6 ms·

Look, I'd love to fix homelessness in America! Really, I would! But Google's policies are causing people to get locked out of their accounts now, today. Google

Look, I'd love to fix homelessness in America! Really, I would! But Google's policies are causing people to get locked out of their accounts now, today. Google could put a toggle in Google Account settings titled something like "Allow anyone who knows my password to log in to my Google account (less secure)." It could sit above a description of the risks involved. It would need to be disabled by default, and it wouldn't help users who don't know about it. It certainly would not fix homelessness in society. But it would do a lot of good for a lot of people! Would this option lead to some increased number of hacked accounts? Probably, but these would be accounts that explicitly opted in to that risk! I think it's excessively paternalistic to not provide the option. Every life situation is unique, and people know their own lives better than Google does.

tick_tock_tick 4y ago
That wouldn't help at all unless it was the default.
- Wowfunhappy 4y ago
  Why? The homeless aren't stupid, and we have libraries and other institutions that can provide education.
everforward 4y ago
The problems are downstream of that. Not having 2FA is going to allow some portion of users to get hacked. When those users do get hacked they will need a way to regain control of the account. Methods of regaining access to an account are notorious for bad actors social engineering their way to gaining control of accounts. 2FA relieves some of that, because even if you do get hacked you can provide a token from the authenticator that was attached to the account, proving that you do in fact own that account. > I think it's excessively paternalistic to not provide that option. I don't find it paternalistic. The goal is to cut down on support costs by reducing the number of users who get hacked and need assistance regaining access to their accounts, and to force users to have a method of demonstrating they own the account even if they can't log in. That it confers some additional security to users is nice, but not really the end goal.
- Wowfunhappy 4y ago
  > Not having 2FA is going to allow some portion of users to get hacked. When those users do get hacked they will need a way to regain control of the account. I don't think they do! This would be part of the tradeoff. Currently, people who cannot use or rely on 2FA are getting locked out of their accounts even if they weren't hacked and knew their password! Isn't that worse?
  - jotm 4y ago
    What, how? I got "hacked", I mean yeah it was a hack using an Android phone and Google's automated recovery system. If not for the latter, my incredibru strong password would've saved me. They also removed the phone and backup email from that account because I recovered the account once. I sure hope 2FA cannot be removed once someone gains access (not without a call to the 2FA number/whatever) lol. Either way, I'm not using it because it's a pain in the ass. I already hate that they lock me out if I try to log in from another country. Gee, yeah I travel between EU countries, that's very unusual for most people.
  - MichaelCollins 4y ago
    > Currently, people who cannot use or rely on 2FA are getting locked out of their accounts even if they weren't hacked and knew their password! Isn't that worse? Not if it's happening to fewer people than the alternative.
  - everforward 4y ago
    > Currently, people who cannot use or rely on 2FA are getting locked out of their accounts even if they weren't hacked and knew their password! Isn't that worse? I don't think so. You seem to presume the end state of both is that the user is locked out, which is only half true. With a lost 2FA device, the user and everyone else is locked out of the account. With a compromised account, the user may be locked out but the hacker is not. The hacker is free to impersonate the user to social services, hospitals, potential employers, etc. If there's no mechanism for the user to regain control of the account, the hacker will have that access until the user can contact all of those people and give them a new email address. That could take a while, especially if we're considering that the user has a high chance of not having a phone at the moment.
sdenton4 4y ago
This seems like something the homeless services are best positioned to fix by providing email hosting to their clients. They know their clients are actual humans, not hackers, so can provide the continuity that the giant providers can't.
mattmcknight 4y ago
The case workers could have an email account to use as the recovery email account. This already exists.
- Wowfunhappy 4y ago
  While I don't think that's a bad idea in some situations, it means trusting the case worker with access to the entire account (as they could use the recovery email to reset the password). It's also an extra burden to put on the case worker, and the individual who has to coordinate with the case worker.
  - notabee 4y ago
    Additionally, this only exists in some magical, fantastical world where the unhoused only have one case worker. In reality the unhoused bounce between a patchwork of government and non-profit services, and because of the soul-crushing workload and emotional labor of those jobs the individuals in each role are also subject to frequent turnover. So the only way this would work is an account that's shared between everyone who might work with that unhoused client at each organization (there are often multiple handling different aspects such as housing, mental health, money for groceries, etc.), and as clients move geographically or do other things that make them eligible or ineligible for each organization's services, that recovery account would also need to change or transition to some new org. Even a single recovery email address is just a totally unworkable solution for the reality they face.
thereddaikon 4y ago
