35 ms·

The specific anger towards Google comes from the fact that they're an overwhelmingly popular email provider, and email is what a lot of paperless processes (in

The specific anger towards Google comes from the fact that they're an overwhelmingly popular email provider, and email is what a lot of paperless processes (including account resets) assume the existence of. If you get locked out of Amazon, or Facebook, or Instagram, or TikTok, or Reddit, or Twitter, or Netflix, you won't lose the ability to receive welfare benefits, or tax information, or rent / utility bills, or statements from your bank, or whatever. Everyone takes for granted that you have an email address that you can receive statements at, and that you'll use email as the central hub of communication, and sometimes the communication is legally mandated. Also, it's considered sufficient for all those non-google tech services to just use your email address to get you back into their system. Netflix can send you an email. Facebook can send you an email. Twitter can send you an email. Netflix can send one, too. Gmail can't send you an email to authenticate you. You can never use email to get access to email. Using a Gmail account to try to unlock a Gmail account is an absurdity, like Baron Munchausen pulling himself out of a swamp by his own hair. You can use a cell phone to unlock email, but cell phone service will always cost money, and phones can be lost, broken, stolen, or sold for emergency funds. No library anywhere provides access to phones that make texts, and even if they did it wouldn't work because they'd be shared by people which would make them unsuitable for identification. That's the reason for the focus. Fixing Gmail sort of "does the heavy lifting" for all the other services that need to get you to prove that you're you.

thadt 4y ago
You're absolutely right - everyone has offloaded the 'identity verification problem' to your email provider. Because doing it well is an intrinsically hard/expensive problem. Replace 'government should provide a digital identity service' with 'government should provide an email service', and we're back at the same place. You still needs a way to prove that you are you - with legal protection and recourse. This letter points out the increasingly obvious - that our online identities have become too important to be left to the customer support whims of one or two corporations. The idea that an innocent algorithmic mistake in a microservice running somewhere deep in Google's cloud could lock me out of my life is not the future we want.
- sweetbitter 4y ago
  > You still needs a way to prove that you are you - with legal protection and recourse. You actually have something that you can use- your reputation. It is difficult to fake your likeness, even moreso to people who actually know you. A combination of past preshared secrets (memories) alongside your likeness is enough to get people who DO have ID to vouch for your identity- family, your landlord, your neighbor, your lawyer, your employer, past schoolteacher, anyone who can reasonably be expected to recognize you and have had some experiences with you, can discern whether or not you are who you say you are. From there you could have access to your theoretical USPS or Library email, add an additional PGP key to publicly-funded keyservers, and generally use the power of this vouch to escalate from there. Even if you make an extreme edge-case argument, saying that someone has some extreme amnesia and finds themselves far away from their home, the government could just let you generate a completely new identity for a small fee, so that you aren't left high and dry without one.
partdavid 4y ago
It's not just that. Yahoo is a very popular free email provider as well, and since it doesn't require MFA, it avoids a whole category of these account lockout issues. So the anger is that Google has required this feature but has not identified sufficient flows for recovery, and in particular does not offer any kind of "catch-all" escalation where you can explain your situation to someone who can individually do something about it.

thadt 4y ago

You're absolutely right - everyone has offloaded the 'identity verification problem' to your email provider. Because doing it well is an intrinsically hard/expensive problem. Replace 'government should provide a digital identity service' with 'government should provide an email service', and we're back at the same place. You still needs a way to prove that you are you - with legal protection and recourse. This letter points out the increasingly obvious - that our online identities have become too important to be left to the customer support whims of one or two corporations. The idea that an innocent algorithmic mistake in a microservice running somewhere deep in Google's cloud could lock me out of my life is not the future we want.

sweetbitter 4y ago
> You still needs a way to prove that you are you - with legal protection and recourse. You actually have something that you can use- your reputation. It is difficult to fake your likeness, even moreso to people who actually know you. A combination of past preshared secrets (memories) alongside your likeness is enough to get people who DO have ID to vouch for your identity- family, your landlord, your neighbor, your lawyer, your employer, past schoolteacher, anyone who can reasonably be expected to recognize you and have had some experiences with you, can discern whether or not you are who you say you are. From there you could have access to your theoretical USPS or Library email, add an additional PGP key to publicly-funded keyservers, and generally use the power of this vouch to escalate from there. Even if you make an extreme edge-case argument, saying that someone has some extreme amnesia and finds themselves far away from their home, the government could just let you generate a completely new identity for a small fee, so that you aren't left high and dry without one.

partdavid 4y ago

It's not just that. Yahoo is a very popular free email provider as well, and since it doesn't require MFA, it avoids a whole category of these account lockout issues. So the anger is that Google has required this feature but has not identified sufficient flows for recovery, and in particular does not offer any kind of "catch-all" escalation where you can explain your situation to someone who can individually do something about it.