6 ms·

The problems are downstream of that. Not having 2FA is going to allow some portion of users to get hacked. When those users do get hacked they will need a way

The problems are downstream of that. Not having 2FA is going to allow some portion of users to get hacked. When those users do get hacked they will need a way to regain control of the account. Methods of regaining access to an account are notorious for bad actors social engineering their way to gaining control of accounts. 2FA relieves some of that, because even if you do get hacked you can provide a token from the authenticator that was attached to the account, proving that you do in fact own that account. > I think it's excessively paternalistic to not provide that option. I don't find it paternalistic. The goal is to cut down on support costs by reducing the number of users who get hacked and need assistance regaining access to their accounts, and to force users to have a method of demonstrating they own the account even if they can't log in. That it confers some additional security to users is nice, but not really the end goal.

Wowfunhappy 4y ago
> Not having 2FA is going to allow some portion of users to get hacked. When those users do get hacked they will need a way to regain control of the account. I don't think they do! This would be part of the tradeoff. Currently, people who cannot use or rely on 2FA are getting locked out of their accounts even if they weren't hacked and knew their password! Isn't that worse?
- jotm 4y ago
  What, how? I got "hacked", I mean yeah it was a hack using an Android phone and Google's automated recovery system. If not for the latter, my incredibru strong password would've saved me. They also removed the phone and backup email from that account because I recovered the account once. I sure hope 2FA cannot be removed once someone gains access (not without a call to the 2FA number/whatever) lol. Either way, I'm not using it because it's a pain in the ass. I already hate that they lock me out if I try to log in from another country. Gee, yeah I travel between EU countries, that's very unusual for most people.
- MichaelCollins 4y ago
  > Currently, people who cannot use or rely on 2FA are getting locked out of their accounts even if they weren't hacked and knew their password! Isn't that worse? Not if it's happening to fewer people than the alternative.
- everforward 4y ago
  > Currently, people who cannot use or rely on 2FA are getting locked out of their accounts even if they weren't hacked and knew their password! Isn't that worse? I don't think so. You seem to presume the end state of both is that the user is locked out, which is only half true. With a lost 2FA device, the user and everyone else is locked out of the account. With a compromised account, the user may be locked out but the hacker is not. The hacker is free to impersonate the user to social services, hospitals, potential employers, etc. If there's no mechanism for the user to regain control of the account, the hacker will have that access until the user can contact all of those people and give them a new email address. That could take a while, especially if we're considering that the user has a high chance of not having a phone at the moment.
  - elcomet 4y ago
    But the locked account is much more likely than the compromised password in the real world.
- chaostheory 4y ago
  Doesn’t Google offer the option of disabling 2FA?
tsimionescu 4y ago
> I don't find it paternalistic. The goal is to cut down on support costs by reducing the number of users who get hacked and need assistance regaining access to their accounts, and to force users to have a method of demonstrating they own the account even if they can't log in. That it confers some additional security to users is nice, but not really the end goal. So we should be mindful of Google's profit margins, instead of homeless people's access to vital services?
- asdfasgasdgasdg 4y ago
  If the service is truly vital it should be provided by the government, not Google. The government would also be free to set security policies and provide support at the level and cost demanded by the public. It is not and should not be the role of a private enterprise to act as a backstop for the fabric of society when it is not in their interests or their customers' overall interests.
  - tsimionescu 4y ago
    The vital services are provided by the government, but require an email address. Some people have trusted Google to be their email provider, and Google is failing some of those people by denying them access unnecessarily.
    - 8note 4y ago
      If vital services rely on email, email is a vital service
    - asdfasgasdgasdg 4y ago
      I'm saying that if the public/government doesn't feel like Google's security policies are compatible with the homeless, the simplest solution is to set up a government-run email host.
      - tsimionescu 4y ago
        Sure, the government should. But we should also expect Google to give a small crap about the troubles it's putting some of its users through, especially when this is so important to some of its most vulnerable users, and adding an option to disable 2FA is such a small feature for a Mega corporation.

Wowfunhappy 4y ago

> Not having 2FA is going to allow some portion of users to get hacked. When those users do get hacked they will need a way to regain control of the account. I don't think they do! This would be part of the tradeoff. Currently, people who cannot use or rely on 2FA are getting locked out of their accounts even if they weren't hacked and knew their password! Isn't that worse?

jotm 4y ago
What, how? I got "hacked", I mean yeah it was a hack using an Android phone and Google's automated recovery system. If not for the latter, my incredibru strong password would've saved me. They also removed the phone and backup email from that account because I recovered the account once. I sure hope 2FA cannot be removed once someone gains access (not without a call to the 2FA number/whatever) lol. Either way, I'm not using it because it's a pain in the ass. I already hate that they lock me out if I try to log in from another country. Gee, yeah I travel between EU countries, that's very unusual for most people.
MichaelCollins 4y ago
> Currently, people who cannot use or rely on 2FA are getting locked out of their accounts even if they weren't hacked and knew their password! Isn't that worse? Not if it's happening to fewer people than the alternative.
everforward 4y ago
> Currently, people who cannot use or rely on 2FA are getting locked out of their accounts even if they weren't hacked and knew their password! Isn't that worse? I don't think so. You seem to presume the end state of both is that the user is locked out, which is only half true. With a lost 2FA device, the user and everyone else is locked out of the account. With a compromised account, the user may be locked out but the hacker is not. The hacker is free to impersonate the user to social services, hospitals, potential employers, etc. If there's no mechanism for the user to regain control of the account, the hacker will have that access until the user can contact all of those people and give them a new email address. That could take a while, especially if we're considering that the user has a high chance of not having a phone at the moment.
- elcomet 4y ago
  But the locked account is much more likely than the compromised password in the real world.
chaostheory 4y ago
Doesn’t Google offer the option of disabling 2FA?

tsimionescu 4y ago

> I don't find it paternalistic. The goal is to cut down on support costs by reducing the number of users who get hacked and need assistance regaining access to their accounts, and to force users to have a method of demonstrating they own the account even if they can't log in. That it confers some additional security to users is nice, but not really the end goal. So we should be mindful of Google's profit margins, instead of homeless people's access to vital services?

asdfasgasdgasdg 4y ago
If the service is truly vital it should be provided by the government, not Google. The government would also be free to set security policies and provide support at the level and cost demanded by the public. It is not and should not be the role of a private enterprise to act as a backstop for the fabric of society when it is not in their interests or their customers' overall interests.
- tsimionescu 4y ago
  The vital services are provided by the government, but require an email address. Some people have trusted Google to be their email provider, and Google is failing some of those people by denying them access unnecessarily.
  - 8note 4y ago
    If vital services rely on email, email is a vital service
  - asdfasgasdgasdg 4y ago
    I'm saying that if the public/government doesn't feel like Google's security policies are compatible with the homeless, the simplest solution is to set up a government-run email host.
    - tsimionescu 4y ago
      Sure, the government should. But we should also expect Google to give a small crap about the troubles it's putting some of its users through, especially when this is so important to some of its most vulnerable users, and adding an option to disable 2FA is such a small feature for a Mega corporation.