Librarian's Letter to Google Security

As a brief introduction, the goal of computer security is generally to make a computer as secure as a door lock. A door lock can be easily broken into, but to do so requires that a person show up to the door in person, and to take some illegal action. A computer, if secured naively, is much less secure than that: if I gain access to the password, I can hack a computer from anywhere in the world. Furthermore, since I have the password, it isn't even clear that I am breaking any rules.

The library system can solve the problem described in the letter while maintaining door-lock level security in the following way: they would give to every library system user a library card, associated with their person. This card would be used to log in to library computers. Certain information would be preserved between logins, namely the browser cookies. Thus, the user would remain logged in to their google account as long as they had access to their library card. If they lost the card, or forget the password, the library would be able to reset the password, or issue a new card, as long as the user could prove they were the owner of the card to the satisfaction of the library employee.

Google, being an internet company, cannot reasonably issue cards to all their users, but libraries regularly do so. For the same reason, Google has difficulty verifying the identity of their users, which libraries can do easily. Google is structured as a profit seeking corporation, and would need to justify charitable behaviour to shareholders. Libraries are well known to exist to provide services for free to their users, and can easily alter their operations to do so differently. Most importantly, libraries already provision physical access to computers. The most important element of our door-lock security model is that a person must appear in person in order to get around our security. The library is the organization operating the physical terminals, and so the library alone can provide this essential element of our security model.

It does not offer to automatically create an entry, until after the login, so it's still quite possible to "fall through the cracks," which is what happened here.

Yeah, my bad. :P

Lets pause on that thought.

Why is there a moral imperative to offer customer service (provided they dont misrepresent that they do)? What is the basis for a moral obligation?

Its not like there is a line in the bible saying "thou shalt offer tech support". Admitidly im not convinced by religious arguments, but i dont see any more modern moral source either.

> Imagine if Google's vendors stopped offering Google customer service. Janitor didn't show up today? Well, clean your own office toilet today, technie. Surely, there's a YouTube tutorial for that.

That's not really a customer support inquiry. That said, one of two things happen - either they are ok with it, or they are not. If they are not they negotiate other terms or hire a different cleaning company.

I'm not saying you have to like google's policies, just that its not unethical for google to have policies you don't like.

> Bullshit. It has billions and billions and billions of dollars that it can throw at the customer service problem, but it doesn't for one simple reason: Greed.

Wait. Are you telling me that a private corporation in america is trying to maximize profits? The horrors. I would have never guessed. What next? Is the sky blue?

> How about the restaurant down the street maximizes its shareholder profits by not honoring your reservation?

A) that action does not maximize shareholder profit.

And b) its wrong because they promised something and didn't deliver. The sin is in the reneging.

If google promised customer support and didn't deliver, that would be wrong. But google didn't promise customer support.

> How about the dry cleaner optimizes its workflow by only being open three minutes a day?

Sounds like a shitty dry cleaner, but i fail to see the ethical issue. If the dry cleaner doesn't meet your needs, don't use it.

Quite frankly, i think this entire thing reeks of entitlement. Just because someone offers to sell you a service, doesn't mean they have an obligation to provide it in the fashion you want. Their obligation is to not mislead, and be honest about what they are offering. Maybe what they are offering works for you, maybe it doesn't. If it doesn't dont do business with them.

> If Google is so wonderful, full of so many smart people, then how come it can't solve its customer service problem?

Because they don't want to and there is nothing wrong with that.