Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Librarian's Letter to Google Security

docs.google.com

Post reply on HN
Print view View original

461–470 of 484 posts

Re: Librarian's Letter to Google Security

#461

Post by kova12 »

prepend wrote: post #302
kova12 wrote: post #174

Earlier quoted context omitted.

Can you describe how regulation solves this problem, how exactly are you proposing for this regulation to work?

I’m not GP, but I expect that regulation could help by requiring customer service. Similar to banking. And there could be an agency similar to CFPB where citizens could appeal who would then make formal investigations. So regulation would force the workflow described in the article to not have a grim outcome for elderly users of gmail.

We already have that structure. It's called "court". And if you think it's not working well, I would agree with you. But neither will the other bureaucracy you are proposing, because neither really care about any of low income people who can't even pay for the phone service.

But let's put aside the efficacy of said institution, and presume it's working very well. They got call from some Joe. He claims that certain email address belongs to him, but can't prove it. Forgot password, no access to phone. What this customer service of yours going to do? Let's imagine they can order Google to give the guy access to account. Is that a right thing to do? What if that email belongs to a journalist or a whistleblower and you just gave access to it to a Russian intelligence? Remember, benefits are one thing, but it's not the only thing for which email is used.

And if it really comes down to this, why is Google under obligation to provide emails for government use? Government can provide email access to everyone who needs it. If they require email in order to access benefits, well go ahead and set up necessary infrastructure. Why Google had to do it? Google provides service on as-is basis. If that service level is unacceptable for government use, well newsflash: it's not the only provider.

Re: Librarian's Letter to Google Security

#462

Post by bawolff »

lostlogin wrote: post #436
bawolff wrote: post #420

Earlier quoted context omitted.

If google's products cause harm, they also get recalled and/or google gets sued.

You seriously believe in business karma? Apply it to oil, arms dealing, pill pushing pharma. It may happen, but the profit was still there. The article states some types of harm causes, and those people are struggling for an few dollars, they can’t sue Google.

My position is that google is subject to the same laws as physical goods companies, and held to the same standard as they are for product recalls. No more, no less.

I do not claim that some sort of utopia of ultimate consumer protection exists. It does not for google, nor for physical goods companies.

Re: Librarian's Letter to Google Security

#463

Post by bawolff »

reaperducer wrote: post #443
bawolff wrote: post #420

Earlier quoted context omitted.

If google's products cause harm, they also get recalled and/or google gets sued.

If google's products cause harm, they also get recalled and/or google gets sued. Yeah, lawyers are just lining up to represent those homeless folks, elderly grandmothers, and people who just don't get tech. Except they're not. Clearly you've never been poor.

> Yeah, lawyers are just lining up to represent those homeless folks, elderly grandmothers, and people who just don't get tech.

Represent them for what precisely? The tort of not providing a good user interface?

I don't think wealth has much to do with the lack of google being sued here. Wealth may buy better lawyers, but it doesn't create grounds for a lawsuit out of thin air.

> Clearly you've never been poor.

Life often sucks and is not fair. It is not google's responsibility to eradicate poverty

Re: Librarian's Letter to Google Security

#464

Post by bawolff »

reaperducer wrote: post #445
bawolff wrote: post #418

Earlier quoted context omitted.

> Too bad. If you have a business (and Google is a business) that goes business with the public (which Google does), you should offer some form of customer services. It's what we human beings call "the right thing to do." Lets pause on that thought. Why is there a moral imperative to offer customer service (provided they dont misrepresent that they do)? What is the basis for a moral obligation? Its not like there is…

they don't want to and there is nothing wrong with that You seem to be working with a different definition of "wrong" than the rest of the planet. There are people becoming homeless and losing government benefits because of Google. Either you didn't read the letter, or you are a deeply amoral person who should seek professional help.

> You seem to be working with a different definition of "wrong" than the rest of the planet.

How would you define it then?

I know this is sort of a trick question, as defining morality is something moral philosophers have struggled with since forever.

Generally though, i think that if you give something to someone for free, you're not responsible to teach them how to use it or make it accessible to use (Unless you promised otherwise).

e.g. We don't think Linus is responsible for teaching a course on how to use Linux.

> There are people becoming homeless and losing government benefits because of Google.

Is it really because of google? I would think the primary party to blame here would be the government that seems to insist using email to communicate about benefits. This seems highly inappropriate given the audience they are trying to serve.

