19 ms·

This problem, and the not-my-problem responses, really highlight the self centered mindset we have encouraged. What if that homeless person was your substance-a

This problem, and the not-my-problem responses, really highlight the self centered mindset we have encouraged. What if that homeless person was your substance-abusing sibling? A friend from school with mental health issues? We need to collectively take more responsibility for those in the worst situations. If you've every tried to teach an old person how to use 2FA you know it's an uphill battle. Using a fingerprint reader isn't even doable for some. And we're all going to be old one day. Practically, we need ideas like to 2FA to gain tractionas widely as possible, while realising that isn't everywhere. And some people will never use 2FA, need higher thresholds for triggering lockouts, and need alternative methods for re-establishing identity to their ID provider (google in this case). For some people that might be their local librarians or community shelter, legal aid groups, and banks.

remote_phone 4y ago
No, people like you really highlight the “If they don’t help everyone then they are being immoral” mentality. Which is wrong. Down grading security for the benefit of a tiny minority with an especially ridiculous use case is not the greater good. If the homeless people think they are at risk of losing their phone then they should pick another free email vendor.
- d4mi3n 4y ago
  This is a simplification of the problem. Both: 1. Vulnerable populations need more assistance accessing essential services required to participate in society 2. Service providers need to maintain a reasonable level of security for their customers Can both be true. Saying that maximum (or minimum) levels of security are required at all time completely misses the point of security--which is to mitigate risk. How much risk is appropriate varies a lot by context. Beyond the context of risk, there is reasonable debate to be had on how to best provide access to essential services to vulnerable populations. It's pretty important to have an email nowadays and if you're not tech savvy or an individual/community has little to no money to spend it's not unreasonable to have the reality of the matter be that there may simply not be many good alternatives (or awareness of alternatives) to GMail. I'm not sure what a correct answer here looks like, but I don't think ignoring the need is an approach that gets us to a better society or enables vulnerable populations to better care for themselves.
  - lotsofpulp 4y ago
    > there is reasonable debate to be had on how to best provide access to essential services to vulnerable populations. What is the debate? The government can collect taxes and provide services, like they do for multitude of other needs. > I'm not sure what a correct answer here looks like, but I don't think ignoring the need is an approach that gets us to a better society or enables vulnerable populations to better care for themselves. The correct answer is not depending on the largesse of businesses. It is using government resources to provide methods for identity verification, communications, and various other bare minimum needs for living.
    - judge2020 4y ago
      > The correct answer is not depending on the largesse of businesses. It is using government resources to provide methods for identity verification, communications, and various other bare minimum needs for living. To be fair I don't see how any government system can do better regarding identity on the internet. Login.gov is one of the best services I've used for access to usajobs/SSA/etc but it follows some of the same security best practices people are complaining about here with no real way to re-gain access to your login.gov account should you lose your 2fa methods (afaik).
      - lotsofpulp 4y ago
        The US government uses the USPS to do identify verification for passports. If it can handle identity verification for passports, why would it not be able to handle identity verification for other purposes, such as replacing or reauthorizing one’s MFA device? Hell, it should be trivial to offer federal government provided emails with ID verification with customer service in the event of loss of device/loss of ID/death/etc.
        angry_octet 4y ago
        The USPS and banks would be ideal identity validators. Having run a few mail servers I don't think the Govt is best placed to do that, but they could outsource it to google, with a few tweaks to allow identity attestation. Many other countries have a central government portal with secure messaging, with federated identify. Heavily reliant on 2FA of course.
scrollaway 4y ago
Counterpoint, I taught several older relatives in my family how to use 1Password. UX for good security can exist, but it does need a little bit of education. We will all be old one day but I have trouble believing we will just forget how to use computers. On the other hand, we do need to carefully consider the role google plays in our lives… especially for us Europeans, who are just at the mercy of a US company’s whims.
UncleMeat 4y ago
"Not-my-problem" is a bad response, but the actual response is that without 2FA even more people lose access to their accounts. Anything that makes it harder for adversaries to take over an account almost necessarily adds friction for the users themselves. This isn't a "fuck the people who don't have regular access to a phone, they don't matter" situation. It is a "there is an aggravating balancing act in this situation and no solution will avoid harming everybody."
- dmix 4y ago
  Yep, reducing standards for everyone in an attempt to help a small minority is also a growing trend in the west. Schools dumbing down so everyone gets A’s type of top level decision making. Sometimes you have to make hard choices where some people get burned because the alternatives are worse. That doesn’t mean you don’t care.
  - paganel 4y ago
    > to help a small minority In this case the people asking for 2FA are the "small minority", and the rest of us have to suffer through 2FA-authentication hell because of them.
    - judge2020 4y ago
      > In this case the people asking for 2FA are the "small minority", and the rest of us have to suffer through 2FA-authentication hell because of them. How many people don't like 2fa because they don't know about all the times it's saved them from total account takeover?
      - arubania2 4y ago
        AKA https://en.m.wikipedia.org/wiki/Preparedness_paradox https://en.m.wikipedia.org/wiki/Preparedness_paradox
