Hacker News Reader

> If the person lost their actual keys and wallet, they've got bigger problems

Do they? Typically for those sorts of things you have recovery options. Your landlord will be able to get you a new key, your bank can issue you a new card.

Looking through my wallet, the only thing that would have a significant hurdle to replacing it is my Egyptian residence permit (I'd have to travel to Egypt to re-issue it). The only significant "loss" would be my current monthly public transport ticket, but if I can produce some kind of payment proof and am willing to argue with metro staff I might even be able to get that replaced.

Point being, there is a lot of recourse for offline things, but if you get into this situation with a tech company - there is none. I have a lost 10+ year old Gmail account and I could not regain access to it through any means even while working as an SRE at Google.

> Looking through my wallet, the only thing that would have a significant hurdle to replacing it is my Egyptian residence permit

Maybe don't carry that in your wallet if you don't need it where you are and it's so hard to replace. :)

You're absolutely right, I also realised that while going through stuff :) It's going to stay home tomorrow!

It's one of those things you just kinda forget about when you don't need them for a while ...

Reading this comment, I thought Yubikeys, which aren't /expensive/, but aren't cheap either. I was pleased to see they have a key targeted at this specific use case now - the Security Key Series [0]. At $25, that is not too bad a price, and something I'd buy for the members of my family without much hesitation.

The hangup with this, which I think the librarian in question will feel, is what happens when someone loses their key? How can I set up a trust relationship that my local librarian can reset my grandma's Yubikey, but a bad actor can't? And, $25 isn't so bad once, but if we have to replace it every month, that's less fun. Maybe that's just agreeing with you and lamenting the state of things, but maybe someone will read this and think $25 isn't so bad and write a grant to pilot this program.

0. https://www.yubico.com/store/#for-individuals

I wouldn't feel confident assuming that the homeless can feel secure in retaining their yubikeys from theft. The optimal solution would probably be some sort of multisig solution where a trusted party like a librarian and maybe a person's parole/benefits/welfare/etc officer hold on to keys.

I believe you can set up multiple keys. In this manner, a librarian could keep a "master key."

This compromises security somewhat, since the library houses one of the second factors, but IMO it's preferable to total account lockout (and still superior to SMS verification).

if you’re using someone else’s computer, or a computer at a library, you have no security. TLS isn’t enough to be certain they haven’t intercepted the connection, installed their own root certs, or whatever else. I can’t think of any method to securely use someone else’s computer and connection unless you bring a live boot Linux USB or something, which I doubt applies to the intended audience here.

Sure, having a physical key makes it easy for a non-technical librarian to steal someone’s identity, but perhaps having some kind of yubikey safe deposit box would be an appropriate compromise.

Also consider that the yubikey is only the 2nd factor, the user still needs to enter the password. Obviously password resets are possible but might be a bit more of tip off to the user.

Hardware keys work well in place of a phone, and are in some ways significantly more secure depending on how U2F is implemented.

Some of the problem remains: If the user forgets their password the second factor won’t help them, and that includes the backup keys.

I’ve read the letter, and I see the massive problem, but I don’t think it’s been fully solved yet.

Q: “How do we remotely authenticate a single user, in a way that cannot be forged, without relying on their memory?”

There are solutions to every part of that sentence, but I do not know of one that solves it entirely.

They could write their password down, but then they’re exposing themselves to the obvious risk of it being stolen. You could trust the librarian in a 2-of-3 system, but this seems very easy to abuse by the library staff.

Genuinely not sure of how this is solved.

A cryptographically-strong biometric key store at the library (e.g. finger-print or face scanner) that will only authenticate a physically present user and release a FIDO signature that could then be used in a multisig authentication?

Ctrl + F => "bio" and this comment was the only result out of 100+. Surprising!

I think biometrics sounds like the best solution. YubiKeys will get lost/damaged/stolen and then you're back to square one. With biometrics you shift the burden of paying for and managing hardware onto the library and individual users don't need to be responsible for anything.

Of course this doesn't solve the issue of the user who is already locked out, but librarians could at least proactively enroll users who have access to their account in order to prevent the issue from happening in the future.

TFA mentions YubiKeys, and acknowledges that they would work, but that the barrier is paying for 450k of them.

>>The keys are easier to use than TOTP

This has not been my experience, even for more knowledgeable people let alone normal users.

>> this particular library patron should have few authentication issues going forward

Until they lose or break the physical key, which will happen more often than losing or breaking their phone with the TOTP

The government should, *especially* if they are requiring mandatory access (though this should be illegal anyway).

But this isn't going to solve the issue of Google being too far gone (too big) to be worth saving : just shut them down.

The unhoused are much more likely to be robbed of their possessions than others. They don't have anywhere secure to store things.