3 ms·

I agree there should be more explicit support here, but can this not be "solved" with backup codes? One or more could be given to a trusted person – a family me

I agree there should be more explicit support here, but can this not be "solved" with backup codes? One or more could be given to a trusted person – a family member, a friend, or even a trusted librarian – or a backup code could be remembered. The tough issue here is that these access edge cases look a lot like malicious use. The aren't but authenticating someone who has no device or ID or really much else to authenticate themselves is a Hard Problem. Passwords also aren't the solution here, the industry is moving away from them precisely because they provide poor authentication, particularly for vulnerable people.

smelendez 4y ago
This is potentially a solution for some but it’s not perfect. If they had a trusted friend or family member who could store backup codes and deliver them as needed, they could probably also just stay logged in on that person’s phone or even have emails sent you that person. Keep in mind that they have limited transportation and likely lose their contacts when they lose their phones, and many will have strained relationships with the housed people in their lives. A library solution may not scale. Sure, a librarian might develop a personal relationship and do this as a favor for someone. But the author mentions talking to about 30 people with this problem in his neighborhood, which suggests that if word got out a librarian was doing this and they tried to institutionalize it, a library might have to store codes for dozens or hundreds of people it has no way to authenticate.
- jamesrr39 4y ago
  I think there are possible solutions here for a library, off the top of my head, taking a picture of your face when dropping off the codes, so that when you come back and ask for your codes, the librarian can ID you against the picture they have. Basically what is done when verifying your ID card/passport when you travel/go to the bank etc... It wouldn't be a librarian doing someone a favour, but rather a service that libraries provide. This could be a great evolution for libraries. They are already a distributed, public system, that people in general trust, but their role in society has changed with the rise of the internet and online services, and this could be a really useful role they could fill.
  - danpalmer 4y ago
    Yes this is sort of what I was envisioning. Not as much one trusted librarian doing a favour, but a librarian team having a filing cabinet full of backup codes and an ID process that they trust and that is appropriate for their community. This is the sort of thing that I think Google could support explicitly with more access control around it, but I don't think that's entirely necessary to get the benefits.
    - intrasight 4y ago
      It would be too much of a target for hackers.
bombcar 4y ago
Backup codes could work - but if they have the support of a trusted person they likely can be assisted in other ways, too. Defining a state-sponsored email account that can only be logged in from specific government machines (imagine a kiosk at the DMV, say) where there are trained clerks who can identify homeless in some way could work.
- danpalmer 4y ago
  An interesting idea, but I suspect it just pushes the issue back one more step. How do you authenticate for login to that email account? Specific machines limits but doesn't fundamentally change the attack surface. If the person has ID, then many options work, but if they don't what can a DMV and trained clerks do that others can't in some way? Lastly, I'm not from the US but even I've heard that the DMV is a hellish place with queues hours long. Putting more barriers in front of those who are already in a tough spot (and may need to spend that time working, queueing for shelters, etc) is a big ask.
  - bombcar 4y ago
    Yeah, you have to keep falling back - my idea was that assuming homeless don't move very rapidly from one location to another, you'd have people at the DMV or shelter or wherever you put this who actually recognize the person and can "vouch" for them. It's not an easy problem to solve with "one quick trick" by any means. Part of the reason the DMV can be hellish (in the US at least) is they have to deal with everyone who has an ID, not just the "good customers".

smelendez 4y ago

This is potentially a solution for some but it’s not perfect. If they had a trusted friend or family member who could store backup codes and deliver them as needed, they could probably also just stay logged in on that person’s phone or even have emails sent you that person. Keep in mind that they have limited transportation and likely lose their contacts when they lose their phones, and many will have strained relationships with the housed people in their lives. A library solution may not scale. Sure, a librarian might develop a personal relationship and do this as a favor for someone. But the author mentions talking to about 30 people with this problem in his neighborhood, which suggests that if word got out a librarian was doing this and they tried to institutionalize it, a library might have to store codes for dozens or hundreds of people it has no way to authenticate.

jamesrr39 4y ago
I think there are possible solutions here for a library, off the top of my head, taking a picture of your face when dropping off the codes, so that when you come back and ask for your codes, the librarian can ID you against the picture they have. Basically what is done when verifying your ID card/passport when you travel/go to the bank etc... It wouldn't be a librarian doing someone a favour, but rather a service that libraries provide. This could be a great evolution for libraries. They are already a distributed, public system, that people in general trust, but their role in society has changed with the rise of the internet and online services, and this could be a really useful role they could fill.
- danpalmer 4y ago
  Yes this is sort of what I was envisioning. Not as much one trusted librarian doing a favour, but a librarian team having a filing cabinet full of backup codes and an ID process that they trust and that is appropriate for their community. This is the sort of thing that I think Google could support explicitly with more access control around it, but I don't think that's entirely necessary to get the benefits.
  - intrasight 4y ago
    It would be too much of a target for hackers.

bombcar 4y ago

Backup codes could work - but if they have the support of a trusted person they likely can be assisted in other ways, too. Defining a state-sponsored email account that can only be logged in from specific government machines (imagine a kiosk at the DMV, say) where there are trained clerks who can identify homeless in some way could work.

danpalmer 4y ago
An interesting idea, but I suspect it just pushes the issue back one more step. How do you authenticate for login to that email account? Specific machines limits but doesn't fundamentally change the attack surface. If the person has ID, then many options work, but if they don't what can a DMV and trained clerks do that others can't in some way? Lastly, I'm not from the US but even I've heard that the DMV is a hellish place with queues hours long. Putting more barriers in front of those who are already in a tough spot (and may need to spend that time working, queueing for shelters, etc) is a big ask.
- bombcar 4y ago
  Yeah, you have to keep falling back - my idea was that assuming homeless don't move very rapidly from one location to another, you'd have people at the DMV or shelter or wherever you put this who actually recognize the person and can "vouch" for them. It's not an easy problem to solve with "one quick trick" by any means. Part of the reason the DMV can be hellish (in the US at least) is they have to deal with everyone who has an ID, not just the "good customers".