- valenterry 4y ago
  > but the actual response is that without 2FA even more people lose access to their accounts This is not black and white. It is possible to encourage 2FA but allow to opt out. The same for phone numbers. And that's why companies enforce 2FA: they want your juicy phone-number or other data. And yeah, maybe they also want to reduce support costs and avoid bad publicity. Still, it's not in your interest, it's in theirs. If they at least would allow for a sufficient number of options. Like paper-tan (even self printed), yubikey or similar, second email address, an authenticator, ... but even big companies often only require a phone number. EDIT: Yes, Google offers more than a phone number when creating a gmail account. I didn't say they don't. However: they don't make it easy and I would even go as far as saying that they are evil here. If you don't believe me, try to create a gmail account right now and don't google/search how to do it without phone number.
stevesearer 4y ago
My dad helps people navigate the system to find housing. Recent story was a 65yo + veteran living in a shelter. They hadn’t started collecting social security due to some debts and was worried it would ALL be garnished. After explaining that veterans get expedited in line for housing and that they would still get almost all of their SS, they have applied for it and should be housed soon. It doesn’t surprise me at all that 2FA causes problems after hearing many stories similar to this one.
- the_only_law 4y ago
  > They hadn’t started collecting social security due to some debts and was worried it would ALL be garnished. Is this common? I knew a guy who had the same mindset. I ended up paying him in cash for some work, he was convinced that if he made any money in a traditional role it would be instantly garnished.
  - canuckintime 4y ago
    > They hadn’t started collecting social security due to some debts and was worried it would ALL be garnished. Your contractor’s actions makes a some twisted sense to me as he’s still receiving ‘undisclosed’ cash. The homeless veteran doesn’t make any sense to me as he was not receiving the social security funds at all.
    - bombcar 4y ago
      If I told you that you had a bunch of forms to fill out, and after doing all the work you'd get no money (and it would all go to your hated ex-wife or something), you might not bother doing it.
      - anotherman554 4y ago
        The above example was someone who FEARED all of their money would be garnished. Not someone who was TOLD all of the money would be garnished. That isn't the same thing.
ouid 4y ago
- lotsofpulp 4y ago
  2FA is not only SMS 2FA.
  - jaclaz 4y ago
    Yes, but what else? A hardware token can be lost as well, and "in app" push notification (or whatever the app does) you stil need the telephone or at least the SIM/same telephone number, don't you?
    - angry_octet 4y ago
      No the device auth prompts are completely independent of mobile number, you don't even need a Sim card. Giving homeless people a secure and convenient place to stash documents would be a great outcome. Birth certificate, military discharge papers, licences, 2FA codes. Many homeless people live in cars and have all this stashed somewhere in the car, but then the car gets stolen/towed (e.g. because they haven't paid car registration) and then they're sleeping rough, without docs.
      - jaclaz 4y ago
        >No the device auth prompts are completely independent of mobile number, you don't even need a Sim card. Sorry, I don't understand, I believed that the independence from the SIM for an app was for an app already installed and authenticated on the specific device. If you lose the smartphone (with the app), and the SIM, how can you install the app and be authenticated on another device? I mean short of a SMS or a code via e-mail (both not receivable/accessible). >Giving homeless people a secure and convenient place to stash documents would be a great outcome. Birth certificate, military discharge papers, licences, 2FA codes. Many homeless people live in cars and have all this stashed somewhere in the car, but then the car gets stolen/towed (e.g. because they haven't paid car registration) and then they're sleeping rough, without docs. A sort of luggage deposit, you mean?
everdrive 4y ago
Right now, technology has reached a point where it's expected to be ubiquitous, however is not as accessible as other ubiquitous and necessary services. This has been brought up before, buy can someone in their 70s keep up with the changing UIs and websites and security requirements these days? This is all fine for something like Netflix or Spotify. But for government services, access to jobs, and fundamental communications this poses a problem.
- bombcar 4y ago
  We're crippling along depending on family, libraries, charities, and other NGO support services. The DMV works with people like this all the time; perhaps something could be done there where you have a government issued email address that you can't lose or be locked out of (worst case you take your ID to the DMV and the nice clerk helps you reset your password/sign in).
- paganel 4y ago
  > someone in their 70s keep I'm in my early 40s, computer programmer, and I've temporarily lost access to my WhatsApp account because I don't have a recent enough mobile phone, and the phone that I do have doesn't have a relatively recent OS installed. It's a 4-year old (I think I've got it for 4 years) iPhone SE, on which I never updated the OS because I hadn't feel the need to do it. When I started getting pop-ups that "hey, our app will stop functioning on your phone unless you upgrade the OS" was already too late for that, I was afraid that upgrading the phone to the latest OS will cripple it permanently in terms of performance (the battery is already on its way out by this point). So, assuming I get to 70, in no way I'll be up to date by then in terms of having the latest OS installed and all that crazy stuff, who has the time and the nerves for that? (especially the nerves).
  - arubania2 4y ago
    What‘s your speciality in programming? Keeping all your software, and that includes the OS, up to date, is one of the most important aspects of personal security.
Bakary 4y ago
