Librarian's Letter to Google Security

All _government _forms have paper-equivalents for accessibility reasons, and OMB numbers that coincide.

The Paperwork reduction act is a thing, but it also stipulates that within reason, paper forms must be available.

Another annoyance is if you enter a landline number most of these things just assume it's a cell and then ask you for the verification code that they just sent into the ether.

This is a direct consequence of garbage cultures that have been left uncontended:

- UN*X, for not providing sane protocols that anyone would want to use (email is garbage in the first place. aside from the other 10000 problems with it, you should be able to generate addresses on the fly for each contact you interact with, which also solves spam and removes the need to have a "super smart" central "trusted" server with spam filter created with 10000 man hours of work that you can never create yourself). SQL injection was a UN*X braindamaged phenomena; no sane protocol would require embedding strings in the concrete syntax by hand, except when you have a bunch of idiots following the "everything is text" and "text is the lowest common denominator" mantra

- (continued) The email end game from the beginning (due to the spam problem) is that anyone who tries to make their own email provider will be blocked temporarily or permanently. There are already only a few remaining email services in existence. Due to UN*X braindamage, your email address is tied to a domain name, which will also be blocked as this is the natural meta of such a system: Admins get to look at the pointless string at the end of your address and decide if they don't like a substring of it, or only allow a set of known domains. Of course, if a sane protocol was in use, your address would just be a long string of meaningless bits and there would be no location or English word to discriminate on.

- Webshit, for allowing corpos to create interactive nonsensical applications instead of forcing them to use well established protocols with static pages describing the address of said services. Why in the hell can a website run code? Immediately the first thing I thought of when I heard of that was, "oh but wait what about all the stupid people who will make crap code that will freeze your browser?". This is such a terrible nonsense idea. And all the web standards are crap too. The web is a relic like Flash player.

- Infosec, for floating this idea that the user is an absolute idiot, and cannot be trusted to manage his credentials, not even with an "I'm an infosec expert, opt me out" option (ironically, anyone in infosec probably _can't_ manage their credentials). The only reason they are partially right is because of UN*Xy practices which make the most trivial tasks insecure (for instance, you could just dump the database of 99% of websites between 2000 and 2010 due to SQL injection, so for casual/lazy users who use the same login on multiple pages, you could login to all their services).

- Login voodoo, this started with "frequent flyer number" bullshit, where you could never tell if someone could use your stupid questions to get into your account without your password (they could), and password reset, which means your email address is essentially the public key for your account, and stuff like the Steam vuln where you could literally just press "i forgot my password" and it would let you into whatever account you wanted

- Hyperstatism, the narrative will eventually shift (if it hasn't already) to "you have to have a complex login mechanism because you need to be identified [by cell phone, government ID]"

This thread is a good example of how you are all helping nothing. We need real solutions to technical problems. Not solutions for people who don't know how to do anything properly. We can trivially have a cell phone that stores private keys, and public keys of other people and maps names to them, and is trivial and intuitive to use by lay people, but instead you will pander the dumbest possible thing like "biometrics", or some other forced 2FA crap, because poor people are supposedely too stupid to use anything else, like even a simple password which would still be better that what companies like google do. That's not how it works, you implement a PROPER solution and let the user friendly amendments to it trickle down. We even see now the capability folks reusing UN*X and javascript, the two worst OS and language to try and appeal to get uptake of their projects. Literally no solution the hacker has put forth today solves the problem, they just want to pander to specific nonsense that makes them feel pragmatic about themselves.