5 ms·

"Not-my-problem" is a bad response, but the actual response is that without 2FA even more people lose access to their accounts. Anything that makes it harder fo

"Not-my-problem" is a bad response, but the actual response is that without 2FA even more people lose access to their accounts. Anything that makes it harder for adversaries to take over an account almost necessarily adds friction for the users themselves. This isn't a "fuck the people who don't have regular access to a phone, they don't matter" situation. It is a "there is an aggravating balancing act in this situation and no solution will avoid harming everybody."

dmix 4y ago
Yep, reducing standards for everyone in an attempt to help a small minority is also a growing trend in the west. Schools dumbing down so everyone gets A’s type of top level decision making. Sometimes you have to make hard choices where some people get burned because the alternatives are worse. That doesn’t mean you don’t care.
- paganel 4y ago
  > to help a small minority In this case the people asking for 2FA are the "small minority", and the rest of us have to suffer through 2FA-authentication hell because of them.
  - judge2020 4y ago
    > In this case the people asking for 2FA are the "small minority", and the rest of us have to suffer through 2FA-authentication hell because of them. How many people don't like 2fa because they don't know about all the times it's saved them from total account takeover?
    - arubania2 4y ago
      AKA https://en.m.wikipedia.org/wiki/Preparedness_paradox https://en.m.wikipedia.org/wiki/Preparedness_paradox
valenterry 4y ago
> but the actual response is that without 2FA even more people lose access to their accounts This is not black and white. It is possible to encourage 2FA but allow to opt out. The same for phone numbers. And that's why companies enforce 2FA: they want your juicy phone-number or other data. And yeah, maybe they also want to reduce support costs and avoid bad publicity. Still, it's not in your interest, it's in theirs. If they at least would allow for a sufficient number of options. Like paper-tan (even self printed), yubikey or similar, second email address, an authenticator, ... but even big companies often only require a phone number. EDIT: Yes, Google offers more than a phone number when creating a gmail account. I didn't say they don't. However: they don't make it easy and I would even go as far as saying that they are evil here. If you don't believe me, try to create a gmail account right now and don't google/search how to do it without phone number.
- lotsofpulp 4y ago
  > Still, it's not in your interest, it's in theirs. Which is okay, because it is a business. If society wants homeless people to have reliable access to email without having SMS 2FA or whatever requirements a business requires, then society should elect a government to provide it as a utility. There is no reason to expect or want businesses to pick up the slack for the government not providing adequate safety nets. Let businesses be businesses, and let governments handle redistributing wealth.
  - md_ 4y ago
    I think this is a better answer than it first appears. Initiatives at for profit corporations will always exist within some business constraints, shareholder obligations, and so forth. It would be very reasonable for governments to provide tax-supported digital services. I could easily imagine that spending a few dollars per year to provide the homeless with basic digital services would pay off simply in easing administrative overhead. But we don't do it, because, in America, our sense of what government can or should provide is atrophied, and we, mistakenly, look to private actors to provide basic public services.
    - 4y ago
jakelazaroff 4y ago
That's also a bad response. The tech industry literally exists to invent things. That's its entire purpose. Why should we satisfied with a status quo that neglects the most vulnerable among us? What is the point of technology if not to solve these problems?
- UncleMeat 4y ago
  Is there a solution? The claim in the link is that homeless people lose every single one of their possessions after a period of time. They also have minimal access to support structures that could be used as a recovery system. We've had decades of work on authentication and pretty much every solution either involves using a password manager to create unique passwords or having possession of a physical thing.
  - jakelazaroff 4y ago
    Consider that the decades of work has probably been done with the exact same blind spots we're discussing now.
    - UncleMeat 4y ago
      I'm really curious. What would you propose? The best I can think of is trusted backup accounts, which already exist. A homeless person with regular attachment to a family member or a social worker could set up that person's account as a backup. But this already exists and is likely to fail for a large number of homeless people, who tend to struggle at maintaining long term relationships with family members or social workers who'd be able to help them.
      - jakelazaroff 4y ago
        I don't have one. I'm not a security expert or researcher or anything like that. But the tech industry has invented thousands of things that to most people would have been inconceivable beforehand. That doesn't mean there's a way to improve on the tradeoffs we have now — but the fact that no one's invented it yet doesn't mean it can't exist. The tech industry self-styles as the smartest people in the world, who try to solve the hardest problems. All I'm saying is that we shouldn't throw our hands up when we can't immediately come up with a solution to something we only learned about five minutes ago.
DoingIsLearning 4y ago
I wonder how many people suffer identity theft versus how many have a working recovery email but are denied to use it because some algo finds it suspicious that you moved country or logged in from a linux machine? The key takeaway is not about how we should promote 2FA or how we should promote long ass passwords, the main issue at hand is google's neglectful lack of customer support. I was once caught in this non-sense many moons ago. But I learned my lesson, I absolutely do not rely on any google products for anything that has any potential to impact me personally (with the unfortunate exception of the Android OS on my phone). Google as a brand is absolutely dead in the water for anyone that has woken up from the 'Don't be evil' kool-aid of the early days.
- judge2020 4y ago
  > the main issue at hand is google's neglectful lack of customer support. Customer support is the main entrypoint into 99% of sim swapping attacks and would be similarly for any targeted account takeovers. What sort of information do you possibly think would be enough to prove someone actually owns a Google account over the phone?
  - UncleMeat 4y ago
    I've heard of some system for reviewing identification like drivers licenses in extreme cases, but homeless people are largely not going to have access to this either.
  - ImPostingOnHN 4y ago
    that is a phenomenal question that deserves to be answered by the highly paid engineers at Google they're smart, I'm sure they can find a way, even if it contains such horrible, detestable ideas like "more support staff" and "more training for support staff"
    - joshuamorton 4y ago
      Companies with highly trained support staff regularly fall for these attacks. The answer has been figured out by the highly trained engineers. It's "don't provide account recovery options that bypass 2fa". Yeah that sucks for a segment if people, but it sucks less than regularly getting your account stolen due to a social engineering attack. There really, truly, doesn't exist a panacea. You don't have and can't create an oracle that knows when an account recovery attempt is legitimate or not.

