undefined | Better HN

0 pointsangry_octet3y ago0 comments

You're reducing the concept to an absurdly simplistic level in order to create simple vulnerabilities.

As I wrote, THIS WOULD NOT BE THE DEFAULT. It is quite possible to pre nominate the specific groups that can allow unlocking of an individual account. And that's all it is, account unlock when they use a new device, or putting the account into PW only mode for a period.

If the PW is forgotten you require a higher level of identity verification, like a bank/USPS/DMV process.

Facebook already has this enabled, you can have a friend/family member (or two of them!) validate your account.

If you're determined not to find solutions then you won't progress.

0 comments

Kalium3y ago

Gmail already has a system for using one account to unlock another, so no changes required there. A bank, USPS, or DMV generally requires ID or other identifying documents. The people we're trying to help often struggle to retain physical possessions like ID.

It's not that I'm determined to not find solutions. It's that I am determined to find solutions that don't create a degraded security state ready-made to abuse people's email accounts. Sometimes finding a good solution requires looking somewhere other than under the streetlight.

Like others, I'm led to the conclusion that perhaps Google isn't the party best positioned to solve this particular pain point for our most vulnerable and marginalized community members. Maybe we should be paying more attention to why Lifeline numbers aren't portable.

angry_octetOP3y ago

It's routine in disaster relief situations that people lose all their documents but then governments step in and allow identity verification via vouching: this other person Alice says you're Bob. Then Bob gets his photo on a temporary ID document and gets a DR payment.

Social workers, shelters, libraries etc are well placed to support that. They know these people because they see them every day.

If you choose to enrol in the "community assisted recovery" process then you could enrol a new device into your email with their help. Put a big red banner at the top of the email client saying "Community recovery via Topeka Library, Kansas".

Lifeline numbers aren't portable because people have no way to prove their ownership of the previous number, because they have no ID.

Kalium3y ago

This feels ever-increasingly like asking Google to cover the role of a government agency. Universal service is something we expect of government agencies. It's rarely something we expect of private enterprise.

The whole "community recovery" concept sets my teeth on edge. It's a whole alternative authentication avenue ripe for exploitation. Anything that positive and innocuous sounding is going to be the target of many an abuse campaign - think Cambridge Analytica and all the people who handed over their info to innocuous-looking things. Telling people all their info has been stolen isn't all that helpful for protecting them and knowing the specific library or shelter that authorized it will do very little to help.

Plus it turns the people designated as recovery agents into high-value targets.

Again, I'm not trying to avoid finding a solution. I'm trying to avoid finding a "solution" that puts a large number of people at risk unnecessarily.

angry_octetOP3y ago

You could easily limit this program to people using Lifeline phones, or enrolled with a geolocated homeless support organisation. The vouching agents can't be high value targets if they're protecting the identity of impoverished people.

j / k navigate · click thread line to collapse

0 comments

Kalium3y ago

angry_octetOP3y ago

Social workers, shelters, libraries etc are well placed to support that. They know these people because they see them every day.

Lifeline numbers aren't portable because people have no way to prove their ownership of the previous number, because they have no ID.

Kalium3y ago

Plus it turns the people designated as recovery agents into high-value targets.

Again, I'm not trying to avoid finding a solution. I'm trying to avoid finding a "solution" that puts a large number of people at risk unnecessarily.

angry_octetOP3y ago

j / k navigate · click thread line to collapse