If you dont know how to control what happens in the park you build, then the park will be shutdown.
In the case of Google its not hard to speed up the process of shutdown. I just encourage them to keep working on more and more mindless ivory tower trash like Pixel phones, watches etc and inject more Ads into everything. They dont have the imagination for anything else but want a pat on the head for whatever they build. Give it to them.
On the one hand, this can be quite reasonably derided as a lack of imagination. Surely there must be a way to do it!
On the other hand, well, we as a society accept that businesses are generally allowed to decide they just don't want to be in a market segment or produce some features. Bridgestone is not compelled by law to have a store in every neighborhood. Montblanc is not forced to produce disposable ballpoint pens.
Perhaps we should treat this as Google admitting the limits of what they're willing and able to build. There is no shame in knowing your limits.
Gmail is functionally the root of trust / skeleton key to millions of people's online lives. The only real competitor is Facebook and, for some, Apple. I think Gmail is far better (more secure, more privacy respecting, less capricious) than Facebook.
With the admission by Chad that that homeless he advocates for can't retain mobile numbers, or ID cards, or 2fa keys, I have no idea how he thinks any secure access could possibly work.
As others have pointed out, turning off 2FA is available. Apparently that doesn't work either because the people in question forget their passwords. So I guess we should add passwords and biometrics (not available on all hardware) to the list of things that aren't going to work.
Like you, I'm left wondering what there is to anchor any level of security.
Both are tools. Empathy is helpful for identifying, understanding, and taking seriously the needs of human beings. Cynicism and pessimism are helpful for considering how to warm someone without setting the building on fire.
"Sometimes problems are just hard. Taking ownership and feeling empathy and sincerely wanting to solve the problem does not render them easy."
No one said it did and it's better than not caring at all.
As I wrote, THIS WOULD NOT BE THE DEFAULT. It is quite possible to pre nominate the specific groups that can allow unlocking of an individual account. And that's all it is, account unlock when they use a new device, or putting the account into PW only mode for a period.
If the PW is forgotten you require a higher level of identity verification, like a bank/USPS/DMV process.
Facebook already has this enabled, you can have a friend/family member (or two of them!) validate your account.
If you're determined not to find solutions then you won't progress.
It's not that I'm determined to not find solutions. It's that I am determined to find solutions that don't create a degraded security state ready-made to abuse people's email accounts. Sometimes finding a good solution requires looking somewhere other than under the streetlight.
Like others, I'm led to the conclusion that perhaps Google isn't the party best positioned to solve this particular pain point for our most vulnerable and marginalized community members. Maybe we should be paying more attention to why Lifeline numbers aren't portable.
Social workers, shelters, libraries etc are well placed to support that. They know these people because they see them every day.
If you choose to enrol in the "community assisted recovery" process then you could enrol a new device into your email with their help. Put a big red banner at the top of the email client saying "Community recovery via Topeka Library, Kansas".
Lifeline numbers aren't portable because people have no way to prove their ownership of the previous number, because they have no ID.
The whole "community recovery" concept sets my teeth on edge. It's a whole alternative authentication avenue ripe for exploitation. Anything that positive and innocuous sounding is going to be the target of many an abuse campaign - think Cambridge Analytica and all the people who handed over their info to innocuous-looking things. Telling people all their info has been stolen isn't all that helpful for protecting them and knowing the specific library or shelter that authorized it will do very little to help.
Plus it turns the people designated as recovery agents into high-value targets.
Again, I'm not trying to avoid finding a solution. I'm trying to avoid finding a "solution" that puts a large number of people at risk unnecessarily.
Let's say I care. Let's say I care a lot. I care so much that I'm willing to make it my personal problem to address the very real, very pressing needs of a critically vulnerable and marginalized part of my community from inside Google.
What am I going to do? Is anyone going to be happier if I stand up and proclaim loudly how much I care? Probably not.
Could I say "Gee, what if we just let everyone put themselves in the group of people who don't do 2FA"? Yes, if I wanted to be responsible for a lot of people not securing their accounts. Could I outsource identity verification to a wide assortment of groups (libraries, non-profits, etc.)? Absolutely, so long as I'm alright with this being used to gain improper access to a LOT of accounts outside the target segment. Could I offer more password chances and friendlier lockout times? Sure, so long as I'm OK with the negative consequences of this for a lot of people.
OK. Let's end the game now. We don't really have any major steps towards real solutions here. Empathy is very useful for showing where a problem is. Demanding what amounts to lowering the global bar for account security is perhaps not the ideal approach here.
Sometimes problems are just hard. Taking ownership and feeling empathy and sincerely wanting to solve the problem does not render them easy.