dmix 4y ago

Yep, reducing standards for everyone in an attempt to help a small minority is also a growing trend in the west. Schools dumbing down so everyone gets A’s type of top level decision making. Sometimes you have to make hard choices where some people get burned because the alternatives are worse. That doesn’t mean you don’t care.

paganel 4y ago
> to help a small minority In this case the people asking for 2FA are the "small minority", and the rest of us have to suffer through 2FA-authentication hell because of them.
- judge2020 4y ago
  > In this case the people asking for 2FA are the "small minority", and the rest of us have to suffer through 2FA-authentication hell because of them. How many people don't like 2fa because they don't know about all the times it's saved them from total account takeover?
  - arubania2 4y ago
    AKA https://en.m.wikipedia.org/wiki/Preparedness_paradox https://en.m.wikipedia.org/wiki/Preparedness_paradox

valenterry 4y ago

> but the actual response is that without 2FA even more people lose access to their accounts This is not black and white. It is possible to encourage 2FA but allow to opt out. The same for phone numbers. And that's why companies enforce 2FA: they want your juicy phone-number or other data. And yeah, maybe they also want to reduce support costs and avoid bad publicity. Still, it's not in your interest, it's in theirs. If they at least would allow for a sufficient number of options. Like paper-tan (even self printed), yubikey or similar, second email address, an authenticator, ... but even big companies often only require a phone number. EDIT: Yes, Google offers more than a phone number when creating a gmail account. I didn't say they don't. However: they don't make it easy and I would even go as far as saying that they are evil here. If you don't believe me, try to create a gmail account right now and don't google/search how to do it without phone number.

