anyway). But this isn't going to solve the issue of Google being too far gone (too big) to be worth saving : just shut them down.

eddieroger 4y ago

Reading this comment, I thought Yubikeys, which aren't /expensive/, but aren't cheap either. I was pleased to see they have a key targeted at this specific use case now - the Security Key Series [0]. At $25, that is not too bad a price, and something I'd buy for the members of my family without much hesitation. The hangup with this, which I think the librarian in question will feel, is what happens when someone loses their key? How can I set up a trust relationship that my local librarian can reset my grandma's Yubikey, but a bad actor can't? And, $25 isn't so bad once, but if we have to replace it every month, that's less fun. Maybe that's just agreeing with you and lamenting the state of things, but maybe someone will read this and think $25 isn't so bad and write a grant to pilot this program. 0. https://www.yubico.com/store/#for-individuals https://www.yubico.com/store/#for-individuals

lynndotpy 4y ago
I believe you can set up multiple keys. In this manner, a librarian could keep a "master key." This compromises security somewhat, since the library houses one of the second factors, but IMO it's preferable to total account lockout (and still superior to SMS verification).
- laweijfmvo 4y ago
  if you’re using someone else’s computer, or a computer at a library, you have no security. TLS isn’t enough to be certain they haven’t intercepted the connection, installed their own root certs, or whatever else. I can’t think of any method to securely use someone else’s computer and connection unless you bring a live boot Linux USB or something, which I doubt applies to the intended audience here. Sure, having a physical key makes it easy for a non-technical librarian to steal someone’s identity, but perhaps having some kind of yubikey safe deposit box would be an appropriate compromise.
  - vxNsr 4y ago
    Also consider that the yubikey is only the 2nd factor, the user still needs to enter the password. Obviously password resets are possible but might be a bit more of tip off to the user.
dereg 4y ago
I wouldn't feel confident assuming that the homeless can feel secure in retaining their yubikeys from theft. The optimal solution would probably be some sort of multisig solution where a trusted party like a librarian and maybe a person's parole/benefits/welfare/etc officer hold on to keys.

phpisthebest 4y ago

>>The keys are easier to use than TOTP This has not been my experience, even for more knowledgeable people let alone normal users. >> this particular library patron should have few authentication issues going forward Until they lose or break the physical key, which will happen more often than losing or breaking their phone with the TOTP

highwaylights 4y ago

Hardware keys work well in place of a phone, and are in some ways significantly more secure depending on how U2F is implemented. Some of the problem remains: If the user forgets their password the second factor won’t help them, and that includes the backup keys. I’ve read the letter, and I see the massive problem, but I don’t think it’s been fully solved yet. Q: “How do we remotely authenticate a single user, in a way that cannot be forged, without relying on their memory?” There are solutions to every part of that sentence, but I do not know of one that solves it entirely. They could write their password down, but then they’re exposing themselves to the obvious risk of it being stolen. You could trust the librarian in a 2-of-3 system, but this seems very easy to abuse by the library staff. Genuinely not sure of how this is solved. A cryptographically-strong biometric key store at the library (e.g. finger-print or face scanner) that will only authenticate a physically present user and release a FIDO signature that could then be used in a multisig authentication?

jacamera 4y ago
Ctrl + F => "bio" and this comment was the only result out of 100+. Surprising! I think biometrics sounds like the best solution. YubiKeys will get lost/damaged/stolen and then you're back to square one. With biometrics you shift the burden of paying for and managing hardware onto the library and individual users don't need to be responsible for anything. Of course this doesn't solve the issue of the user who is already locked out, but librarians could at least proactively enroll users who have access to their account in order to prevent the issue from happening in the future.

lol768 4y ago

TFA mentions YubiKeys, and acknowledges that they would work, but that the barrier is paying for 450k of them.

tazjin 4y ago

> If the person lost their actual keys and wallet, they've got bigger problems Do they? Typically for those sorts of things you have recovery options. Your landlord will be able to get you a new key, your bank can issue you a new card. Looking through my wallet, the only thing that would have a significant hurdle to replacing it is my Egyptian residence permit (I'd have to travel to Egypt to re-issue it). The only significant "loss" would be my current monthly public transport ticket, but if I can produce some kind of payment proof and am willing to argue with metro staff I might even be able to get that replaced. Point being, there is a lot of recourse for offline things, but if you get into this situation with a tech company - there is none. I have a lost 10+ year old Gmail account and I could not regain access to it through any means even while working as an SRE at Google.

dxdm 4y ago
> Looking through my wallet, the only thing that would have a significant hurdle to replacing it is my Egyptian residence permit Maybe don't carry that in your wallet if you don't need it where you are and it's so hard to replace. :)
- tazjin 4y ago
  You're absolutely right, I also realised that while going through stuff :) It's going to stay home tomorrow! It's one of those things you just kinda forget about when you don't need them for a while ...

cortesoft 4y ago

The unhoused are much more likely to be robbed of their possessions than others. They don't have anywhere secure to store things.