13 ms·

In one of the later posts, the OP writes that the homeless will lose any physical thing after N weeks. So what kind of 2FA would be homeless-proof? I don't see

• Cerium 4y ago
  Maybe we don't need to meet all those requirements simultaneously. The on boarding process could try to determining if 2fa would actually benefit you or not.
  • macspoofing 4y ago
    >The on boarding process could try to determining if 2fa would actually benefit you or not. How?
    • adgjlsfhk1 4y ago
      By asking you?
      • macspoofing 4y ago
        Well .. yeah. And I think that's what OP (of the twitter thread) is advocating (without explicitly stating it). Namely, that 2FA doesn't work for homeless.
    • MonkeyMalarky 4y ago
      Ask. Default to yes but allow to opt out.
    • userbinator 4y ago
      By the complexity of the password you choose?
• gmm1990 4y ago
  Probably a dna solution, not that you'd want google to have that info directly.
  • cdot2 4y ago
    The problem with biometrics like that is that if the data is stolen or otherwise accessed then it can't be reset. If an attacker has your fingerprint and you use that for 2FA you can't reset that to prevent them from having access.
• radford-neal 4y ago
  > ... the homeless will lose any physical thing after N weeks. So what kind of 2FA would be homeless-proof? I don't see a solution. How about the homeless person remembers a good password, and that's all that's needed for authentication? You know, just like it used to be. What exactly is wrong with that?
  • Double_a_92 4y ago
    People can't remember many good passwords. So they start reusing them. If one site has a leak, everything is lost without 2FA.
    • sph 4y ago
      So the choice is for them to permanently lose access to their email? Homeless people aren't stupid and strong password don't have to be incredibly hard to remember. I'd rather get my accounts hacked because of password reuse than lose access to my email, forever. There is literally nothing more important than your email. Even stuff like your bank account has secondary means of recovery, whereas if you lose access to your email you're pretty much fucked.
      • bombcar 4y ago
        I would rank a home as more important than email; I'd certainly rather lose access to my email than my home. But by definition, the homeless have already lost a home (assuming they weren't born homeless) - and I've forgotten passwords before. So "the stupid homeless just need to memorize their password" isn't a solution.
        • Wowfunhappy 4y ago
          It's not a solution, but it's a heck of a lot better than locking them out of their accounts even if they still know their password!
      • judge2020 4y ago
        Who's to say that your email account getting hacked is less dire than losing access to it? Attackers can easily search your inbox for 'verify your email', visit any website of value, and use their access to change the account away from your email to an address that they own, effectively removing your access to your third-party website accounts entirely.
• deleted 4y ago
  [deleted]
• esperent 4y ago
  So if there are certain vulnerable categories of people who cannot use any form of 2FA, where does that leave 2FA? Seems to me it should mean that it has to be optional, at least until we solve that problem.
  • Kalium 4y ago
    That depends greatly on if the systems in question are expected to provide universal service or not. This is perhaps the crux of the question - do we expect Google to operate as a public service capable of delivering service in a way that meets the needs of 100% of the population? Or do we think it's acceptable for Google to decide that they're happy with 98%, modulo things like the ADA? USPS serves every US address. Lone Star Overnight is allowed to mostly serve Texas without a requirement to also serve Maine. Which category do we want Google to fall into? This kinda smells like we're expecting it to be a universally provisioned public service, but provided by a private entity with private funding.
• pydry 4y ago
  >The other thing is, we want at the same time Gmail to be unhackable against best hackers and state sponsored adversaries for the billions of users, including high profile dissidents, journalists, and senators who will inevitably have accounts; and at the same time to homeless people who can't keep any physical thing. It's kinda difficult to meet those conflicting requirements well at the same time. It's only hard if you adopt a one size fits all approach to security. Google's proclivity towards treating its users as an undifferentiated commodity isnt proof that its users couldnt be treated differently.
• macspoofing 4y ago
  >Maybe the solution should be to have some basic free state-paid email provider for those people. They are not forced to use Gmail specifically (albeit the number of non-sucking and free email providers is probably close to zero). You don't need to use Gmail. There are a lot of good free mail providers.
  • fknorangesite 4y ago
    And what happens if I've already been using that gmail address and then become homeless? I guess too bad! Should have thought of my future homelessness when I was signing up for an email service a decade ago!
    • macspoofing 4y ago
      OK ... who are you arguing with? OP stated "Maybe the solution should be to have some basic free state-paid email provider for those people." I replied that there are a lot of good free email providers already.
      • lazyasciiart 4y ago
        You, when you said “they don’t have to use Gmail”.
