News for hackers. Stuff that matters.
Re:Gmail 2FA causes the homeless to permanently lose access ... by UncleMeat on Friday October 07, 2022 @09:55AM (#33121367)
Is there a solution?

The claim in the link is that homeless people lose every single one of their possessions after a period of time. They also have minimal access to support structures that could be used as a recovery system. We've had decades of work on authentication and pretty much every solution either involves using a password manager to create unique passwords or having possession of a physical thing.

Re:Gmail 2FA causes the homeless to permanently lose access ... by nyuszika7h on Friday October 07, 2022 @10:30AM (#33121850)
Password managers are absolutely not required. While they're a good idea for most of us who don't have to worry about having somewhere to sleep, homeless people can still most likely memorize a password and remember it after a few tries. They can't do that if 2FA is forced on them.
Re:Gmail 2FA causes the homeless to permanently lose access ... by UncleMeat on Friday October 07, 2022 @11:47AM (#33122922)
Everybody sucks at memorizing unique passwords. I'd be stunned if homeless people are consistently not reusing passwords. Credential stuffing is the #1 form of account takeover and 2FA is the solution.
Re:Gmail 2FA causes the homeless to permanently lose access ... by bombcar on Friday October 07, 2022 @10:03AM (#33121470)
Surgical implanting yubikeys.

That won't at all bother anyone homeless, because there's never been a homeless person who was a conspiracy theorist.

(Obvious sarcasm detected)

Re:Gmail 2FA causes the homeless to permanently lose access ... by yellowapple on Friday October 07, 2022 @01:14PM (#33124195)
An only-slightly-less-sarcastic solution would be to get a tattoo of the recovery codes.
Re:Gmail 2FA causes the homeless to permanently lose access ... by jakelazaroff on Friday October 07, 2022 @09:59AM (#33121413)
Consider that the decades of work has probably been done with the exact same blind spots we're discussing now.
Re:Gmail 2FA causes the homeless to permanently lose access ... by UncleMeat on Friday October 07, 2022 @10:06AM (#33121516)
I'm really curious. What would you propose?

The best I can think of is trusted backup accounts, which already exist. A homeless person with regular attachment to a family member or a social worker could set up that person's account as a backup. But this already exists and is likely to fail for a large number of homeless people, who tend to struggle at maintaining long term relationships with family members or social workers who'd be able to help them.

Re:Gmail 2FA causes the homeless to permanently lose access ... by nyuszika7h on Friday October 07, 2022 @10:26AM (#33121793)
> I'm really curious. What would you propose?

The solution is very simple. Don't force 2FA. I'm sure most homeless people would rather risk the unlikely case of their accounts being hacked if they didn't choose a strong enough password to memorize than risk getting locked out of their accounts permanently.

You can encourage 2FA but forcibly enabling it for everyone does more harm than good, especially to homeless people but also non-tech-savvy parents and such (though the latter would be more likely to have a working recovery method).

Re:Gmail 2FA causes the homeless to permanently lose access ... by UncleMeat on Friday October 07, 2022 @11:50AM (#33122954)
> The solution is very simple. Don't force 2FA.

And then in alternative-universe HN people are complaining about the rate of account takeovers via credential stuffing and calling Google irresponsible for making it easy to disable a powerful security measure.

> You can encourage 2FA but forcibly enabling it for everyone does more harm than good

I'd wager that pretty much the only people on the planet who can definitively say this are the people who handle account takeovers and lockouts of large email services. My understanding is that the folks at Google responsible for this have concluded that making it behave the way it currently does is the setup that causes the fewest people to lose access to their accounts.

Re:Gmail 2FA causes the homeless to permanently lose access ... by jakelazaroff on Friday October 07, 2022 @10:11AM (#33121592)
I don't have one. I'm not a security expert or researcher or anything like that. But the tech industry has invented thousands of things that to most people would have been inconceivable beforehand. That doesn't mean there's a way to improve on the tradeoffs we have now — but the fact that no one's invented it yet doesn't mean it can't exist.

The tech industry self-styles as the smartest people in the world, who try to solve the hardest problems. All I'm saying is that we shouldn't throw our hands up when we can't immediately come up with a solution to something we only learned about five minutes ago.

Re:Gmail 2FA causes the homeless to permanently lose access ... by Arainach on Friday October 07, 2022 @10:29AM (#33121840)
This isn't something we learned about five minutes ago. It's been known that people lose their phones for a very long time. The tradeoffs were considered when designing the system.

Treating the tech industry as a magical black box that can "solve anything" is disingenous and dangerous. This is the exact same attitude that leads to things such as legislation that says "find a way for any communication to be decrypted upon subpoena. You're tech people, figure it out"

Re:Gmail 2FA causes the homeless to permanently lose access ... by b3morales on Friday October 07, 2022 @12:04PM (#33123168)
> The tech industry self-styles as the smartest people in the world, who try to solve the hardest problems.

I think this is a good point, but the catch is that there's an implicit footnote that needs to be attached to "the hardest problems*": "*Which generate sufficient monetary returns". This particular problem isn't one that has much revenue potential.

Re:Gmail 2FA causes the homeless to permanently lose access ... by GraphenePants on Friday October 07, 2022 @02:37PM (#33125256)
The 3-2-1 backup strategy requires an offsite backup. It's unclear what advantage was forseen by the homeless when the decision was made to forgo this guidance.