> Either you didn't read the letter, or you are a deeply amoral person who should seek professional help.

You can be sympathetic to the situation without thinking google is at fault here. Or alternatively think the situation is really sad and unfortunate but think that imposing a duty to provide support is a bad solution.

Re: Librarian's Letter to Google Security

#465

Post by dredmorbius »

tomjen3 wrote: post #311
dredmorbius wrote: post #295

Earlier quoted context omitted.

Regulation can change that.

Well yes, but then a) regulation can also cause more damage and b) you should be writing to your senator, not google.

Points being that:

1. Overcoming business incentivisation requires some external influence.

2. Individual action alone won't accomplish this.

3. We're part of that larger conversation.

Writing Google first shows a good-faith effort. Google's failed to respond to that. HN is upping the ante. Regulatory action is another level.

These are not exclusive or independent actions.

Re: Librarian's Letter to Google Security

#466

Post by sumedh »

IshKebab wrote: post #80
sumedh wrote: post #66

Earlier quoted context omitted.

Have a Support line where people can call and verify their identity?

How would they verify their identity? Those sorts of password reset systems are regularly bypassed by convincing scammers who have stolen some personal information.

> How would they verify their identity?

How do they verify requests coming from Police and courts who want data?

People who forgot their login can go to Police or maybe some govt office who can help them to prove their identity and then approach Google.

I am sure Google has brilliant people who can come up with a solution if a law is passed for such things.

Re: Librarian's Letter to Google Security

#467

Post by IshKebab »

sumedh wrote: post #466
IshKebab wrote: post #80

Earlier quoted context omitted.

How would they verify their identity? Those sorts of password reset systems are regularly bypassed by convincing scammers who have stolen some personal information.

> How would they verify their identity? How do they verify requests coming from Police and courts who want data? People who forgot their login can go to Police or maybe some govt office who can help them to prove their identity and then approach Google. I am sure Google has brilliant people who can come up with a solution if a law is passed for such things.

I think the main issue with that approach is that they could verify that the person in question is Mary Jane born 1/1/1970 in Texas, but there's no simple way to verify that mj1970@gmail.com belongs to Mary Jane born 1/1/1970 in Texas.

You would need to verify your real-world identity before losing your account which people would really hate if mandatory and nobody would bother with if optional.

Re: Librarian's Letter to Google Security

#468

Post by sumedh »

IshKebab wrote: post #467
sumedh wrote: post #466

Earlier quoted context omitted.

> How would they verify their identity? How do they verify requests coming from Police and courts who want data? People who forgot their login can go to Police or maybe some govt office who can help them to prove their identity and then approach Google. I am sure Google has brilliant people who can come up with a solution if a law is passed for such things.

I think the main issue with that approach is that they could verify that the person in question is Mary Jane born 1/1/1970 in Texas, but there's no simple way to verify that mj1970@gmail.com belongs to Mary Jane born 1/1/1970 in Texas. You would need to verify your real-world identity before losing your account which people would really hate if mandatory and nobody would bother with if optional.

Google can ask questions like what credit card providers do. They can ask questions about some of their emails, if the verified person can answer them, then they probably are the owner.

Re: Librarian's Letter to Google Security

#469

Post by garfieldnate »

Even owning a phone, I really hate phone-based 2FA. What happens if I lose my phone? I've lived in foreign countries for almost my entire adult life, and no phone number is permanent. When I move, I need a new phone.

My Indian friends tell me it's much worse there. All of their government services are tied to a specific phone number that they must keep forever. So all of the ex-pats living here still pay for their Indian phone number back home so that they can still interact with the government when they need to.

Re: Librarian's Letter to Google Security

#470

Post by xiphias2 »

valleyjo wrote: post #322
ChrisMarshallNY wrote: post #25

Great letter. Wanna bet it was completely ignored? Glad to see it here. Maybe it won't be ignored. Librarians rock. There's even a show about them[0], Starring Number One. I can't access the gMail account I set up, because I made a mistake, when setting the password, and did not save the one I used. It will not allow me to access the account I set up. After a while, I just gave up. I am satisfied that someone can't u…

The author updated the document to say that they worked with google security and the problems have been resolved. So it wasn’t ignored.

So what's the resolution for the billions of people who weren't contacted?
Post reply on HN