    • ravel-bar-foo 4y ago
      Gmail allows users to generate 10 one-time use 2FA codes at a time. Even if you are not going to become homeless, you should generate these and write them down somewhere secure. You never know if your phone battery will suddenly die.
    • newaccount2021 4y ago
    • WithinReason 4y ago
      Then you change your password to a strong one and turn off 2FA
• scyzoryk_xyz 4y ago
  „Maybe the solution should be to have some basic free state-paid email provider for those people.”
• nirimda 4y ago
  > In one of the later posts, the OP writes that the homeless will lose any physical thing after N weeks. So what kind of 2FA would be homeless-proof? I don't see a solution. This is not a technical problem and should not be automated away. Rely on trustworthy third parties. Universal utilities like Google should have retail outlets which are adapted to local conditions and can exercise educated judgement. In some countries, the police might certify the identity of the individual, and then Google could trust that certification. In another place, it might be some combination of the Red Cross and a public hospital. Obviously some identifications will be easier and others harder - if a person in New York claims they are the owner of an account based in Spain, the employee should be suspicious and require a higher burden of proof (and the reactivation might be logistically more difficult). > The other thing is, we want at the same time Gmail to be unhackable against best hackers and state sponsored adversaries for the billions of users, including high profile dissidents, journalists, and senators who will inevitably have accounts; I'm not really convinced high profile dissidents, journalists and senators (why senators?) should be trusting Gmail to protect them from state sponsored adversaries. Google generally wants to do business in territories controlled by states which means they have to follow laws and will sometimes be subject to intimidation; but they have no intrinsic motivation to be unhackable.
  • SpicyLemonZest 4y ago
    I don’t think there’s any universe where a company runs an international chain of retail outlets in order to support a free email service. If that were the standard, free email providers just wouldn’t exist outside of bundles with other services.
    • snotrockets 4y ago
      We treat email almost as we used to treat postal mail: we expect it to be available to all ("digital transition" replacing human-fronted public services with digital one). If we treat it as a utility, it's fine to regulate it as such. If <big corp> want to make money, directly or indirectly, by offering email service, they should have some standard of service. If they can't we can just make it public service, which wouldn't let <big corp> make money out of it, but would also guarantee it's available to all. Either way, eating the cake and leaving it whole, like it is now, shouldn't be an option.
• 1970-01-01 4y ago
  >So what kind of 2FA would be homeless-proof? Drop the password requirement. Use fingerprints + face. Very hard to lose these, but not impossible. Note, this solution is 1.5FA, but would solve the issue at hand. (pun alert)
  • patmcc 4y ago
    This assumes they have a device that can read fingerprints/face. I'm going to homeless folks are also more likely to be on library computers, old phones, etc. and not have access to biometric sensors.
  • shakna 4y ago
    Very easy to lose the features of those that tracking systems identify, however. Scar tissue makes most fingerprint systems fail over the smallest of changes, and facial scarring is also, unfortunately, not an uncommon issue among the homeless. Ignoring the issue of device accessibility - which is the crux of the 2FA problem.
• joshka 4y ago
  Replace something you know, something you have with something you know, someone you know or something similar.
• zoredache 4y ago
  > So what kind of 2FA would be homeless-proof? Almost certainly is a bad idea. But the first thing that seems like it could work would be an implantable nfc yubikey. Then making more devices support nfc. I know I would be pretty tempted to get an implantable 2FA device if one was available and seemed like it would have both broad and long term support.
  • xvector 4y ago
    How could you possibly come to the conclusion that a homeless person could afford a surgically implanted 2fa token?
  • indrora 4y ago
    Ah, yes I can read the headline now “GOVERNMENT PROGRAM TO CHIP HOMELESS PEOPLE LIKE DOGS TO PROVE IDENTITY” I implore you to read The Scarlet Letter and perhaps read up on [similar such things](https://en.wikipedia.org/wiki/Identification_of_inmates_in_German_concentration_camps https://en.wikipedia.org/wiki/Identification_of_inmates_in_G...).
    • Kamq 4y ago
      Oh come on now, you're being a little harsh. They prefixed the comment with "Almost certainly would be a bad idea"
  • xani_ 4y ago
• IncRnd 4y ago
  > So what kind of 2FA would be homeless-proof? I don't see a solution. There are three factor categories, what you know, what you are, and what you have. A password is what you know. A phone is what you have. Biometrics are what you are - facial recognition, thumbprints, etc. 2FA in one manner or another is used by various services, because the security recommendation is to pillar identification by at least two of the three factors. For your question, there are any two from the three factor categories that could be used. However, there are also limited versions of a single category that are often used as a backup when 2fa is not available. In this case, google uses backup codes when "what you have" is not available. Backup codes are functionally equivalent to passwords, except that they are limited to a single-time use. Limiting use is often a method of using a single factor category, when another factor is not available. Another method is to rely upon another authority, such as using a physical ID card that can be validated in order to let a person back in. And so forth.