This is missing the forest for the trees. Of course we'd be more emotionally involved if it was someone we knew, that's not hypocritical. Most people aren't against fixing societal problems, either. As it stands, homelessness is definitely something that affects a ton of people so it definitely is our problem as long as we are city dwellers. The problem here is that misapplied empathy can lead to terrible decisions. Having Google change their 2FA system for this group would be one such decision. It's similar to the 'think of the kids + terrorism' attacks on encryption. It's socially difficult to argue against these ideas because you are then labeled as a terrible and non-empathetic person, but the solutions themselves make one other thing worse without really being helpful other than for garnering retweets and likes. In this case, we actually aren't being ambitious enough. Why are we having a system where we give out phones every 12 weeks to each homeless person? We'd probably save money for the program by developing some sort of dedicated device designed to be harder to steal or lose. Maybe a high-autonomy low-powered KaiOS smartphone that can be attached as a strap? It's not like the current devices are working. Why is it such a hassle to keep the same number after a theft? We could investigate there too. Improving this would be better than decreasing the effectiveness of gmail's measures. Heck, if we want to focus on Gmail, why not focus on why it's the default choice for the homeless to begin with, as opposed to removing features. We could try to solve the problem structurally but we prefer the caseworker approach, because it's more easily packaged 'empathy' than actually fixing the homelessness issue. It's like people who travel to developing countries to 'help', when the locals need investments and training facilities, not extra warm bodies. Actually giving homes to the homeless would probably be cheaper than whatever we are doing now, even taking into account the mental illness and drug-abuse problems that factor into this.
- ranger_danger 4y ago
  - tut-urut-utut 4y ago
    > You do realize that KaiOS is Chinese, right? What's the point of this comment? Google is American, so what? And people all over the world still use it regardless.
reaperducer 4y ago
What if that homeless person was your substance-abusing sibling? A friend from school with mental health issues? I think we also have to realize that not everyone who is homeless has problems that can explain it away. It's easy to look at someone who is homeless and tell yourself, "Oh, he's a dope addict. He did this to himself." It's only very rarely true, and you're only making excuses for not helping another human being. Just last year there were newspaper articles about how a shocking number of perfectly normal public school teachers in California live out of their cars, just because they cannot afford a place to live on what they're paid. Most people, especially in the SV bubble, would be shocked to learn how many of the baristas, maids, security guards, convenience store clerks, and other people they encounter every single day are homeless, living in their cars, or sleeping on other people's couches through no fault of their own.
- bombcar 4y ago
  The "quiet homeless" who can hold down a job are also likely to be able to keep track of a phone or other two factor device. If we can "solve" the problem for the dopest of dope addicts, the problem will also be solved for the homeless barista. That still doesn't solve the problem for homelessness, of course.
  - judge2020 4y ago
    > The "quiet homeless" who can hold down a job are also likely to be able to keep track of a phone or other two factor device. While I agree that there's a lot of generalization here, a lot of the point of supporting the homeless in the first place is that big tech should support everyone, even if they are indeed someone who "can't keep the same cell phone number for more than 4 months at a time" (via the source twitter thread) as if they're a government that must cater to its citizens.
- angry_octet 4y ago
  Just trying to motivate some empathy, "there but for the grace of God go I." You are correct than many homeless people are not carless, or they suffer from housing uncertainty (couch surfing, itinerant sleepers rolling through difficult family situations and severe housing shortages). Probably they can manage 2FA though.
tpoacher 4y ago
> we need ideas like to 2FA to gain traction as widely as possible No, 2FA needs to die in a fire. Easily circumvented in most social attacks that actually matter, false sense of security, massive timewaster/usability-hell/pain in the butt, acts as a novel social/corporate/accessibility barrier to technology for a large number of previously unaffected groups, and poses a threat to software freedoms. There are many ways to strengthen security and this has got to be the shittiest one.
- Eisenstein 4y ago
  What are the other ways?
  - tpoacher 4y ago
    Get rid of software that doesn't have to be an online service, for one. This cuts 90% of incidents. Then, all the "common sense" stuff: encourage use of password managers to discourage password re-use, having actual humans providing actual customer support when suspicious activity is flagged, companies educating about safe practices like banks do now (e.g. always call back to a trusted number), spam prevention at the ISP level, SSO authentication, VPN ... At the very least there must be better ways to do two-factor authentication than what is the standard default. And to top it all off, on many services, if you cant get all that to work, all you need is your "memorable word". *facepalm*
Spooky23 4y ago
Hopefully we will be able to get digital credentials from state and local entities that will help with this sort of issue. It’s a problem all around - the elderly are most vulnerable to the types of account takeovers that MFA will prevent.
- angry_octet 4y ago
  I think FIDO2 keys are probably ideal -- people understand the concept of keys.
Kalium 4y ago
OK. Let's play a game. Let's say I care. Let's say I care a lot. I care so much that I'm willing to make it my personal problem to address the very real, very pressing needs of a critically vulnerable and marginalized part of my community from inside Google. What am I going to do? Is anyone going to be happier if I stand up and proclaim loudly how much I care? Probably not. Could I say "Gee, what if we just let everyone put themselves in the group of people who don't do 2FA"? Yes, if I wanted to be responsible for a lot of people not securing their accounts. Could I outsource identity verification to a wide assortment of groups (libraries, non-profits, etc.)? Absolutely, so long as I'm alright with this being used to gain improper access to a LOT of accounts outside the target segment. Could I offer more password chances and friendlier lockout times? Sure, so long as I'm OK with the negative consequences of this for a lot of people. OK. Let's end the game now. We don't really have any major steps towards real solutions here. Empathy is very useful for showing where a problem is. Demanding what amounts to lowering the global bar for account security is perhaps not the ideal approach here. Sometimes problems are just hard. Taking ownership and feeling empathy and sincerely wanting to solve the problem does not render them easy.
