4 ms·

That's also a bad response. The tech industry literally exists to invent things. That's its entire purpose. Why should we satisfied with a status quo that negle

That's also a bad response. The tech industry literally exists to invent things. That's its entire purpose. Why should we satisfied with a status quo that neglects the most vulnerable among us? What is the point of technology if not to solve these problems?

UncleMeat 4y ago
Is there a solution? The claim in the link is that homeless people lose every single one of their possessions after a period of time. They also have minimal access to support structures that could be used as a recovery system. We've had decades of work on authentication and pretty much every solution either involves using a password manager to create unique passwords or having possession of a physical thing.
- jakelazaroff 4y ago
  Consider that the decades of work has probably been done with the exact same blind spots we're discussing now.
  - UncleMeat 4y ago
    I'm really curious. What would you propose? The best I can think of is trusted backup accounts, which already exist. A homeless person with regular attachment to a family member or a social worker could set up that person's account as a backup. But this already exists and is likely to fail for a large number of homeless people, who tend to struggle at maintaining long term relationships with family members or social workers who'd be able to help them.
    - jakelazaroff 4y ago
      I don't have one. I'm not a security expert or researcher or anything like that. But the tech industry has invented thousands of things that to most people would have been inconceivable beforehand. That doesn't mean there's a way to improve on the tradeoffs we have now — but the fact that no one's invented it yet doesn't mean it can't exist. The tech industry self-styles as the smartest people in the world, who try to solve the hardest problems. All I'm saying is that we shouldn't throw our hands up when we can't immediately come up with a solution to something we only learned about five minutes ago.
      - Arainach 4y ago
        This isn't something we learned about five minutes ago. It's been known that people lose their phones for a very long time. The tradeoffs were considered when designing the system. Treating the tech industry as a magical black box that can "solve anything" is disingenous and dangerous. This is the exact same attitude that leads to things such as legislation that says "find a way for any communication to be decrypted upon subpoena. You're tech people, figure it out"
      - b3morales 4y ago
        > The tech industry self-styles as the smartest people in the world, who try to solve the hardest problems. I think this is a good point, but the catch is that there's an implicit footnote that needs to be attached to "the hardest problems*": "*Which generate sufficient monetary returns". This particular problem isn't one that has much revenue potential.
    - nyuszika7h 4y ago
      > I'm really curious. What would you propose? The solution is very simple. Don't force 2FA. I'm sure most homeless people would rather risk the unlikely case of their accounts being hacked if they didn't choose a strong enough password to memorize than risk getting locked out of their accounts permanently. You can encourage 2FA but forcibly enabling it for everyone does more harm than good, especially to homeless people but also non-tech-savvy parents and such (though the latter would be more likely to have a working recovery method).
      - UncleMeat 4y ago
        > The solution is very simple. Don't force 2FA. And then in alternative-universe HN people are complaining about the rate of account takeovers via credential stuffing and calling Google irresponsible for making it easy to disable a powerful security measure. > You can encourage 2FA but forcibly enabling it for everyone does more harm than good I'd wager that pretty much the only people on the planet who can definitively say this are the people who handle account takeovers and lockouts of large email services. My understanding is that the folks at Google responsible for this have concluded that making it behave the way it currently does is the setup that causes the fewest people to lose access to their accounts.
- bombcar 4y ago
  Surgical implanting yubikeys. That won't at all bother anyone homeless, because there's never been a homeless person who was a conspiracy theorist. (Obvious sarcasm detected)
  - yellowapple 4y ago
    An only-slightly-less-sarcastic solution would be to get a tattoo of the recovery codes.
- nyuszika7h 4y ago
  Password managers are absolutely not required. While they're a good idea for most of us who don't have to worry about having somewhere to sleep, homeless people can still most likely memorize a password and remember it after a few tries. They can't do that if 2FA is forced on them.
  - UncleMeat 4y ago
    Everybody sucks at memorizing unique passwords. I'd be stunned if homeless people are consistently not reusing passwords. Credential stuffing is the #1 form of account takeover and 2FA is the solution.
- GraphenePants 4y ago
  The 3-2-1 backup strategy requires an offsite backup. It's unclear what advantage was forseen by the homeless when the decision was made to forgo this guidance.

