Librarian's Letter to Google Security

> trusted civic authorities

They'll need to be resistant to threats and bribes, so it will be difficult to have these on-site at the library.

I think we've overlooked an option. Note that the article's objection to FIDO keys was financial, not UX. This sort of confirms the hunch I got when first playing with them: "hey, the key metaphor is so strong and intuitive that these might be even better than passwords for people with low tech literacy." I held off on saying anything until their compatibility actually lived up to the hype, which IIRC only happened in 2020 (all major browsers, all major platforms, by default), but it did happen.

As for the financial barrier, yeah, it's wild that these are still $30/ea on Amazon. Can they be bought cheap in bulk? Or does the market need some aggressive new entrants? In any case, they are "near practical" and the shove needed to make them "very practical" is probably 100x smaller than, say, creating a Central Bureau of A12N.

In this situation, maybe one thing that could help is if the library holds on to the backup codes for patrons. So they can sort of act as a quasi trusted authority. In fact if these people can't even log in without backup codes, they can just keep their password in their wallet.

Of course, yubikeys also work very well in this situation. So the library could sell a yubikey and keep backup codes on file for in case the yubikey is lost.

Or since you can store so many identities on an individual yubikey, just give the librarians one.

It does seem like the library's (and really, anyone who helps the aged with their accounts) first order of business for those that have access to their email should be to get them setup with a secondary account at a different service.

I'm aware of a number of problems though - this is a lot of cognitive load to add to someone who just barely understands how to get to the mail in the first place. And obviously it doesn't help someone who is already locked out and seeking assistance getting back in. It opens another (likely less secure intentionally) way of phishing the seniors. And there is not really a good way to transfer all of your email history from one account to another that I'm aware of.

So while I believe the best "market solution" would be for folks to use some sort of alternative, I'm not sure it's a realistic ask. So Google needs to take this seriously and realize how devastating this can be. It's not "just a free email address" to many people, it's their lifeline to everything.

Heck, even myself as a tech savvy person worries about getting locked out of my Google account given I use an Android phone and have 2FA setup through that device for a large number of services, including my password manager. Note to self, get on that physical version of the digital black book that provides physical copies of anything needed to get back into accounts (2FA codes, backup codes, etc.)

Don’t make 2FA effectively mandatory.

Reading this comment, I thought Yubikeys, which aren't /expensive/, but aren't cheap either. I was pleased to see they have a key targeted at this specific use case now - the Security Key Series [0]. At $25, that is not too bad a price, and something I'd buy for the members of my family without much hesitation.

The hangup with this, which I think the librarian in question will feel, is what happens when someone loses their key? How can I set up a trust relationship that my local librarian can reset my grandma's Yubikey, but a bad actor can't? And, $25 isn't so bad once, but if we have to replace it every month, that's less fun. Maybe that's just agreeing with you and lamenting the state of things, but maybe someone will read this and think $25 isn't so bad and write a grant to pilot this program.

0. https://www.yubico.com/store/#for-individuals