- gsatic 4y ago
  What do you think the moral of Jurassic Park was? If you dont know how to control what happens in the park you build, then the park will be shutdown. In the case of Google its not hard to speed up the process of shutdown. I just encourage them to keep working on more and more mindless ivory tower trash like Pixel phones, watches etc and inject more Ads into everything. They dont have the imagination for anything else but want a pat on the head for whatever they build. Give it to them.
  - Kalium 4y ago
    It seems to me that Google is in full control of what they've built here. They've chosen not to put in the effort to find a way to meet the needs of this portion of their user community. On the one hand, this can be quite reasonably derided as a lack of imagination. Surely there must be a way to do it! On the other hand, well, we as a society accept that businesses are generally allowed to decide they just don't want to be in a market segment or produce some features. Bridgestone is not compelled by law to have a store in every neighborhood. Montblanc is not forced to produce disposable ballpoint pens. Perhaps we should treat this as Google admitting the limits of what they're willing and able to build. There is no shame in knowing your limits.
deleted 4y ago
[deleted]
robertlagrant 4y ago
> For some people that might be their local librarians or community shelter, legal aid groups, and banks. What's stopping any of those groups becoming a homeless person's 2FA?
ynbl_ 4y ago
> Practically, we need ideas like to 2FA to gain tractionas widely as possible, while realising that isn't everywhere. thats just one opinion on security. you see this world where google is an identity provider, and you prove your identity to it via a librarian or bank. i dont. an internet service should absolutely never require any form of government id nor separate network like cell.
- angry_octet 4y ago
  You're failing to read my argument: for some people normal 2FA is too hard, and they need help from a local organisation. But not for ALL people. Just for the people who need it. You keep using TOTP and GPG email all you want, just don't get in the way of them getting basic services like social security.
  - ynbl_ 4y ago
    you just backed off and said that the thing i responded to is an auxiliary point then your last sentence just retakes the position you backed off from by reclaiming that the auxillery point is true shut the fuck up. of course someone named octect is the most braindamaged fuck on earth.
tdehnel 4y ago
Someone with a drug addiction or mental health issues needs treatment _now_. Access to email is a lower priority.
Aunche 4y ago
More people ought to read this: https://blog.jaibot.com/the-copenhagen-interpretation-of-ethics/ https://blog.jaibot.com/the-copenhagen-interpretation-of-eth.... Google is already providing a free service to homeless people. It's not empathy to tell someone else to solve a problem that you care about. That's virtue signaling. If he cares, he should take matters into his own hands. Is it too much to ask a single person to build a free email service for all homeless people? Perhaps, but the good news is that he doesn't have to. Google already allows you to disable 2FA [1]. He could have started a campaign to disable 2FA on homeless people's phones, but instead he uses this as an opportunity to shame Google to boost his own Twitter follower count. I think that empathy is highly overrated. I doubt anyone notorious for flashing their big Johnson is particularly empathetic, yet LBJ expanded social services more than any other President. The problem isn't that people have too little empathy these days. It's that people are too easily impressed by broadcasting their intentions rather than actually trying to solve a problem. [1] https://support.google.com/accounts/answer/1064203 https://support.google.com/accounts/answer/1064203
- replygirl 4y ago
  looks like loder is talking about problems their own friends face, and the post is not directed at anyone in particular. venting is not virtue signaling
  - Aunche 4y ago
    Loder has 130k Twitter followers without any claim to fame besides Twitter, so he knows exactly what he's doing. If he had vented about his friends cutting themselves with a knife that's too sharp, he would have been ridiculed, but in this case he can hide behind the Google hate bandwagon.
- danso 4y ago
  But many people consider LBJ to have been an empathetic president? I don't see how it's supposed to be self-evident that, because Johnson liked bragging about his johnson, that his focus on the Great Society must have been driven by hard-headed pragmatism. U.S. presidents have a wide array of problems to solve. LBJ didn't have to pick causes that are commonly associated with empathy for the downtrodden.
gubernation 4y ago
[flagged]
soneil 4y ago
I have a sibling who's "no fixed abode". Teaching him how to use 2fa isn't the problem. It's that all property is transient, so the 2nd-factor can't be tied to property. It doesn't matter if that's his phone or his socks. "Something you know and something you have" does not account for those who have nothing.
president 4y ago
If we all spent our collective efforts to make sure everything in this world is accessible to every single human being, we would have zero progress as a society. We are not even guaranteed the right to live in this world and yet you are advocating for the right to email service? It is shocking that someone could even have a thought process like this and receive so many upvotes.
- mplewis 4y ago
  This is entirely untrue. We can build an accessible society for everyone. We clearly have the resources for it.
tqi 4y ago
As someone else pointed out, there is an unavoidable tradeoff that had to be made here between account security, accessibility, and privacy. Reasonable people can absolutely come to different conclusions, but I think it is arrogant to believe that a different decision from the one you would have made could only result from incompetence or ignorance.

