Ask HN: If I get locked out of everything, please try to help me • Hacker News Board

Re: Ask HN: If I get locked out of everything, please try to help me

#221

Post by TurkishPoptart » Tue, Dec 13, 2022, 8:08 AM UTC

velox_neb wrote: post #181

donmcronald wrote: post #32

Earlier quoted context omitted.

> There was a post a while back around poor and homeless people encountering exactly this problem on a regular basis. Lots of people in the comments were incredibly dismissive and sometimes actively malign about it. Even worse than that, they're often connecting from public IPs that are "suspicious" which causes automated systems to treat them more harshly. In Canada it's gotten to the point where you need an interne…

> they're often connecting from public IPs that are "suspicious" which causes automated systems to treat them more harshly. What's worse is that the the error messages never explain the problem. It's just an endless sequence of "Oops! Something went wrong" "We could not fulfill your request" "Please try again later". Could drive someone crazy if they're not savvy enough to realize what's going on.

>What's worse is that the the error messages never explain the problem. It's just an endless sequence of "Oops! Something went wrong" "We could not fulfill your request" "Please try again later".

You're absolutely right. They each carry the tone of "This content isn't available right now", like when trying to view a tweet from a shadowbanned user. I've seen that drive people, particularly family, into a kind of aggressive version of frustration.

Re: Ask HN: If I get locked out of everything, please try to help me

#222

Post by _morgs_ » Tue, Dec 13, 2022, 8:11 AM UTC

jjav wrote: post #208

Wowfunhappy wrote: post #4

This is my nightmare. This is why I refuse to use 2FA. (Except on services that require it, and I wish they didn't require it.) Am I worried about getting hacked? Absolutely! But when I weigh the likelihood of (1) someone else getting into my account without 2FA and (2) locking myself out of my own account with 2FA, the latter seems much more likely! I understand how backup codes work. I promise you I will loose them…

> Am I worried about getting hacked? Absolutely! If you set a strong, long, unique password for every account, your chances of getting the account compromised are just about zero. 2FA is a good thing in most cases, but I do hate how the industry has blindly adopted it as some sort of mantra that you can't exist without. The reality is that if you chose 128+ bit passwords generated out of /dev/random, they cannot be b…

How will you avoid fake login pages? Those can even phish SMS and TOTP 2FA.

Yubikey 2FA (and equivalents) help to solve this.

Re: Ask HN: If I get locked out of everything, please try to help me

#223

Post by Beltalowda » Tue, Dec 13, 2022, 8:22 AM UTC

bawolff wrote: post #211

DoreenMichele wrote: post #201

Earlier quoted context omitted.

but should i have to have an insecure account because homeless people exist? No, of course not. This is like when people who drive get chuffed about pedestrians wanting their lives to work and acting like "Well, if we do anything for you , then my life will fall apart." As if we can only build a world that works for cars or build a world that works for non-drivers and the other camp just has to accept a sucky life an…

Because the topic of this thread is suggesting google should reduce security for everyone. You can't have google letting people back in their account unverified if they ask nicely not affect other people with accounts.

> the topic of this thread is suggesting google should reduce security for everyone

I don't really see that anywhere; I think you're jumping to conclusions.

Every system will need to have some escape hatches, whether that's a governmental bureaucratic process or a Google account recovery process. Because no matter how well you design a system some folks are going to fall outside of it because the world is complex and the number of possible situations are too many to capture.

"Yes, but it's only 1%" – yes, but it's 1% for system A, and a different 1% for system B, etc. and it all adds up.

All of this is why things like appeals exist in many processes, and why we have judges in addition to mountains of laws. None of this is perfect by any means and there's lots that can be improved, but at least there's the recognition that The System isn't perfect – even if it's more symbolic than anything else at times.

If I lose access to my HN account then that might be annoying, but fundamentally it's not really a big deal, at least not for me. But some accounts/services are connected to all sorts of things and much more important than some HN account and connect to "real life" in much more complex and impactful ways. You can't on one hand have a service wanting to become central in people's lives but on the other hand also just shrug at the edge cases and pretend it's not your responsibility when people get screwed over.

Re: Ask HN: If I get locked out of everything, please try to help me

#224

Post by twelve40 » Tue, Dec 13, 2022, 8:23 AM UTC

havo wrote: post #111

discardedrefuse wrote: post #87

Earlier quoted context omitted.

The trick isn't to disable 2FA. It's to add a bunch of 2FA methods that don't rely on your cell phone: authenticator app, yubi keys, backup codes.

This is terrible advice. Please don't ever rely on authenticator apps. Try changing your phone, resetting your phone or losing your phone and watch yourself get locked out of your accounts with absolutely no recourse.

I agree, auth apps actually work relatively painlessly for day-to-day (especially if someone else supports them, like at work), but for me at least, as a personally managed last resort they turned out horrible. If something happens to the device(s), you're screwed. Even SMS is better, because at least you can move the sim or eventually recover your own phone number on a brand new device, even if the old one vanished. And yes, I know SMS's can be hijacked in some cases (like by a malicious mobile app) but for personal stuff there has to be some sane recovery, and Google does not give you one easily.