This is a result of taking a product made by someone else for a certain purpose and then using it for one it isn't intended. Its not Google's fault gmail is a bad fit here. They didn't design it with this use case in mind. The solution is to use one that is. Why are case workers directing the homeless to setup gmail accounts? Because they haven't been provided with a better solution by the system they work within. So its the government's problem to fix. They are the ones handing out phones and setting the expectation to communicate through email. So they can either design an email service themselves that fits their needs. Or they can work with an industry partner, such as google or someone else to provide the service. Normal gmail is a one size fits all commodity solution. It works well enough for most people, most of the time. Specialized problems call for specialized solutions. Complaining that google didn't think of you is misplaced.
- Wowfunhappy 4y ago
  Should users with poor vision also have to use a special blind-person email provider? Because, I'd expect supporting screen readers to take significantly more effort than adding the setting I outlined. Also, if I was homeless, I wouldn't want my email address to indicate I was homeless. I broadly agree that it isn't Google's job to cater to everyone, but in this instance, the ask seems overwhelmingly reasonable—and less than what we expect in other circumstances.
  - Kalium 4y ago
    What is the ask that is overwhelmingly reasonable? As has been pointed out to me and others, Google already offers a way to turn off 2FA - https://support.google.com/accounts/answer/1064203 https://support.google.com/accounts/answer/1064203 Naively this seems like it should solve the 2FA problem for the unhoused community members in question. With this in mind, what else should Google do?
    - Wowfunhappy 4y ago
      Even when 2FA is disabled, Google will insist on additional verification (phone, recovery email, etc) if it thinks something about your browser or IP address is unusual, even if you know your password. If you don't have a verification method (or cannot access it), Google will literally just lock you out. I have personally experienced this. It should be possible to turn this off!
jonas21 4y ago
That's almost exactly what Google has done. Here's how you turn off 2FA on your account: 1. Go to myaccount.google.com 2. Press "Security" 3. Press "2 step verification" 4. Enter your password 5. Press "Turn off" 6. Confirm the dialog that says "Turning off 2-Step Verification will remove the extra security on your account, and you’ll only use your password to sign in."
- tyingq 4y ago
  I recall that the problem was broader than 2FA. They also re-verify accounts that have been idle, or that are being accessed from a new location. Or issues if you've forgotten the password and don't have a phone.
  - Wowfunhappy 4y ago
    This is exactly it. And if you don't have a verification method on file, Google will just lock the account if it thinks something about your browser or IP address is unusual. Even if you know your password.
    - mrec 4y ago
      Speaking as a long-time Gmail user who doesn't have a mobile, this is kind of terrifying. Sounds like I need to look into moving to Fastmail or somesuch pronto.
      - Wowfunhappy 4y ago
        If you have a backup email on your account, that's sufficient (assuming you can get into the backup email), at least in my experience.
- deleted 4y ago
  [deleted]
- aetch 4y ago
  Those steps don’t actually turn off 2FA for Google accounts. If you login from a new computer or unrecognized IP, Google forces you to use the YouTube app on your phone to enter a “code” to login. It sometimes doesn’t even let you get a text code. God forbid I lose my phone or delete the YouTube app and login from a new IP. I don’t know how I would even get into my account. I don’t know how this isn’t a wider spread issue affecting more people but I guess Google developers live in a perfect world where the YouTube app auth can never fail and you never lose your phone.
TacticalCoder 4y ago
> Google could put a toggle in Google Account settings titled something like "Allow anyone who knows my password to log in to my Google account (less secure)." Google allows someone of your choosing, who must also have a GMail account, to takeover one's account after x months of inactivity. It's not great but it's better than nothing and it has the benefit of being an option that exists today.
_chu1 4y ago
How about just don't use Google services, Tutanota is free and is just as good.
deleted 4y ago
[deleted]
maxerickson 4y ago
The state could run an email service.
puglr 4y ago
While your proposal is perfectly reasonable, I couldn't help but notice that your opening was an example of the "'think of the kids + terrorism'" mentioned by GP. > Look, I'd love to stop CP distribution in America! Really, I would! But Google's encryption policies are preventing law enforcement from intercepting pedophile communications now, today. It's the same "think of [vulnerable group]" type of statement.
- Wowfunhappy 4y ago
  The purpose of that sentence was to bring us back to the issue at hand. GP was essentially saying (as I interpreted it) that we should focus on the root causes of homelessness instead of worrying about day-to-day concerns like how the homeless access email. I think we should do both, especially when the latter would be relatively simple. But also, yes, there are in fact many times when it's important to consider the needs of different groups of people! That isn't to say that the ends always justify the means—it depends on what the means are—but reasonable accommodations should be made where possible.
professorTuring 4y ago
I can understand your statement, but by doing that you will find that A LOT of people will check the insecure options because “that a not going to happen to me”. Remember you have the “rescue keys” from google to avoid these kind of problems. The bigger problem is how you teach those people how to use the services in their situation.

tick_tock_tick 4y ago

That wouldn't help at all unless it was the default.