remote_phone 4y ago

No, people like you really highlight the “If they don’t help everyone then they are being immoral” mentality. Which is wrong. Down grading security for the benefit of a tiny minority with an especially ridiculous use case is not the greater good. If the homeless people think they are at risk of losing their phone then they should pick another free email vendor.

d4mi3n 4y ago
This is a simplification of the problem. Both: 1. Vulnerable populations need more assistance accessing essential services required to participate in society 2. Service providers need to maintain a reasonable level of security for their customers Can both be true. Saying that maximum (or minimum) levels of security are required at all time completely misses the point of security--which is to mitigate risk. How much risk is appropriate varies a lot by context. Beyond the context of risk, there is reasonable debate to be had on how to best provide access to essential services to vulnerable populations. It's pretty important to have an email nowadays and if you're not tech savvy or an individual/community has little to no money to spend it's not unreasonable to have the reality of the matter be that there may simply not be many good alternatives (or awareness of alternatives) to GMail. I'm not sure what a correct answer here looks like, but I don't think ignoring the need is an approach that gets us to a better society or enables vulnerable populations to better care for themselves.
- lotsofpulp 4y ago
  > there is reasonable debate to be had on how to best provide access to essential services to vulnerable populations. What is the debate? The government can collect taxes and provide services, like they do for multitude of other needs. > I'm not sure what a correct answer here looks like, but I don't think ignoring the need is an approach that gets us to a better society or enables vulnerable populations to better care for themselves. The correct answer is not depending on the largesse of businesses. It is using government resources to provide methods for identity verification, communications, and various other bare minimum needs for living.
  - judge2020 4y ago
    > The correct answer is not depending on the largesse of businesses. It is using government resources to provide methods for identity verification, communications, and various other bare minimum needs for living. To be fair I don't see how any government system can do better regarding identity on the internet. Login.gov is one of the best services I've used for access to usajobs/SSA/etc but it follows some of the same security best practices people are complaining about here with no real way to re-gain access to your login.gov account should you lose your 2fa methods (afaik).
    - lotsofpulp 4y ago
      The US government uses the USPS to do identify verification for passports. If it can handle identity verification for passports, why would it not be able to handle identity verification for other purposes, such as replacing or reauthorizing one’s MFA device? Hell, it should be trivial to offer federal government provided emails with ID verification with customer service in the event of loss of device/loss of ID/death/etc.
      - angry_octet 4y ago
        The USPS and banks would be ideal identity validators. Having run a few mail servers I don't think the Govt is best placed to do that, but they could outsource it to google, with a few tweaks to allow identity attestation. Many other countries have a central government portal with secure messaging, with federated identify. Heavily reliant on 2FA of course.

scrollaway 4y ago

Counterpoint, I taught several older relatives in my family how to use 1Password. UX for good security can exist, but it does need a little bit of education. We will all be old one day but I have trouble believing we will just forget how to use computers. On the other hand, we do need to carefully consider the role google plays in our lives… especially for us Europeans, who are just at the mercy of a US company’s whims.

UncleMeat 4y ago

"Not-my-problem" is a bad response, but the actual response is that without 2FA even more people lose access to their accounts. Anything that makes it harder for adversaries to take over an account almost necessarily adds friction for the users themselves. This isn't a "fuck the people who don't have regular access to a phone, they don't matter" situation. It is a "there is an aggravating balancing act in this situation and no solution will avoid harming everybody."

dmix 4y ago
Yep, reducing standards for everyone in an attempt to help a small minority is also a growing trend in the west. Schools dumbing down so everyone gets A’s type of top level decision making. Sometimes you have to make hard choices where some people get burned because the alternatives are worse. That doesn’t mean you don’t care.
- paganel 4y ago
  > to help a small minority In this case the people asking for 2FA are the "small minority", and the rest of us have to suffer through 2FA-authentication hell because of them.
  - judge2020 4y ago
    > In this case the people asking for 2FA are the "small minority", and the rest of us have to suffer through 2FA-authentication hell because of them. How many people don't like 2fa because they don't know about all the times it's saved them from total account takeover?
    - arubania2 4y ago
      AKA https://en.m.wikipedia.org/wiki/Preparedness_paradox https://en.m.wikipedia.org/wiki/Preparedness_paradox
valenterry 4y ago
> but the actual response is that without 2FA even more people lose access to their accounts This is not black and white. It is possible to encourage 2FA but allow to opt out. The same for phone numbers. And that's why companies enforce 2FA: they want your juicy phone-number or other data. And yeah, maybe they also want to reduce support costs and avoid bad publicity. Still, it's not in your interest, it's in theirs. If they at least would allow for a sufficient number of options. Like paper-tan (even self printed), yubikey or similar, second email address, an authenticator, ... but even big companies often only require a phone number. EDIT: Yes, Google offers more than a phone number when creating a gmail account. I didn't say they don't. However: they don't make it easy and I would even go as far as saying that they are evil here. If you don't believe me, try to create a gmail account right now and don't google/search how to do it without phone number.

