Librarian's Letter to Google Security • Hacker News Board

Re: Librarian's Letter to Google Security

#481

Post by TrapLord_Rhodo » Wed, Aug 03, 2022, 2:57 PM UTC

mattnewton wrote: post #387

jeremyjh wrote: post #367

Earlier quoted context omitted.

They would use photo ID the same way everyone else does. Compare the photo on the ID to the picture the person provides; which is why it needs todays date in the photo.

All that proves is that there is a person who matches the photo on their ID? It doesn’t prove it is the account owner unless the ID and personal information is stored with google ahead of time. And now you have people upset about google asking people for id to sign up, like their children for a school account and other people like me upset that my account was phished. I don’t think they even have my real birthday on…

2FA should not be a requirement.

If you want to enable 2FA, Do one of the following - upload the front and back of your ID - UBI Key or other hardware Cert, - etc. etc.

2FA by phone is a flawed architecture due to being subject to change. Sim-swaps are a known vulnerability.

But mainly, do not force me to have 2FA.

Re: Librarian's Letter to Google Security

#482

Post by zie » Wed, Aug 03, 2022, 4:51 PM UTC

blackboxlogic wrote: post #384

m348e912 wrote: post #255

I don't particularly love gmail and I'm personally trying to switch to fastmail over time, however I am on google's side this time around. There are reasonable approaches that can address this librarian's concern. Backup codes, backing up the MFA seed. She talks about patrons having cell service shutoff, but that doesn't affect google authenticator. There are good reasons why google went to an MFA only model and yes…

MFA is a great option to provide, and I would even suggest it should be default on, but what's the harm in allowing the user to opt out of MFA? If available, it seems to me it would be the best option for this demographic.

At least one reason: cyber-security insurance policies are starting to mandate MFA, because they are tired of paying out on insurance claims.

Re: Librarian's Letter to Google Security

#483

Post by highwaylights » Thu, Aug 04, 2022, 8:34 AM UTC

kova12 wrote: post #461

prepend wrote: post #302

Earlier quoted context omitted.

I’m not GP, but I expect that regulation could help by requiring customer service. Similar to banking. And there could be an agency similar to CFPB where citizens could appeal who would then make formal investigations. So regulation would force the workflow described in the article to not have a grim outcome for elderly users of gmail.

We already have that structure. It's called "court". And if you think it's not working well, I would agree with you. But neither will the other bureaucracy you are proposing, because neither really care about any of low income people who can't even pay for the phone service. But let's put aside the efficacy of said institution, and presume it's working very well. They got call from some Joe. He claims that certain em…

It's not the only provider, except when it is.

If you have an Android phone, your e-mail is on Gmail. It doesn't need to be, but it is, because you didn't know that when you were funnelled into the e-mail when you set up the account and oops now that you're locked out ten years later it's too late to make a choice.

Re: Librarian's Letter to Google Security

#484

Post by tetromino_ » Thu, Aug 04, 2022, 9:16 AM UTC

0xbadcafebee wrote: post #173

Classism via Internet. When Uber and Lyft became popular and you still needed a smartphone and mobile connection to use it, it basically became a way to keep poor people segregated in transportation. If you couldn't afford a smartphone, or a data plan, or only sporadically, you were relegated to the public transportation options which are slowly defunded as Lyft and Uber lobby governments to become the "more affordab…

> When Uber and Lyft became popular and you still needed a smartphone and mobile connection to use it, it basically became a way to keep poor people segregated in transportation.

Uber and Lyft were a massive, widely praised improvement specifically for poor people because for the first time ever, poor people got access to a taxi service that was not bigoted against them. Before Uber, bigoted taxi drivers routinely refused to pick up passengers with the wrong skin color and refused to drive to poor, outlying neighborhoods. Uber and Lyft did away with that nonsense. Doesn't matter what you look like or what you are wearing or where you live, if you can get a phone, you get a ride.