Re: Ask HN: If I get locked out of everything, please try to help me

#225

Post by soco » Tue, Dec 13, 2022, 8:26 AM UTC

denkmoon wrote: post #101

crooked-v wrote: post #6

There was a post a while back around poor and homeless people encountering exactly this problem on a regular basis. Lots of people in the comments were incredibly dismissive and sometimes actively malign about it. Edit: One suggestion from me would be to try and start the dead phone connected to power but with the battery physically removed (assuming it's removable). That might bypass whatever issue it's having and l…

While we were all watching CCP implement their social credit system, big tech gave us one while our gaze was elsewhere. These algorithmic systems can pretty quickly make you an unperson in our society.

Theoretically one is implemented by state's request and the other happens while the state is busy looking away. Yay for freedom but when you're at the receiving end of the digital stick, is the difference really significant?

Re: Ask HN: If I get locked out of everything, please try to help me

#226

Post by soco » Tue, Dec 13, 2022, 8:29 AM UTC

Twisell wrote: post #215

katbyte wrote: post #114

Earlier quoted context omitted.

for the rest of us having a hacker gain access to our accounts and stealing money or scamming others is a far greater risk. And for google a far more common occurrence. There is a reason there are so many safeguards in place and its because hackers are trying all day every day to break in and steal identities and money. Homeless people don't need to use 2fa if they are so unconcerned with someone stealing their accou…

Were you so harsh on self-entrepreneurs that came here crying out loud because Google did shut down their developer account for some unrelated payement error on a linked account? I hope so because otherwise you are just discriminating people based on their wealth. But praise lord dollar that if you ever fall from your status you won't find pedantic guys like you when seeking for help.

There's a recurrent thread of posters blaming everybody else for having issues with the big companies, because big companies cannot make mistakes otherwise they wouldn't be "big", right.

Re: Ask HN: If I get locked out of everything, please try to help me

#227

Post by arc-in-space » Tue, Dec 13, 2022, 8:31 AM UTC

Alex3917 wrote: post #86

Wowfunhappy wrote: post #4

This is my nightmare. This is why I refuse to use 2FA. (Except on services that require it, and I wish they didn't require it.) Am I worried about getting hacked? Absolutely! But when I weigh the likelihood of (1) someone else getting into my account without 2FA and (2) locking myself out of my own account with 2FA, the latter seems much more likely! I understand how backup codes work. I promise you I will loose them…

> This is why I refuse to use 2FA. That just makes it even more likely you'll lose access. If you have 2fA, Google will just ask for your 2fa. If you don't have 2fa, Google will pick some random device you signed in on once ten years ago, and tell you that you can only ever log into your account again if it's from that device.

It seems possible to disable this by manually logging out of all your devices in google account management, then never using them to log into your google account again. I've done that, but the fact that this is the only solution is unbelievably insane.

Re: Ask HN: If I get locked out of everything, please try to help me

#228

Post by ptman » Tue, Dec 13, 2022, 8:32 AM UTC

Wowfunhappy wrote: post #4

This is my nightmare. This is why I refuse to use 2FA. (Except on services that require it, and I wish they didn't require it.) Am I worried about getting hacked? Absolutely! But when I weigh the likelihood of (1) someone else getting into my account without 2FA and (2) locking myself out of my own account with 2FA, the latter seems much more likely! I understand how backup codes work. I promise you I will loose them…

Not all 2FA is the same.

SMS 2FA leads to these problems.

But A FIDO2/WebAuthn token (yubikey or similar) would help you stay secure and independent from your phone. I agree that yubikey is a bit expensive, but there are alternatives. Token2 seems quite bit cheaper, but depends on shipping: https://www.token2.com/shop/product/token2-t2f2-fido2-and-u2...

Re: Ask HN: If I get locked out of everything, please try to help me

#229

Post by tomduncalf » Tue, Dec 13, 2022, 8:35 AM UTC

A recent experience with Instagram has made me wonder whether 2FA is worth the hassle. My phone broke and I hadn’t backed up my 2FA app since joining Instagram (I since switched to 1Password for 2FA) so I couldn’t log in. No problem, I have backup codes in a screenshot - but they don’t work!

I managed to get in touch with their support and had a bunch of back and forth to prove my ID but am now stuck getting “sorry we only have time to review the most urgent requests” auto responses.

I don’t care about my Instagram account but I will probably complain to the ICO here in the UK out of principle as they’re preventing me from accessing my data which is required under GDPR. However, it does make me think what a nightmare it would be if this happened to my Google account. Seems like once you have an issue, you’re stuck as these companies just don’t have human support.

What’s people’s thinking on the best way to deal with this risk? I totally understand why 2FA is required but this experience showed me that stuff can go wrong - in this case my backup codes stopped working.

Re: Ask HN: If I get locked out of everything, please try to help me

#230

Post by shepherdjerred » Tue, Dec 13, 2022, 8:37 AM UTC

djha-skin wrote: post #163

I wanted to point out a very serious problem related to this post: Google will no longer simply accept totp as a verification but insists on sending you a notification to one of your devices. Now I can't just use KeepassXC to get into Google anymore, I have to use my phone. The problem that the OP points out provides very real and poignant evidence that this is not only annoying but dangerous. What is it that compani…

Yes!!! This has happened to me before. I entered my TOTP and then Google forced me to open YouTube on my phone. I didn't have YouTube (I deleted it), so I had to re-installed the YouTube app and sign in through that before I could login to whatever I was initially trying to do.