> Even when we clicked “I don’t have my phone” it asked her to open the Google app from the phone that she does not have.
That's a google problem.
Google fixing their problem would lessen the impact of the government problem. (And, more generally, make gmail a better service for lots of people.)
For most people, that's too hard. The elderly, marginally educated people being served by the library or in other contexts just don't understand how things work to the degree that they might appreciate backup codes or their importance. They just don't get it. Backup codes are like this noise in the way of account signup.
Ever tried to get friends and family to start using PGP? A password manager?
The technical solutions that are practical already exist, as you've pointed out; and the technical solutions that seem like they're lacking (enrolling a new device without MFA-ing in) are lacking for a reason--they're security holes. You can't say "this email account is super important and access to it unlocks important things in someone's life" and also "account recovery must be as easy as claiming you lost your phone, and you don't have to know any pre-shared or pre-generated secret".
I also don't know what the solution is. Trusted intermediaries (librarians? social workers? police? social security office people?) introduce all kinds of other attack vectors. Elsewhere folks are pointing out that the mistake was probably to rely on email for all of this super important messaging and your account recovery workflow for every system other than email, but that's a society-wide problem that you probably couldn't have controlled in the first place and definitely can't now.
The best you can probably do is aggressively prompt people to prepare for account recovery prospectively, maybe by identifying a trusted intermediary and/or verifying that they have backup codes.
This seemed pretty effective to me.
If you want to enable 2FA, Do one of the following - upload the front and back of your ID - UBI Key or other hardware Cert, - etc. etc.
2FA by phone is a flawed architecture due to being subject to change. Sim-swaps are a known vulnerability.
But mainly, do not force me to have 2FA.
I don't know what the right answer is, but that certainly isn't it.
We probably need some sort of state-sponsored digital inbox for these kinds of documents. The thing that makes Google useful -- that it is a "reasonably" secure location to stash documents -- also makes it really easy to get locked out. There are recovery options, but it isn't obvious how a system could be secure while still allowing recovery for a user who elects to not set any recovery options up.
Perhaps the government could do a better job (at least they have things like social security cards and birth certificates, and have been dealing with the last resort case where these aren't available for longer than any of us have been alive). They also aren't constrained by things like a need to make a profit, and they don't even really need us to be able to communicate out from this inbox, it could be just a one-way channel for the reception of documents, which would avoid some annoying issues ala people using their gmails to harass others.
All _government _forms have paper-equivalents for accessibility reasons, and OMB numbers that coincide.
The Paperwork reduction act is a thing, but it also stipulates that within reason, paper forms must be available.
The HN community caused this problem. I precisely remember about 10 years ago on HN I'd see obnoxious articles with thousands of upvotes hyping crap like "we disrupted the goverment" and "we saved a lot of paper by providing a webshit interface to government institutes" and "we replaced non-working COBOL crap with new JS crap it's so much better". And of course they followed suit with "security best practices" such as having a hidden security policy (that an attacker can easily find out) and "advanced risk model", which is something 99% of websites get wrong despite that they all regurgitate the standard "we have a complex risk model, you do not know what you're talking about". What we have now is absolutely, literally what my expected outcome was for this movement, at the time, 10 years ago.
Many government offices have temporarily(?) gone online-only for covid.
It isn't just government forms, it is also private companies, employers, landlords, and even out-of-touch charities that are run by people who are used to having 24/7 access to reliable internet.
Is that actually true? I’ve never seen a single site that didn’t allow me to log in with a ‘regular’ email address, even if they pushed Log in with Google first
The problem is 2FA. 2FA causes people to get locked out of their accounts. Google mail requires 2FA, the government does not. If Google turns off 2FA requirement, the problem in the letter goes away. But they won't.
Google is the cause of the problem, and can easily solve it.
The IRS recently had a problem with people using their online access tools to get other people's refund. Insufficient security on authentication can easily be as bad or worse than 2FA.
"Many government welfare forms, housing applications, and jobs applications these days require the use of the internet exclusively with no option to fill things out in person."
Why is this? Really, this does not seem like a problem Google caused, but rather a problem caused by the government when they made it mandatory to have internet access to get the benefits they should get. Would they have made it mandatory to call them on the phone, back when phone access was not yet universal? If they had, would AT&T have been at fault?
The government caused this problem.
I'm all in favor of finding a non-government solution (charity sponsored by HN people to get people Yubikey or equivalent, maybe). But this is not really a problem caused by Google, and if these people were having their benefits scammed away from them because their email accounts were hacked, people would be excoriating them for not instituting 2FA.