4 ms·

OK. Let's play a game. Let's say I care. Let's say I care a lot. I care so much that I'm willing to make it my personal problem to address the very real, very

by Kalium 4y ago

OK. Let's play a game. Let's say I care. Let's say I care a lot. I care so much that I'm willing to make it my personal problem to address the very real, very pressing needs of a critically vulnerable and marginalized part of my community from inside Google. What am I going to do? Is anyone going to be happier if I stand up and proclaim loudly how much I care? Probably not. Could I say "Gee, what if we just let everyone put themselves in the group of people who don't do 2FA"? Yes, if I wanted to be responsible for a lot of people not securing their accounts. Could I outsource identity verification to a wide assortment of groups (libraries, non-profits, etc.)? Absolutely, so long as I'm alright with this being used to gain improper access to a LOT of accounts outside the target segment. Could I offer more password chances and friendlier lockout times? Sure, so long as I'm OK with the negative consequences of this for a lot of people. OK. Let's end the game now. We don't really have any major steps towards real solutions here. Empathy is very useful for showing where a problem is. Demanding what amounts to lowering the global bar for account security is perhaps not the ideal approach here. Sometimes problems are just hard. Taking ownership and feeling empathy and sincerely wanting to solve the problem does not render them easy.

gsatic 4y ago
What do you think the moral of Jurassic Park was? If you dont know how to control what happens in the park you build, then the park will be shutdown. In the case of Google its not hard to speed up the process of shutdown. I just encourage them to keep working on more and more mindless ivory tower trash like Pixel phones, watches etc and inject more Ads into everything. They dont have the imagination for anything else but want a pat on the head for whatever they build. Give it to them.
- Kalium 4y ago
  It seems to me that Google is in full control of what they've built here. They've chosen not to put in the effort to find a way to meet the needs of this portion of their user community. On the one hand, this can be quite reasonably derided as a lack of imagination. Surely there must be a way to do it! On the other hand, well, we as a society accept that businesses are generally allowed to decide they just don't want to be in a market segment or produce some features. Bridgestone is not compelled by law to have a store in every neighborhood. Montblanc is not forced to produce disposable ballpoint pens. Perhaps we should treat this as Google admitting the limits of what they're willing and able to build. There is no shame in knowing your limits.
  - x0x0 4y ago
    It seems likely that enabling insecure account usage would be a net negative to huge swaths of their user base. Gmail is functionally the root of trust / skeleton key to millions of people's online lives. The only real competitor is Facebook and, for some, Apple. I think Gmail is far better (more secure, more privacy respecting, less capricious) than Facebook. With the admission by Chad that that homeless he advocates for can't retain mobile numbers, or ID cards, or 2fa keys, I have no idea how he thinks any secure access could possibly work.
    - Kalium 4y ago
      I have the nagging sense that what we're seeing amounts to throwing one's hands in the air and exclaiming "There must be a way!" As others have pointed out, turning off 2FA is available. Apparently that doesn't work either because the people in question forget their passwords. So I guess we should add passwords and biometrics (not available on all hardware) to the list of things that aren't going to work. Like you, I'm left wondering what there is to anchor any level of security.
hairofadog 4y ago
I guess I don't see a lot of difference between the practical results of loudly proclaiming empathy vs. loudly proclaiming cynicism.
- deleted 4y ago
  [deleted]
themitigating 4y ago
Empathy is the motivation and starting point. Even if you don't go beyond that step you can vote for those that will. "Sometimes problems are just hard. Taking ownership and feeling empathy and sincerely wanting to solve the problem does not render them easy." No one said it did and it's better than not caring at all.
- Kalium 4y ago
  While I agree that empathy is the motivation and starting point, I do want to note that a lot of people in this discussion do seem to sincerely believe that this problem would be easy for Google to solve if they just cared enough. The framing of "Google's product designers should talk to my unhoused friends" in the tweet linked seems invested in this idea. What if the most empathetic answer here is "This isn't really the right service for you"?
angry_octet 4y ago
You're reducing the concept to an absurdly simplistic level in order to create simple vulnerabilities. As I wrote, THIS WOULD NOT BE THE DEFAULT. It is quite possible to pre nominate the specific groups that can allow unlocking of an individual account. And that's all it is, account unlock when they use a new device, or putting the account into PW only mode for a period. If the PW is forgotten you require a higher level of identity verification, like a bank/USPS/DMV process. Facebook already has this enabled, you can have a friend/family member (or two of them!) validate your account. If you're determined not to find solutions then you won't progress.
- Kalium 4y ago
  Gmail already has a system for using one account to unlock another, so no changes required there. A bank, USPS, or DMV generally requires ID or other identifying documents. The people we're trying to help often struggle to retain physical possessions like ID. It's not that I'm determined to not find solutions. It's that I am determined to find solutions that don't create a degraded security state ready-made to abuse people's email accounts. Sometimes finding a good solution requires looking somewhere other than under the streetlight. Like others, I'm led to the conclusion that perhaps Google isn't the party best positioned to solve this particular pain point for our most vulnerable and marginalized community members. Maybe we should be paying more attention to why Lifeline numbers aren't portable.
  - angry_octet 4y ago
    It's routine in disaster relief situations that people lose all their documents but then governments step in and allow identity verification via vouching: this other person Alice says you're Bob. Then Bob gets his photo on a temporary ID document and gets a DR payment. Social workers, shelters, libraries etc are well placed to support that. They know these people because they see them every day. If you choose to enrol in the "community assisted recovery" process then you could enrol a new device into your email with their help. Put a big red banner at the top of the email client saying "Community recovery via Topeka Library, Kansas". Lifeline numbers aren't portable because people have no way to prove their ownership of the previous number, because they have no ID.

