5 ms·

I fully sympathize with the librarian's concerns, but there's this: "Many government welfare forms, housing applications, and jobs applications these days requ

I fully sympathize with the librarian's concerns, but there's this: "Many government welfare forms, housing applications, and jobs applications these days require the use of the internet exclusively with no option to fill things out in person." Why is this? Really, this does not seem like a problem Google caused, but rather a problem caused by the government when they made it mandatory to have internet access to get the benefits they should get. Would they have made it mandatory to call them on the phone, back when phone access was not yet universal? If they had, would AT&T have been at fault? The government caused this problem. I'm all in favor of finding a non-government solution (charity sponsored by HN people to get people Yubikey or equivalent, maybe). But this is not really a problem caused by Google, and if these people were having their benefits scammed away from them because their email accounts were hacked, people would be excoriating them for not instituting 2FA.

hugh-avherald 4y ago
It's cheaper.
nfriedly 4y ago
You're right, that online-only access is definately a government problem. But this: > Even when we clicked “I don’t have my phone” it asked her to open the Google app from the phone that she does not have. That's a google problem. Google fixing their problem would lessen the impact of the government problem. (And, more generally, make gmail a better service for lots of people.)
- jeffbee 4y ago
  Well, you can see the problem, right? Allowing attackers to bypass 2FA just by saying their phone is lost makes 2FA worthless.
  - nfriedly 4y ago
    Yeah.. but an "I don't have my phone" button that just tells people to use their phone is equally worthless. I don't know what the right answer is, but that certainly isn't it.
- wjko21 4y ago
  but what would Google do, how is it possible to fix? What's the point of having 2FA using the phone if you can bypass it by clicking "i don't have my phone"?
  - Miraste 4y ago
    The "I don't have my phone" button only showing options that require a phone is a Catch-22 nightmare. They should remove that workflow, which is effectively just mocking the user, and instead emphasize recovery codes much more. These are free and would solve many of the problems in this letter, if only people knew and were heavily pushed to print them beforehand.
  - tuetuopay 4y ago
    well what every other service relying on OTP or YubiKey for 2FA (not that SMS bullcrap) has ever did: recovery codes you write down somewhere. it can even be as simple as writing them down on the library card carried in the wallet.
  - TrapLord_Rhodo 4y ago
    When i lost my phone and was locked out of 2fa, most services required a picture of me, with my ID, my face and a letter showing the date all in the same picture. This seemed pretty effective to me.
    - mattnewton 4y ago
      Google doesn’t have a picture of me linked to my gmail account, so this would require as much planning as printing 2fa backup codes right?
      - jeremyjh 4y ago
        They would use photo ID the same way everyone else does. Compare the photo on the ID to the picture the person provides; which is why it needs todays date in the photo.
hedora 4y ago
What does this have to do with not having an account recovery flow? Many government offices have temporarily(?) gone online-only for covid.
- deleted 4y ago
  [deleted]
Jerrrry 4y ago
This is flat out incorrect. All _government _forms have paper-equivalents for accessibility reasons, and OMB numbers that coincide. The Paperwork reduction act is a thing, but it also stipulates that within reason, paper forms must be available.
- kristjansson 4y ago
  Federal, yes, but also the state and municipal governments that manage services relevant to the internet-in-the-library population?
0xbadcafebee 4y ago
> Really, this does not seem like a problem Google caused, The problem is 2FA. 2FA causes people to get locked out of their accounts. Google mail requires 2FA, the government does not. If Google turns off 2FA requirement, the problem in the letter goes away. But they won't. Google is the cause of the problem, and can easily solve it.
- rossdavidh 4y ago
  Google didn't introduce 2FA for no reason. While Google does lots of things for reasons I don't like, 2FA was most definitely introduced for valid reasons, which could easily result in a problem as bad (or worse) than the one the librarian is discussing. The IRS recently had a problem with people using their online access tools to get other people's refund. Insufficient security on authentication can easily be as bad or worse than 2FA.
  - deleted 4y ago
    [deleted]
unixbane 4y ago
Google is still a huge part of the problem for requiring all kinds of acrobatics to log into their service which you are forced to use due to the fact that it's one of the only free email providers, the fact that email is pointlessly required to use most websites, and the fact that a huge amount of websites only allow gmail and a few other hosts (yes, there are also other stupid websites that go the other way around and block gmail, yahoo, etc). Government is at fault for not using their billions of dollars to create a simple _modern_ protocol to transfer information. Using web for banking or tax purposes should be illegal just as it would be to use a kids toy radio in the military.
- happyopossum 4y ago
  > a huge amount of websites only allow gmail and a few other hosts Is that actually true? I’ve never seen a single site that didn’t allow me to log in with a ‘regular’ email address, even if they pushed Log in with Google first
  - unixbane 4y ago
    Lots of sites have whitelists of email domains.
humanistbot 4y ago
> The government caused this problem. It isn't just government forms, it is also private companies, employers, landlords, and even out-of-touch charities that are run by people who are used to having 24/7 access to reliable internet.
thenoblesunfish 4y ago
I agree - this is a really bad situation for people, and I'm glad that she's publicizing the issue, but it might be that a free email service from a corporation isn't ever going to serve as a robust enough way to provide essential government services to people. In a perfect (ly funded) world, people might be better served by email accounts from the post office, or even the library.
bee_rider 4y ago
One of the issues they mention is that that a person needed paystubs to send in to the government as documentation for their subsidized housing. Even if the government has nice paper options as a backup (around here they usually do, at least) the person will still need to get into their email. Google didn't create the problem, but unfortunately an eMail address has become a centralized point of communication for lots of things. We probably need some sort of state-sponsored digital inbox for these kinds of documents. The thing that makes Google useful -- that it is a "reasonably" secure location to stash documents -- also makes it really easy to get locked out. There are recovery options, but it isn't obvious how a system could be secure while still allowing recovery for a user who elects to not set any recovery options up. Perhaps the government could do a better job (at least they have things like social security cards and birth certificates, and have been dealing with the last resort case where these aren't available for longer than any of us have been alive). They also aren't constrained by things like a need to make a profit, and they don't even really need us to be able to communicate out from this inbox, it could be just a one-way channel for the reception of documents, which would avoid some annoying issues ala people using their gmails to harass others.
unixbane 4y ago
> The government caused this problem. The HN community caused this problem. I precisely remember about 10 years ago on HN I'd see obnoxious articles with thousands of upvotes hyping crap like "we disrupted the goverment" and "we saved a lot of paper by providing a webshit interface to government institutes" and "we replaced non-working COBOL crap with new JS crap it's so much better". And of course they followed suit with "security best practices" such as having a hidden security policy (that an attacker can easily find out) and "advanced risk model", which is something 99% of websites get wrong despite that they all regurgitate the standard "we have a complex risk model, you do not know what you're talking about". What we have now is absolutely, literally what my expected outcome was for this movement, at the time, 10 years ago.