Wowfunhappy 4y ago
Why? The homeless aren't stupid, and we have libraries and other institutions that can provide education.

everforward 4y ago

The problems are downstream of that. Not having 2FA is going to allow some portion of users to get hacked. When those users do get hacked they will need a way to regain control of the account. Methods of regaining access to an account are notorious for bad actors social engineering their way to gaining control of accounts. 2FA relieves some of that, because even if you do get hacked you can provide a token from the authenticator that was attached to the account, proving that you do in fact own that account. > I think it's excessively paternalistic to not provide that option. I don't find it paternalistic. The goal is to cut down on support costs by reducing the number of users who get hacked and need assistance regaining access to their accounts, and to force users to have a method of demonstrating they own the account even if they can't log in. That it confers some additional security to users is nice, but not really the end goal.

Wowfunhappy 4y ago
> Not having 2FA is going to allow some portion of users to get hacked. When those users do get hacked they will need a way to regain control of the account. I don't think they do! This would be part of the tradeoff. Currently, people who cannot use or rely on 2FA are getting locked out of their accounts even if they weren't hacked and knew their password! Isn't that worse?
- jotm 4y ago
  What, how? I got "hacked", I mean yeah it was a hack using an Android phone and Google's automated recovery system. If not for the latter, my incredibru strong password would've saved me. They also removed the phone and backup email from that account because I recovered the account once. I sure hope 2FA cannot be removed once someone gains access (not without a call to the 2FA number/whatever) lol. Either way, I'm not using it because it's a pain in the ass. I already hate that they lock me out if I try to log in from another country. Gee, yeah I travel between EU countries, that's very unusual for most people.
- MichaelCollins 4y ago
  > Currently, people who cannot use or rely on 2FA are getting locked out of their accounts even if they weren't hacked and knew their password! Isn't that worse? Not if it's happening to fewer people than the alternative.
- everforward 4y ago
  > Currently, people who cannot use or rely on 2FA are getting locked out of their accounts even if they weren't hacked and knew their password! Isn't that worse? I don't think so. You seem to presume the end state of both is that the user is locked out, which is only half true. With a lost 2FA device, the user and everyone else is locked out of the account. With a compromised account, the user may be locked out but the hacker is not. The hacker is free to impersonate the user to social services, hospitals, potential employers, etc. If there's no mechanism for the user to regain control of the account, the hacker will have that access until the user can contact all of those people and give them a new email address. That could take a while, especially if we're considering that the user has a high chance of not having a phone at the moment.

sdenton4 4y ago

This seems like something the homeless services are best positioned to fix by providing email hosting to their clients. They know their clients are actual humans, not hackers, so can provide the continuity that the giant providers can't.

mattmcknight 4y ago

The case workers could have an email account to use as the recovery email account. This already exists.

Wowfunhappy 4y ago
While I don't think that's a bad idea in some situations, it means trusting the case worker with access to the entire account (as they could use the recovery email to reset the password). It's also an extra burden to put on the case worker, and the individual who has to coordinate with the case worker.
- notabee 4y ago
  Additionally, this only exists in some magical, fantastical world where the unhoused only have one case worker. In reality the unhoused bounce between a patchwork of government and non-profit services, and because of the soul-crushing workload and emotional labor of those jobs the individuals in each role are also subject to frequent turnover. So the only way this would work is an account that's shared between everyone who might work with that unhoused client at each organization (there are often multiple handling different aspects such as housing, mental health, money for groceries, etc.), and as clients move geographically or do other things that make them eligible or ineligible for each organization's services, that recovery account would also need to change or transition to some new org. Even a single recovery email address is just a totally unworkable solution for the reality they face.

thereddaikon 4y ago

This is a result of taking a product made by someone else for a certain purpose and then using it for one it isn't intended. Its not Google's fault gmail is a bad fit here. They didn't design it with this use case in mind. The solution is to use one that is. Why are case workers directing the homeless to setup gmail accounts? Because they haven't been provided with a better solution by the system they work within. So its the government's problem to fix. They are the ones handing out phones and setting the expectation to communicate through email. So they can either design an email service themselves that fits their needs. Or they can work with an industry partner, such as google or someone else to provide the service. Normal gmail is a one size fits all commodity solution. It works well enough for most people, most of the time. Specialized problems call for specialized solutions. Complaining that google didn't think of you is misplaced.

