Librarian's Letter to Google Security

I suspect that this is yet another situation where public libraries are going to have to step up to the plate and provide services to fill in the gap. In this case, it would be email services to patrons.

The Googles of the world exist because they provide inexpensive services through automation and at scale. They are poorly positioned to provide services that cannot be automated at scale. Chances are that any attempt to do so would likely bankrupt them even though we are talking about extremely wealthy corporations. (Keep in mind that we only hear of a fraction of the complaints about Google. Few people have the reach or ability to have their voices heard.)

On the other hand, libraries are already embedded in the community. They already have personnel who can better understand and respond to situations that Google would regard as edge cases. They are also much smaller organizations that have less bureaucracy to deal with and a mission that aligns with the needs of the community.

I am not saying that they have to provide the actual email servers. They could contract that out, perhaps even to Google (though I suspect they would try to find another organization). They would be managing the email accounts themselves, including authentication and recovery.

>>The keys are easier to use than TOTP

This has not been my experience, even for more knowledgeable people let alone normal users.

>> this particular library patron should have few authentication issues going forward

Until they lose or break the physical key, which will happen more often than losing or breaking their phone with the TOTP

Or now that I think about it… for 2FA in particular, what about enrolling a software FIDO token with an extension on every library computer that can be triggered by a librarian from their desk? Doesn’t require hardware for each patron, only applies to accounts that have been enrolled at the library. Feels like it could work.

This is well meaning and shows an unfortunate side of 2f-auth, but she seems to think that google is in the business of helping people. They are in the business of selling ads. True their search engine has greatly helped a lot of people, as has gmail.

But they are in the business of selling ads, and they are not selling enough ads to people who both a) cannot continuously afford a phone number b) are unable to afford an internet connection at home to be worth dealing with the complaints, manual verification and prevent fraud.

Google is in the business of making money. You make very little money from poor people, and you lose money if they cost even more to service.

This does not mean that it doesn't suck for the homeless lady, but this is reality.

Hardware keys work well in place of a phone, and are in some ways significantly more secure depending on how U2F is implemented.

Some of the problem remains: If the user forgets their password the second factor won’t help them, and that includes the backup keys.

I’ve read the letter, and I see the massive problem, but I don’t think it’s been fully solved yet.

Q: “How do we remotely authenticate a single user, in a way that cannot be forged, without relying on their memory?”

There are solutions to every part of that sentence, but I do not know of one that solves it entirely.

They could write their password down, but then they’re exposing themselves to the obvious risk of it being stolen. You could trust the librarian in a 2-of-3 system, but this seems very easy to abuse by the library staff.

Genuinely not sure of how this is solved.

A cryptographically-strong biometric key store at the library (e.g. finger-print or face scanner) that will only authenticate a physically present user and release a FIDO signature that could then be used in a multisig authentication?