stevesearer 4y ago

My dad helps people navigate the system to find housing. Recent story was a 65yo + veteran living in a shelter. They hadn’t started collecting social security due to some debts and was worried it would ALL be garnished. After explaining that veterans get expedited in line for housing and that they would still get almost all of their SS, they have applied for it and should be housed soon. It doesn’t surprise me at all that 2FA causes problems after hearing many stories similar to this one.

the_only_law 4y ago
> They hadn’t started collecting social security due to some debts and was worried it would ALL be garnished. Is this common? I knew a guy who had the same mindset. I ended up paying him in cash for some work, he was convinced that if he made any money in a traditional role it would be instantly garnished.
- canuckintime 4y ago
  > They hadn’t started collecting social security due to some debts and was worried it would ALL be garnished. Your contractor’s actions makes a some twisted sense to me as he’s still receiving ‘undisclosed’ cash. The homeless veteran doesn’t make any sense to me as he was not receiving the social security funds at all.
  - bombcar 4y ago
    If I told you that you had a bunch of forms to fill out, and after doing all the work you'd get no money (and it would all go to your hated ex-wife or something), you might not bother doing it.
    - anotherman554 4y ago
      The above example was someone who FEARED all of their money would be garnished. Not someone who was TOLD all of the money would be garnished. That isn't the same thing.

ouid 4y ago

lotsofpulp 4y ago
2FA is not only SMS 2FA.
- jaclaz 4y ago
  Yes, but what else? A hardware token can be lost as well, and "in app" push notification (or whatever the app does) you stil need the telephone or at least the SIM/same telephone number, don't you?
  - angry_octet 4y ago
    No the device auth prompts are completely independent of mobile number, you don't even need a Sim card. Giving homeless people a secure and convenient place to stash documents would be a great outcome. Birth certificate, military discharge papers, licences, 2FA codes. Many homeless people live in cars and have all this stashed somewhere in the car, but then the car gets stolen/towed (e.g. because they haven't paid car registration) and then they're sleeping rough, without docs.
    - jaclaz 4y ago
      >No the device auth prompts are completely independent of mobile number, you don't even need a Sim card. Sorry, I don't understand, I believed that the independence from the SIM for an app was for an app already installed and authenticated on the specific device. If you lose the smartphone (with the app), and the SIM, how can you install the app and be authenticated on another device? I mean short of a SMS or a code via e-mail (both not receivable/accessible). >Giving homeless people a secure and convenient place to stash documents would be a great outcome. Birth certificate, military discharge papers, licences, 2FA codes. Many homeless people live in cars and have all this stashed somewhere in the car, but then the car gets stolen/towed (e.g. because they haven't paid car registration) and then they're sleeping rough, without docs. A sort of luggage deposit, you mean?

everdrive 4y ago

Right now, technology has reached a point where it's expected to be ubiquitous, however is not as accessible as other ubiquitous and necessary services. This has been brought up before, buy can someone in their 70s keep up with the changing UIs and websites and security requirements these days? This is all fine for something like Netflix or Spotify. But for government services, access to jobs, and fundamental communications this poses a problem.

bombcar 4y ago
We're crippling along depending on family, libraries, charities, and other NGO support services. The DMV works with people like this all the time; perhaps something could be done there where you have a government issued email address that you can't lose or be locked out of (worst case you take your ID to the DMV and the nice clerk helps you reset your password/sign in).
paganel 4y ago
> someone in their 70s keep I'm in my early 40s, computer programmer, and I've temporarily lost access to my WhatsApp account because I don't have a recent enough mobile phone, and the phone that I do have doesn't have a relatively recent OS installed. It's a 4-year old (I think I've got it for 4 years) iPhone SE, on which I never updated the OS because I hadn't feel the need to do it. When I started getting pop-ups that "hey, our app will stop functioning on your phone unless you upgrade the OS" was already too late for that, I was afraid that upgrading the phone to the latest OS will cripple it permanently in terms of performance (the battery is already on its way out by this point). So, assuming I get to 70, in no way I'll be up to date by then in terms of having the latest OS installed and all that crazy stuff, who has the time and the nerves for that? (especially the nerves).
- arubania2 4y ago
  What‘s your speciality in programming? Keeping all your software, and that includes the OS, up to date, is one of the most important aspects of personal security.