UncleMeat 4y ago

Is there a solution? The claim in the link is that homeless people lose every single one of their possessions after a period of time. They also have minimal access to support structures that could be used as a recovery system. We've had decades of work on authentication and pretty much every solution either involves using a password manager to create unique passwords or having possession of a physical thing.

jakelazaroff 4y ago
Consider that the decades of work has probably been done with the exact same blind spots we're discussing now.
- UncleMeat 4y ago
  I'm really curious. What would you propose? The best I can think of is trusted backup accounts, which already exist. A homeless person with regular attachment to a family member or a social worker could set up that person's account as a backup. But this already exists and is likely to fail for a large number of homeless people, who tend to struggle at maintaining long term relationships with family members or social workers who'd be able to help them.
  - jakelazaroff 4y ago
    I don't have one. I'm not a security expert or researcher or anything like that. But the tech industry has invented thousands of things that to most people would have been inconceivable beforehand. That doesn't mean there's a way to improve on the tradeoffs we have now — but the fact that no one's invented it yet doesn't mean it can't exist. The tech industry self-styles as the smartest people in the world, who try to solve the hardest problems. All I'm saying is that we shouldn't throw our hands up when we can't immediately come up with a solution to something we only learned about five minutes ago.
    - Arainach 4y ago
      This isn't something we learned about five minutes ago. It's been known that people lose their phones for a very long time. The tradeoffs were considered when designing the system. Treating the tech industry as a magical black box that can "solve anything" is disingenous and dangerous. This is the exact same attitude that leads to things such as legislation that says "find a way for any communication to be decrypted upon subpoena. You're tech people, figure it out"
    - b3morales 4y ago
      > The tech industry self-styles as the smartest people in the world, who try to solve the hardest problems. I think this is a good point, but the catch is that there's an implicit footnote that needs to be attached to "the hardest problems*": "*Which generate sufficient monetary returns". This particular problem isn't one that has much revenue potential.
  - nyuszika7h 4y ago
    > I'm really curious. What would you propose? The solution is very simple. Don't force 2FA. I'm sure most homeless people would rather risk the unlikely case of their accounts being hacked if they didn't choose a strong enough password to memorize than risk getting locked out of their accounts permanently. You can encourage 2FA but forcibly enabling it for everyone does more harm than good, especially to homeless people but also non-tech-savvy parents and such (though the latter would be more likely to have a working recovery method).
    - UncleMeat 4y ago
      > The solution is very simple. Don't force 2FA. And then in alternative-universe HN people are complaining about the rate of account takeovers via credential stuffing and calling Google irresponsible for making it easy to disable a powerful security measure. > You can encourage 2FA but forcibly enabling it for everyone does more harm than good I'd wager that pretty much the only people on the planet who can definitively say this are the people who handle account takeovers and lockouts of large email services. My understanding is that the folks at Google responsible for this have concluded that making it behave the way it currently does is the setup that causes the fewest people to lose access to their accounts.
bombcar 4y ago
Surgical implanting yubikeys. That won't at all bother anyone homeless, because there's never been a homeless person who was a conspiracy theorist. (Obvious sarcasm detected)
- yellowapple 4y ago
  An only-slightly-less-sarcastic solution would be to get a tattoo of the recovery codes.
nyuszika7h 4y ago
Password managers are absolutely not required. While they're a good idea for most of us who don't have to worry about having somewhere to sleep, homeless people can still most likely memorize a password and remember it after a few tries. They can't do that if 2FA is forced on them.
- UncleMeat 4y ago
  Everybody sucks at memorizing unique passwords. I'd be stunned if homeless people are consistently not reusing passwords. Credential stuffing is the #1 form of account takeover and 2FA is the solution.
GraphenePants 4y ago
The 3-2-1 backup strategy requires an offsite backup. It's unclear what advantage was forseen by the homeless when the decision was made to forgo this guidance.