hugh-avherald 4y ago

It's cheaper.

nfriedly 4y ago

You're right, that online-only access is definately a government problem. But this: > Even when we clicked “I don’t have my phone” it asked her to open the Google app from the phone that she does not have. That's a google problem. Google fixing their problem would lessen the impact of the government problem. (And, more generally, make gmail a better service for lots of people.)

jeffbee 4y ago
Well, you can see the problem, right? Allowing attackers to bypass 2FA just by saying their phone is lost makes 2FA worthless.
- nfriedly 4y ago
  Yeah.. but an "I don't have my phone" button that just tells people to use their phone is equally worthless. I don't know what the right answer is, but that certainly isn't it.
wjko21 4y ago
but what would Google do, how is it possible to fix? What's the point of having 2FA using the phone if you can bypass it by clicking "i don't have my phone"?
- Miraste 4y ago
  The "I don't have my phone" button only showing options that require a phone is a Catch-22 nightmare. They should remove that workflow, which is effectively just mocking the user, and instead emphasize recovery codes much more. These are free and would solve many of the problems in this letter, if only people knew and were heavily pushed to print them beforehand.
- tuetuopay 4y ago
  well what every other service relying on OTP or YubiKey for 2FA (not that SMS bullcrap) has ever did: recovery codes you write down somewhere. it can even be as simple as writing them down on the library card carried in the wallet.
- TrapLord_Rhodo 4y ago
  When i lost my phone and was locked out of 2fa, most services required a picture of me, with my ID, my face and a letter showing the date all in the same picture. This seemed pretty effective to me.
  - mattnewton 4y ago
    Google doesn’t have a picture of me linked to my gmail account, so this would require as much planning as printing 2fa backup codes right?
    - jeremyjh 4y ago
      They would use photo ID the same way everyone else does. Compare the photo on the ID to the picture the person provides; which is why it needs todays date in the photo.