Wowfunhappy 4y ago
Should users with poor vision also have to use a special blind-person email provider? Because, I'd expect supporting screen readers to take significantly more effort than adding the setting I outlined. Also, if I was homeless, I wouldn't want my email address to indicate I was homeless. I broadly agree that it isn't Google's job to cater to everyone, but in this instance, the ask seems overwhelmingly reasonable—and less than what we expect in other circumstances.
- Kalium 4y ago
  What is the ask that is overwhelmingly reasonable? As has been pointed out to me and others, Google already offers a way to turn off 2FA - https://support.google.com/accounts/answer/1064203 https://support.google.com/accounts/answer/1064203 Naively this seems like it should solve the 2FA problem for the unhoused community members in question. With this in mind, what else should Google do?
  - Wowfunhappy 4y ago
    Even when 2FA is disabled, Google will insist on additional verification (phone, recovery email, etc) if it thinks something about your browser or IP address is unusual, even if you know your password. If you don't have a verification method (or cannot access it), Google will literally just lock you out. I have personally experienced this. It should be possible to turn this off!

jonas21 4y ago

That's almost exactly what Google has done. Here's how you turn off 2FA on your account: 1. Go to myaccount.google.com 2. Press "Security" 3. Press "2 step verification" 4. Enter your password 5. Press "Turn off" 6. Confirm the dialog that says "Turning off 2-Step Verification will remove the extra security on your account, and you’ll only use your password to sign in."

tyingq 4y ago
I recall that the problem was broader than 2FA. They also re-verify accounts that have been idle, or that are being accessed from a new location. Or issues if you've forgotten the password and don't have a phone.
- Wowfunhappy 4y ago
  This is exactly it. And if you don't have a verification method on file, Google will just lock the account if it thinks something about your browser or IP address is unusual. Even if you know your password.
  - mrec 4y ago
    Speaking as a long-time Gmail user who doesn't have a mobile, this is kind of terrifying. Sounds like I need to look into moving to Fastmail or somesuch pronto.
    - Wowfunhappy 4y ago
      If you have a backup email on your account, that's sufficient (assuming you can get into the backup email), at least in my experience.
deleted 4y ago
[deleted]
aetch 4y ago
Those steps don’t actually turn off 2FA for Google accounts. If you login from a new computer or unrecognized IP, Google forces you to use the YouTube app on your phone to enter a “code” to login. It sometimes doesn’t even let you get a text code. God forbid I lose my phone or delete the YouTube app and login from a new IP. I don’t know how I would even get into my account. I don’t know how this isn’t a wider spread issue affecting more people but I guess Google developers live in a perfect world where the YouTube app auth can never fail and you never lose your phone.

TacticalCoder 4y ago

> Google could put a toggle in Google Account settings titled something like "Allow anyone who knows my password to log in to my Google account (less secure)." Google allows someone of your choosing, who must also have a GMail account, to takeover one's account after x months of inactivity. It's not great but it's better than nothing and it has the benefit of being an option that exists today.

_chu1 4y ago

How about just don't use Google services, Tutanota is free and is just as good.

deleted 4y ago

[deleted]

maxerickson 4y ago

The state could run an email service.

puglr 4y ago

While your proposal is perfectly reasonable, I couldn't help but notice that your opening was an example of the "'think of the kids + terrorism'" mentioned by GP. > Look, I'd love to stop CP distribution in America! Really, I would! But Google's encryption policies are preventing law enforcement from intercepting pedophile communications now, today. It's the same "think of [vulnerable group]" type of statement.

Wowfunhappy 4y ago
The purpose of that sentence was to bring us back to the issue at hand. GP was essentially saying (as I interpreted it) that we should focus on the root causes of homelessness instead of worrying about day-to-day concerns like how the homeless access email. I think we should do both, especially when the latter would be relatively simple. But also, yes, there are in fact many times when it's important to consider the needs of different groups of people! That isn't to say that the ends always justify the means—it depends on what the means are—but reasonable accommodations should be made where possible.

professorTuring 4y ago

I can understand your statement, but by doing that you will find that A LOT of people will check the insecure options because “that a not going to happen to me”. Remember you have the “rescue keys” from google to avoid these kind of problems. The bigger problem is how you teach those people how to use the services in their situation.