Gmail 2FA causes the homeless to permanently lose access 3 times a year

Post by intrasight » Sat, Oct 08, 2022, 1:56 AM UTC

lucasyvas wrote: post #656

As someone who uses 2FA extensively and even has 1Password autofill the OTP codes - 2FA is objectively fucking brutal. Half of you in here have never met a non-technical user. These folks should not have 2FA on ever, because they can't even use the damn thing with it on. Yes, those users run a higher risk and should be notified of that extremely clearly. But 2FA is a garbage solution to the problem and it should alwa…

Post by intrasight » Sat, Oct 08, 2022, 2:00 AM UTC

danpalmer wrote: post #162

jamesrr39 wrote: post #149

Earlier quoted context omitted.

I think there are possible solutions here for a library, off the top of my head, taking a picture of your face when dropping off the codes, so that when you come back and ask for your codes, the librarian can ID you against the picture they have. Basically what is done when verifying your ID card/passport when you travel/go to the bank etc... It wouldn't be a librarian doing someone a favour, but rather a service tha…

Yes this is sort of what I was envisioning. Not as much one trusted librarian doing a favour, but a librarian team having a filing cabinet full of backup codes and an ID process that they trust and that is appropriate for their community. This is the sort of thing that I think Google could support explicitly with more access control around it, but I don't think that's entirely necessary to get the benefits.

Post by meshaneian » Sat, Oct 08, 2022, 2:59 AM UTC

xani_ wrote: post #601

hn_throwaway_99 wrote: post #339

Earlier quoted context omitted.

> How about the homeless person remembers a good password, and that's all that's needed for authentication? Gosh, I don't know, how about literally all of the problems that 2FA solves in the first place? Passwords alone are a bad solution (often forgotten, easily re-used insecurely) for people without all of the challenges and frequent mental issues that accompany homelessness, why would you think they'd be a good so…

> Gosh, I don't know, how about literally all of the problems that 2FA solves in the first place? Well, it isn't solving this one. Option to opt out would be nice. > aren't capable of keeping track of a physical device for more than N weeks? Bit ignorant of you. They could be just plainly stolen by someone else. A piece of rag working as a tent doesn't exactly have best physical security... > I'm not unsympathetic to…

Post by crooked-v » Sat, Oct 08, 2022, 3:31 AM UTC

gerash wrote: post #665

crooked-v wrote: post #569

Personally, I find it particularly infuriating that more and more companies are demanding to use phone-based 2FA even when I already have 2FA authentication set up . This applies to Google, too, which has forced me to add a phone number and get a SMS 2FA code for accounts that already had non-SMS 2FA configured. The whole reason I use an authenticator app is so that my accounts aren't dependent on having the same pho…

I'm sure you won't blame it on the "big bad tech" once you drop your phone in the pool and lose access to your accounts because they never asked you to create an SMS backup

Post by kshacker » Sat, Oct 08, 2022, 3:36 AM UTC

jakub_g wrote: post #8

In one of the later posts, the OP writes that the homeless will lose any physical thing after N weeks. So what kind of 2FA would be homeless-proof? I don't see a solution. Also, fully acknowledging Google and other bigtechs 2FA is far from ideal: The other thing is, we want at the same time Gmail to be unhackable against best hackers and state sponsored adversaries for the billions of users, including high profile di…