hedora 4y ago

What does this have to do with not having an account recovery flow? Many government offices have temporarily(?) gone online-only for covid.

deleted 4y ago
[deleted]

Jerrrry 4y ago

This is flat out incorrect. All _government _forms have paper-equivalents for accessibility reasons, and OMB numbers that coincide. The Paperwork reduction act is a thing, but it also stipulates that within reason, paper forms must be available.

kristjansson 4y ago
Federal, yes, but also the state and municipal governments that manage services relevant to the internet-in-the-library population?

0xbadcafebee 4y ago

> Really, this does not seem like a problem Google caused, The problem is 2FA. 2FA causes people to get locked out of their accounts. Google mail requires 2FA, the government does not. If Google turns off 2FA requirement, the problem in the letter goes away. But they won't. Google is the cause of the problem, and can easily solve it.

rossdavidh 4y ago
Google didn't introduce 2FA for no reason. While Google does lots of things for reasons I don't like, 2FA was most definitely introduced for valid reasons, which could easily result in a problem as bad (or worse) than the one the librarian is discussing. The IRS recently had a problem with people using their online access tools to get other people's refund. Insufficient security on authentication can easily be as bad or worse than 2FA.
- deleted 4y ago
  [deleted]

unixbane 4y ago

Google is still a huge part of the problem for requiring all kinds of acrobatics to log into their service which you are forced to use due to the fact that it's one of the only free email providers, the fact that email is pointlessly required to use most websites, and the fact that a huge amount of websites only allow gmail and a few other hosts (yes, there are also other stupid websites that go the other way around and block gmail, yahoo, etc). Government is at fault for not using their billions of dollars to create a simple _modern_ protocol to transfer information. Using web for banking or tax purposes should be illegal just as it would be to use a kids toy radio in the military.

happyopossum 4y ago
> a huge amount of websites only allow gmail and a few other hosts Is that actually true? I’ve never seen a single site that didn’t allow me to log in with a ‘regular’ email address, even if they pushed Log in with Google first
- unixbane 4y ago
  Lots of sites have whitelists of email domains.

humanistbot 4y ago

> The government caused this problem. It isn't just government forms, it is also private companies, employers, landlords, and even out-of-touch charities that are run by people who are used to having 24/7 access to reliable internet.

thenoblesunfish 4y ago

I agree - this is a really bad situation for people, and I'm glad that she's publicizing the issue, but it might be that a free email service from a corporation isn't ever going to serve as a robust enough way to provide essential government services to people. In a perfect (ly funded) world, people might be better served by email accounts from the post office, or even the library.

bee_rider 4y ago

One of the issues they mention is that that a person needed paystubs to send in to the government as documentation for their subsidized housing. Even if the government has nice paper options as a backup (around here they usually do, at least) the person will still need to get into their email. Google didn't create the problem, but unfortunately an eMail address has become a centralized point of communication for lots of things. We probably need some sort of state-sponsored digital inbox for these kinds of documents. The thing that makes Google useful -- that it is a "reasonably" secure location to stash documents -- also makes it really easy to get locked out. There are recovery options, but it isn't obvious how a system could be secure while still allowing recovery for a user who elects to not set any recovery options up. Perhaps the government could do a better job (at least they have things like social security cards and birth certificates, and have been dealing with the last resort case where these aren't available for longer than any of us have been alive). They also aren't constrained by things like a need to make a profit, and they don't even really need us to be able to communicate out from this inbox, it could be just a one-way channel for the reception of documents, which would avoid some annoying issues ala people using their gmails to harass others.

unixbane 4y ago

> The government caused this problem. The HN community caused this problem. I precisely remember about 10 years ago on HN I'd see obnoxious articles with thousands of upvotes hyping crap like "we disrupted the goverment" and "we saved a lot of paper by providing a webshit interface to government institutes" and "we replaced non-working COBOL crap with new JS crap it's so much better". And of course they followed suit with "security best practices" such as having a hidden security policy (that an attacker can easily find out) and "advanced risk model", which is something 99% of websites get wrong despite that they all regurgitate the standard "we have a complex risk model, you do not know what you're talking about". What we have now is absolutely, literally what my expected outcome was for this movement, at the time, 10 years ago.