3 ms·

No, people like you really highlight the “If they don’t help everyone then they are being immoral” mentality. Which is wrong. Down grading security for the be

No, people like you really highlight the “If they don’t help everyone then they are being immoral” mentality. Which is wrong. Down grading security for the benefit of a tiny minority with an especially ridiculous use case is not the greater good. If the homeless people think they are at risk of losing their phone then they should pick another free email vendor.

d4mi3n 4y ago
This is a simplification of the problem. Both: 1. Vulnerable populations need more assistance accessing essential services required to participate in society 2. Service providers need to maintain a reasonable level of security for their customers Can both be true. Saying that maximum (or minimum) levels of security are required at all time completely misses the point of security--which is to mitigate risk. How much risk is appropriate varies a lot by context. Beyond the context of risk, there is reasonable debate to be had on how to best provide access to essential services to vulnerable populations. It's pretty important to have an email nowadays and if you're not tech savvy or an individual/community has little to no money to spend it's not unreasonable to have the reality of the matter be that there may simply not be many good alternatives (or awareness of alternatives) to GMail. I'm not sure what a correct answer here looks like, but I don't think ignoring the need is an approach that gets us to a better society or enables vulnerable populations to better care for themselves.
- lotsofpulp 4y ago
  > there is reasonable debate to be had on how to best provide access to essential services to vulnerable populations. What is the debate? The government can collect taxes and provide services, like they do for multitude of other needs. > I'm not sure what a correct answer here looks like, but I don't think ignoring the need is an approach that gets us to a better society or enables vulnerable populations to better care for themselves. The correct answer is not depending on the largesse of businesses. It is using government resources to provide methods for identity verification, communications, and various other bare minimum needs for living.
  - judge2020 4y ago
    > The correct answer is not depending on the largesse of businesses. It is using government resources to provide methods for identity verification, communications, and various other bare minimum needs for living. To be fair I don't see how any government system can do better regarding identity on the internet. Login.gov is one of the best services I've used for access to usajobs/SSA/etc but it follows some of the same security best practices people are complaining about here with no real way to re-gain access to your login.gov account should you lose your 2fa methods (afaik).
    - lotsofpulp 4y ago
      The US government uses the USPS to do identify verification for passports. If it can handle identity verification for passports, why would it not be able to handle identity verification for other purposes, such as replacing or reauthorizing one’s MFA device? Hell, it should be trivial to offer federal government provided emails with ID verification with customer service in the event of loss of device/loss of ID/death/etc.
      - angry_octet 4y ago
        The USPS and banks would be ideal identity validators. Having run a few mail servers I don't think the Govt is best placed to do that, but they could outsource it to google, with a few tweaks to allow identity attestation. Many other countries have a central government portal with secure messaging, with federated identify. Heavily reliant on 2FA of course.
      - judge2020 4y ago
        Passports require the most paperwork out of anything - your in particular, a birth certificate, a second form of ID including a driver's license, a photo, and $130+$35. The USPS isn't just looking at a face and issuing a passport. 0The issue here is that homeless don't hold onto anything physical for 4 months; identity verification breaks down in-person immediately as shelters/libraries can't be expected to run a facial recognition operation, and specific shelter employees/volunteers aren't guaranteed to be there anytime a homeless person might walk in and need those backup codes, but it breaks down even further online since 2fa is inherently 'what you know' + ('what you have'/'who you are').

d4mi3n 4y ago

This is a simplification of the problem. Both: 1. Vulnerable populations need more assistance accessing essential services required to participate in society 2. Service providers need to maintain a reasonable level of security for their customers Can both be true. Saying that maximum (or minimum) levels of security are required at all time completely misses the point of security--which is to mitigate risk. How much risk is appropriate varies a lot by context. Beyond the context of risk, there is reasonable debate to be had on how to best provide access to essential services to vulnerable populations. It's pretty important to have an email nowadays and if you're not tech savvy or an individual/community has little to no money to spend it's not unreasonable to have the reality of the matter be that there may simply not be many good alternatives (or awareness of alternatives) to GMail. I'm not sure what a correct answer here looks like, but I don't think ignoring the need is an approach that gets us to a better society or enables vulnerable populations to better care for themselves.

lotsofpulp 4y ago
> there is reasonable debate to be had on how to best provide access to essential services to vulnerable populations. What is the debate? The government can collect taxes and provide services, like they do for multitude of other needs. > I'm not sure what a correct answer here looks like, but I don't think ignoring the need is an approach that gets us to a better society or enables vulnerable populations to better care for themselves. The correct answer is not depending on the largesse of businesses. It is using government resources to provide methods for identity verification, communications, and various other bare minimum needs for living.
- judge2020 4y ago
  > The correct answer is not depending on the largesse of businesses. It is using government resources to provide methods for identity verification, communications, and various other bare minimum needs for living. To be fair I don't see how any government system can do better regarding identity on the internet. Login.gov is one of the best services I've used for access to usajobs/SSA/etc but it follows some of the same security best practices people are complaining about here with no real way to re-gain access to your login.gov account should you lose your 2fa methods (afaik).
  - lotsofpulp 4y ago
    The US government uses the USPS to do identify verification for passports. If it can handle identity verification for passports, why would it not be able to handle identity verification for other purposes, such as replacing or reauthorizing one’s MFA device? Hell, it should be trivial to offer federal government provided emails with ID verification with customer service in the event of loss of device/loss of ID/death/etc.
    - angry_octet 4y ago
      The USPS and banks would be ideal identity validators. Having run a few mail servers I don't think the Govt is best placed to do that, but they could outsource it to google, with a few tweaks to allow identity attestation. Many other countries have a central government portal with secure messaging, with federated identify. Heavily reliant on 2FA of course.
    - judge2020 4y ago
      Passports require the most paperwork out of anything - your in particular, a birth certificate, a second form of ID including a driver's license, a photo, and $130+$35. The USPS isn't just looking at a face and issuing a passport. 0The issue here is that homeless don't hold onto anything physical for 4 months; identity verification breaks down in-person immediately as shelters/libraries can't be expected to run a facial recognition operation, and specific shelter employees/volunteers aren't guaranteed to be there anytime a homeless person might walk in and need those backup codes, but it breaks down even further online since 2fa is inherently 'what you know' + ('what you have'/'who you are').