lotsofpulp 4y ago
> Still, it's not in your interest, it's in theirs. Which is okay, because it is a business. If society wants homeless people to have reliable access to email without having SMS 2FA or whatever requirements a business requires, then society should elect a government to provide it as a utility. There is no reason to expect or want businesses to pick up the slack for the government not providing adequate safety nets. Let businesses be businesses, and let governments handle redistributing wealth.
- md_ 4y ago
  I think this is a better answer than it first appears. Initiatives at for profit corporations will always exist within some business constraints, shareholder obligations, and so forth. It would be very reasonable for governments to provide tax-supported digital services. I could easily imagine that spending a few dollars per year to provide the homeless with basic digital services would pay off simply in easing administrative overhead. But we don't do it, because, in America, our sense of what government can or should provide is atrophied, and we, mistakenly, look to private actors to provide basic public services.
  - 4y ago

jakelazaroff 4y ago

That's also a bad response. The tech industry literally exists to invent things. That's its entire purpose. Why should we satisfied with a status quo that neglects the most vulnerable among us? What is the point of technology if not to solve these problems?

UncleMeat 4y ago
Is there a solution? The claim in the link is that homeless people lose every single one of their possessions after a period of time. They also have minimal access to support structures that could be used as a recovery system. We've had decades of work on authentication and pretty much every solution either involves using a password manager to create unique passwords or having possession of a physical thing.
- jakelazaroff 4y ago
  Consider that the decades of work has probably been done with the exact same blind spots we're discussing now.
  - UncleMeat 4y ago
    I'm really curious. What would you propose? The best I can think of is trusted backup accounts, which already exist. A homeless person with regular attachment to a family member or a social worker could set up that person's account as a backup. But this already exists and is likely to fail for a large number of homeless people, who tend to struggle at maintaining long term relationships with family members or social workers who'd be able to help them.
    - jakelazaroff 4y ago
      I don't have one. I'm not a security expert or researcher or anything like that. But the tech industry has invented thousands of things that to most people would have been inconceivable beforehand. That doesn't mean there's a way to improve on the tradeoffs we have now — but the fact that no one's invented it yet doesn't mean it can't exist. The tech industry self-styles as the smartest people in the world, who try to solve the hardest problems. All I'm saying is that we shouldn't throw our hands up when we can't immediately come up with a solution to something we only learned about five minutes ago.

DoingIsLearning 4y ago

I wonder how many people suffer identity theft versus how many have a working recovery email but are denied to use it because some algo finds it suspicious that you moved country or logged in from a linux machine? The key takeaway is not about how we should promote 2FA or how we should promote long ass passwords, the main issue at hand is google's neglectful lack of customer support. I was once caught in this non-sense many moons ago. But I learned my lesson, I absolutely do not rely on any google products for anything that has any potential to impact me personally (with the unfortunate exception of the Android OS on my phone). Google as a brand is absolutely dead in the water for anyone that has woken up from the 'Don't be evil' kool-aid of the early days.

judge2020 4y ago
> the main issue at hand is google's neglectful lack of customer support. Customer support is the main entrypoint into 99% of sim swapping attacks and would be similarly for any targeted account takeovers. What sort of information do you possibly think would be enough to prove someone actually owns a Google account over the phone?
- UncleMeat 4y ago
  I've heard of some system for reviewing identification like drivers licenses in extreme cases, but homeless people are largely not going to have access to this either.
- ImPostingOnHN 4y ago
  that is a phenomenal question that deserves to be answered by the highly paid engineers at Google they're smart, I'm sure they can find a way, even if it contains such horrible, detestable ideas like "more support staff" and "more training for support staff"
  - joshuamorton 4y ago
    Companies with highly trained support staff regularly fall for these attacks. The answer has been figured out by the highly trained engineers. It's "don't provide account recovery options that bypass 2fa". Yeah that sucks for a segment if people, but it sucks less than regularly getting your account stolen due to a social engineering attack. There really, truly, doesn't exist a panacea. You don't have and can't create an oracle that knows when an account recovery attempt is legitimate or not.