Bakary 4y ago

This is missing the forest for the trees. Of course we'd be more emotionally involved if it was someone we knew, that's not hypocritical. Most people aren't against fixing societal problems, either. As it stands, homelessness is definitely something that affects a ton of people so it definitely is our problem as long as we are city dwellers. The problem here is that misapplied empathy can lead to terrible decisions. Having Google change their 2FA system for this group would be one such decision. It's similar to the 'think of the kids + terrorism' attacks on encryption. It's socially difficult to argue against these ideas because you are then labeled as a terrible and non-empathetic person, but the solutions themselves make one other thing worse without really being helpful other than for garnering retweets and likes. In this case, we actually aren't being ambitious enough. Why are we having a system where we give out phones every 12 weeks to each homeless person? We'd probably save money for the program by developing some sort of dedicated device designed to be harder to steal or lose. Maybe a high-autonomy low-powered KaiOS smartphone that can be attached as a strap? It's not like the current devices are working. Why is it such a hassle to keep the same number after a theft? We could investigate there too. Improving this would be better than decreasing the effectiveness of gmail's measures. Heck, if we want to focus on Gmail, why not focus on why it's the default choice for the homeless to begin with, as opposed to removing features. We could try to solve the problem structurally but we prefer the caseworker approach, because it's more easily packaged 'empathy' than actually fixing the homelessness issue. It's like people who travel to developing countries to 'help', when the locals need investments and training facilities, not extra warm bodies. Actually giving homes to the homeless would probably be cheaper than whatever we are doing now, even taking into account the mental illness and drug-abuse problems that factor into this.

ranger_danger 4y ago
- tut-urut-utut 4y ago
  > You do realize that KaiOS is Chinese, right? What's the point of this comment? Google is American, so what? And people all over the world still use it regardless.

reaperducer 4y ago

What if that homeless person was your substance-abusing sibling? A friend from school with mental health issues? I think we also have to realize that not everyone who is homeless has problems that can explain it away. It's easy to look at someone who is homeless and tell yourself, "Oh, he's a dope addict. He did this to himself." It's only very rarely true, and you're only making excuses for not helping another human being. Just last year there were newspaper articles about how a shocking number of perfectly normal public school teachers in California live out of their cars, just because they cannot afford a place to live on what they're paid. Most people, especially in the SV bubble, would be shocked to learn how many of the baristas, maids, security guards, convenience store clerks, and other people they encounter every single day are homeless, living in their cars, or sleeping on other people's couches through no fault of their own.

bombcar 4y ago
The "quiet homeless" who can hold down a job are also likely to be able to keep track of a phone or other two factor device. If we can "solve" the problem for the dopest of dope addicts, the problem will also be solved for the homeless barista. That still doesn't solve the problem for homelessness, of course.
- judge2020 4y ago
  > The "quiet homeless" who can hold down a job are also likely to be able to keep track of a phone or other two factor device. While I agree that there's a lot of generalization here, a lot of the point of supporting the homeless in the first place is that big tech should support everyone, even if they are indeed someone who "can't keep the same cell phone number for more than 4 months at a time" (via the source twitter thread) as if they're a government that must cater to its citizens.
angry_octet 4y ago
Just trying to motivate some empathy, "there but for the grace of God go I." You are correct than many homeless people are not carless, or they suffer from housing uncertainty (couch surfing, itinerant sleepers rolling through difficult family situations and severe housing shortages). Probably they can manage 2FA though.

tpoacher 4y ago

> we need ideas like to 2FA to gain traction as widely as possible No, 2FA needs to die in a fire. Easily circumvented in most social attacks that actually matter, false sense of security, massive timewaster/usability-hell/pain in the butt, acts as a novel social/corporate/accessibility barrier to technology for a large number of previously unaffected groups, and poses a threat to software freedoms. There are many ways to strengthen security and this has got to be the shittiest one.

Eisenstein 4y ago
What are the other ways?
- tpoacher 4y ago
  Get rid of software that doesn't have to be an online service, for one. This cuts 90% of incidents. Then, all the "common sense" stuff: encourage use of password managers to discourage password re-use, having actual humans providing actual customer support when suspicious activity is flagged, companies educating about safe practices like banks do now (e.g. always call back to a trusted number), spam prevention at the ISP level, SSO authentication, VPN ... At the very least there must be better ways to do two-factor authentication than what is the standard default. And to top it all off, on many services, if you cant get all that to work, all you need is your "memorable word". *facepalm*

Spooky23 4y ago

Hopefully we will be able to get digital credentials from state and local entities that will help with this sort of issue. It’s a problem all around - the elderly are most vulnerable to the types of account takeovers that MFA will prevent.

angry_octet 4y ago
I think FIDO2 keys are probably ideal -- people understand the concept of keys.

Kalium 4y ago

OK. Let's play a game. Let's say I care. Let's say I care a lot. I care so much that I'm willing to make it my personal problem to address the very real, very pressing needs of a critically vulnerable and marginalized part of my community from inside Google. What am I going to do? Is anyone going to be happier if I stand up and proclaim loudly how much I care? Probably not. Could I say "Gee, what if we just let everyone put themselves in the group of people who don't do 2FA"? Yes, if I wanted to be responsible for a lot of people not securing their accounts. Could I outsource identity verification to a wide assortment of groups (libraries, non-profits, etc.)? Absolutely, so long as I'm alright with this being used to gain improper access to a LOT of accounts outside the target segment. Could I offer more password chances and friendlier lockout times? Sure, so long as I'm OK with the negative consequences of this for a lot of people. OK. Let's end the game now. We don't really have any major steps towards real solutions here. Empathy is very useful for showing where a problem is. Demanding what amounts to lowering the global bar for account security is perhaps not the ideal approach here. Sometimes problems are just hard. Taking ownership and feeling empathy and sincerely wanting to solve the problem does not render them easy.