by Kalium 4y ago

gsatic 4y ago

What do you think the moral of Jurassic Park was? If you dont know how to control what happens in the park you build, then the park will be shutdown. In the case of Google its not hard to speed up the process of shutdown. I just encourage them to keep working on more and more mindless ivory tower trash like Pixel phones, watches etc and inject more Ads into everything. They dont have the imagination for anything else but want a pat on the head for whatever they build. Give it to them.

Kalium 4y ago
It seems to me that Google is in full control of what they've built here. They've chosen not to put in the effort to find a way to meet the needs of this portion of their user community. On the one hand, this can be quite reasonably derided as a lack of imagination. Surely there must be a way to do it! On the other hand, well, we as a society accept that businesses are generally allowed to decide they just don't want to be in a market segment or produce some features. Bridgestone is not compelled by law to have a store in every neighborhood. Montblanc is not forced to produce disposable ballpoint pens. Perhaps we should treat this as Google admitting the limits of what they're willing and able to build. There is no shame in knowing your limits.
- x0x0 4y ago
  It seems likely that enabling insecure account usage would be a net negative to huge swaths of their user base. Gmail is functionally the root of trust / skeleton key to millions of people's online lives. The only real competitor is Facebook and, for some, Apple. I think Gmail is far better (more secure, more privacy respecting, less capricious) than Facebook. With the admission by Chad that that homeless he advocates for can't retain mobile numbers, or ID cards, or 2fa keys, I have no idea how he thinks any secure access could possibly work.
  - Kalium 4y ago
    I have the nagging sense that what we're seeing amounts to throwing one's hands in the air and exclaiming "There must be a way!" As others have pointed out, turning off 2FA is available. Apparently that doesn't work either because the people in question forget their passwords. So I guess we should add passwords and biometrics (not available on all hardware) to the list of things that aren't going to work. Like you, I'm left wondering what there is to anchor any level of security.

hairofadog 4y ago

I guess I don't see a lot of difference between the practical results of loudly proclaiming empathy vs. loudly proclaiming cynicism.

deleted 4y ago
[deleted]

themitigating 4y ago

Empathy is the motivation and starting point. Even if you don't go beyond that step you can vote for those that will. "Sometimes problems are just hard. Taking ownership and feeling empathy and sincerely wanting to solve the problem does not render them easy." No one said it did and it's better than not caring at all.

Kalium 4y ago
While I agree that empathy is the motivation and starting point, I do want to note that a lot of people in this discussion do seem to sincerely believe that this problem would be easy for Google to solve if they just cared enough. The framing of "Google's product designers should talk to my unhoused friends" in the tweet linked seems invested in this idea. What if the most empathetic answer here is "This isn't really the right service for you"?

angry_octet 4y ago

You're reducing the concept to an absurdly simplistic level in order to create simple vulnerabilities. As I wrote, THIS WOULD NOT BE THE DEFAULT. It is quite possible to pre nominate the specific groups that can allow unlocking of an individual account. And that's all it is, account unlock when they use a new device, or putting the account into PW only mode for a period. If the PW is forgotten you require a higher level of identity verification, like a bank/USPS/DMV process. Facebook already has this enabled, you can have a friend/family member (or two of them!) validate your account. If you're determined not to find solutions then you won't progress.

Kalium 4y ago
Gmail already has a system for using one account to unlock another, so no changes required there. A bank, USPS, or DMV generally requires ID or other identifying documents. The people we're trying to help often struggle to retain physical possessions like ID. It's not that I'm determined to not find solutions. It's that I am determined to find solutions that don't create a degraded security state ready-made to abuse people's email accounts. Sometimes finding a good solution requires looking somewhere other than under the streetlight. Like others, I'm led to the conclusion that perhaps Google isn't the party best positioned to solve this particular pain point for our most vulnerable and marginalized community members. Maybe we should be paying more attention to why Lifeline numbers aren't portable.
- angry_octet 4y ago
  It's routine in disaster relief situations that people lose all their documents but then governments step in and allow identity verification via vouching: this other person Alice says you're Bob. Then Bob gets his photo on a temporary ID document and gets a DR payment. Social workers, shelters, libraries etc are well placed to support that. They know these people because they see them every day. If you choose to enrol in the "community assisted recovery" process then you could enrol a new device into your email with their help. Put a big red banner at the top of the email client saying "Community recovery via Topeka Library, Kansas". Lifeline numbers aren't portable because people have no way to prove their ownership of the previous number, because they have no ID.