  • deleted 4y ago
    [deleted]
• skybrian 4y ago
  One possibility would be to solve the "can't keep anything on them" problem with a bracelet or something like that, like they do in hospitals. Something more durable and less valuable than a cell phone. If they truly can't keep anything on them, someone who recognizes them needs to represent them. (A locker won't do - they'll lose the key.) And if they have no friends they can trust (which is likely) then it probably needs to be a government worker of some sort, who has their photo on the computer. I mean, unless you want to have retina scans to log into library computers or something. Or really reliable face recognition.
• xani_ 4y ago
  Or just let people to disable 2FA. That's simplest and easiest solution. Slap a red warning label if you need to.
  • fragmede 4y ago
    For better or worse, I can’t set my password to be “password” or any other number of weak words, and also need a number and symbol. Same principle in practice here.
    • crooked-v 4y ago
      It's realistic to expect people to remember a difficult password eventually. It's not realistic to expect them to recover the SIM card from a phone that was stolen from them in the middle of the night and pawned for drugs or broken down into parts.
    • CyberDildonics 4y ago
      Why would a strong password and needing an entirely different communication channel be the same thing? That's like saying walking to work and needing to drive a car to work are the same thing.
  • jonas21 4y ago
    You mean like this? https://support.google.com/accounts/answer/1064203?hl=en https://support.google.com/accounts/answer/1064203?hl=en
• out-of-ideas 4y ago
  I've often wondered that with a valid ID, that the gov does not give us an email noawdays. Especially one that does not require this asinine phone-validity garbage. I'd even suggest that maybe not use email-addresses as a login-name along with plenty of alias's for inbound and outbound that do not expose your "main" or account. And google is not alone here; many other major "free" email providers require a phone as well (dagger eyes at you, MS, yahoo, ect); and the icing on the cake are some websites even require a particular set of domains to register with them to prevent multi-accounts/bots/spammers/ect => just a big ol download-spiral of decisions that feed into eachother, just to put a physical ID on anybody to tag-em-to-sell-em The biggest gripe is that it is mandatory; it is not an option and nothing we can do about it other than "vote with our wallets" - and google does not even allow ToTP use as an alternative to phones, lol The beatings will continue until morale improves; always has been, always will
  • jdminhbg 4y ago
    > I've often wondered that with a valid ID, that the gov does not give us an email noawdays. Especially one that does not require this asinine phone-validity garbage. Can you even imagine the nightmare of trying to police the usage of such a thing? Everything from simple spamming to harassment to child pornography, all complicated by the stricter scrutiny the government gets for who it can decide not to provide services to.
    • kortex 4y ago
      Yes, with actual police. Why anyone would use a government- issue email tied to their identity to traffic CP is absolutely beyond me.
      • out-of-ideas 4y ago
        funny, USPS is still on the federal level last i was aware; and all your phone calls are monitored
    • samdcbu 4y ago
      This literally sounds like an FBI honeypot, they would love it. The almost complete inability to moderate due to 1A is the largest of many fatal flaws in government run email
• xg15 4y ago
  > So what kind of 2FA would be homeless-proof? There is none. That's the entire point of the post: "something you have" doesn't work if you're at risk of losing all of your possessions at any time. So let them disable 2FA and rely on passwords - or even better yet, provide some way to actually talk to a person and verify identity.
• mmmpop 4y ago
  Nothing a good old barcode on the wrist can't fix.
• intrasight 4y ago
  >kind of 2FA would be homeless-proof What kind of 2FA would be human-proof? Also, the tweet uses the word "permanent" but doesn't explain. How is it any more "permanent" than anyone else?
• kshacker 4y ago
  We will need to design it, but India has a biometrics system (yes big bad privacy issues) called aadhaar which is used for authentication in so many systems. As long as you can build and secure such a system, and people get used to it, as they are used to Socials now, it can be used to unlock a whole lot of things.
• sfvegandude 4y ago
  > So what kind of 2FA would be homeless-proof? I don't see a solution. Biometric? Amazon One's hand recognition would be a decent solution here, though I'll be damned if I've ever met someone willing to try it. And I ask, every time I go to Whole Foods.
  • joshxyz 4y ago
    what if they lost their eye or their arms?