gsatic 4y ago
What do you think the moral of Jurassic Park was? If you dont know how to control what happens in the park you build, then the park will be shutdown. In the case of Google its not hard to speed up the process of shutdown. I just encourage them to keep working on more and more mindless ivory tower trash like Pixel phones, watches etc and inject more Ads into everything. They dont have the imagination for anything else but want a pat on the head for whatever they build. Give it to them.
- Kalium 4y ago
  It seems to me that Google is in full control of what they've built here. They've chosen not to put in the effort to find a way to meet the needs of this portion of their user community. On the one hand, this can be quite reasonably derided as a lack of imagination. Surely there must be a way to do it! On the other hand, well, we as a society accept that businesses are generally allowed to decide they just don't want to be in a market segment or produce some features. Bridgestone is not compelled by law to have a store in every neighborhood. Montblanc is not forced to produce disposable ballpoint pens. Perhaps we should treat this as Google admitting the limits of what they're willing and able to build. There is no shame in knowing your limits.

deleted 4y ago

[deleted]

robertlagrant 4y ago

> For some people that might be their local librarians or community shelter, legal aid groups, and banks. What's stopping any of those groups becoming a homeless person's 2FA?

ynbl_ 4y ago

> Practically, we need ideas like to 2FA to gain tractionas widely as possible, while realising that isn't everywhere. thats just one opinion on security. you see this world where google is an identity provider, and you prove your identity to it via a librarian or bank. i dont. an internet service should absolutely never require any form of government id nor separate network like cell.

angry_octet 4y ago
You're failing to read my argument: for some people normal 2FA is too hard, and they need help from a local organisation. But not for ALL people. Just for the people who need it. You keep using TOTP and GPG email all you want, just don't get in the way of them getting basic services like social security.
- ynbl_ 4y ago
  you just backed off and said that the thing i responded to is an auxiliary point then your last sentence just retakes the position you backed off from by reclaiming that the auxillery point is true shut the fuck up. of course someone named octect is the most braindamaged fuck on earth.

tdehnel 4y ago

Someone with a drug addiction or mental health issues needs treatment _now_. Access to email is a lower priority.

Aunche 4y ago

More people ought to read this: https://blog.jaibot.com/the-copenhagen-interpretation-of-ethics/ https://blog.jaibot.com/the-copenhagen-interpretation-of-eth.... Google is already providing a free service to homeless people. It's not empathy to tell someone else to solve a problem that you care about. That's virtue signaling. If he cares, he should take matters into his own hands. Is it too much to ask a single person to build a free email service for all homeless people? Perhaps, but the good news is that he doesn't have to. Google already allows you to disable 2FA [1]. He could have started a campaign to disable 2FA on homeless people's phones, but instead he uses this as an opportunity to shame Google to boost his own Twitter follower count. I think that empathy is highly overrated. I doubt anyone notorious for flashing their big Johnson is particularly empathetic, yet LBJ expanded social services more than any other President. The problem isn't that people have too little empathy these days. It's that people are too easily impressed by broadcasting their intentions rather than actually trying to solve a problem. [1] https://support.google.com/accounts/answer/1064203 https://support.google.com/accounts/answer/1064203

replygirl 4y ago
looks like loder is talking about problems their own friends face, and the post is not directed at anyone in particular. venting is not virtue signaling
- Aunche 4y ago
  Loder has 130k Twitter followers without any claim to fame besides Twitter, so he knows exactly what he's doing. If he had vented about his friends cutting themselves with a knife that's too sharp, he would have been ridiculed, but in this case he can hide behind the Google hate bandwagon.
danso 4y ago
But many people consider LBJ to have been an empathetic president? I don't see how it's supposed to be self-evident that, because Johnson liked bragging about his johnson, that his focus on the Great Society must have been driven by hard-headed pragmatism. U.S. presidents have a wide array of problems to solve. LBJ didn't have to pick causes that are commonly associated with empathy for the downtrodden.

gubernation 4y ago

[flagged]

soneil 4y ago

I have a sibling who's "no fixed abode". Teaching him how to use 2fa isn't the problem. It's that all property is transient, so the 2nd-factor can't be tied to property. It doesn't matter if that's his phone or his socks. "Something you know and something you have" does not account for those who have nothing.

president 4y ago

If we all spent our collective efforts to make sure everything in this world is accessible to every single human being, we would have zero progress as a society. We are not even guaranteed the right to live in this world and yet you are advocating for the right to email service? It is shocking that someone could even have a thought process like this and receive so many upvotes.

mplewis 4y ago
This is entirely untrue. We can build an accessible society for everyone. We clearly have the resources for it.

tqi 4y ago

As someone else pointed out, there is an unavoidable tradeoff that had to be made here between account security, accessibility, and privacy. Reasonable people can absolutely come to different conclusions, but I think it is arrogant to believe that a different decision from the one you would have made could only result from incompetence or ignorance.