Hacker News Reader

Comment by Wowfunhappy | Hacker News Reader

Look, I'd love to fix homelessness in America! Really, I would! But Google's policies are causing people to get locked out of their accounts now, today.

Google could put a toggle in Google Account settings titled something like "Allow anyone who knows my password to log in to my Google account (less secure)." It could sit above a description of the risks involved. It would need to be disabled by default, and it wouldn't help users who don't know about it. It certainly would not fix homelessness in society. But it would do a lot of good for a lot of people!

Would this option lead to some increased number of hacked accounts? Probably, but these would be accounts that explicitly opted in to that risk! I think it's excessively paternalistic to not provide the option. Every life situation is unique, and people know their own lives better than Google does.

View on HN

This is a result of taking a product made by someone else for a certain purpose and then using it for one it isn't intended. Its not Google's fault gmail is a bad fit here. They didn't design it with this use case in mind.

The solution is to use one that is. Why are case workers directing the homeless to setup gmail accounts? Because they haven't been provided with a better solution by the system they work within.

So its the government's problem to fix. They are the ones handing out phones and setting the expectation to communicate through email. So they can either design an email service themselves that fits their needs. Or they can work with an industry partner, such as google or someone else to provide the service.

Normal gmail is a one size fits all commodity solution. It works well enough for most people, most of the time. Specialized problems call for specialized solutions. Complaining that google didn't think of you is misplaced.

Should users with poor vision also have to use a special blind-person email provider? Because, I'd expect supporting screen readers to take significantly more effort than adding the setting I outlined.

Also, if I was homeless, I wouldn't want my email address to indicate I was homeless.

I broadly agree that it isn't Google's job to cater to everyone, but in this instance, the ask seems overwhelmingly reasonable—and less than what we expect in other circumstances.

What is the ask that is overwhelmingly reasonable? As has been pointed out to me and others, Google already offers a way to turn off 2FA - https://support.google.com/accounts/answer/1064203 Naively this seems like it should solve the 2FA problem for the unhoused community members in question.

With this in mind, what else should Google do?

Even when 2FA is disabled, Google will insist on additional verification (phone, recovery email, etc) if it thinks something about your browser or IP address is unusual, even if you know your password. If you don't have a verification method (or cannot access it), Google will literally just lock you out. I have personally experienced this.

It should be possible to turn this off!

OK. That raises all sorts of follow-up questions, as turning off security measures can be expected to have consequences.

What should Google do in the scenario that this purposely-low-security-for-the-unhoused account is breached? What about abuse? Are we OK with Google just shutting off accounts in that scenario? Are we prepared to accept that the members of our community experiencing being unhoused will find themselves constantly creating new accounts as their old ones are shut off or rendered unusual from the consequences of purposely-low-security-for-the-vulnerable?

Remember, things like gmail accounts are under constant attack. Security measures, the very ones we're talking about disabling, help keep those attacks at bay. Each of those things that triggers verification actually lines up with real attack patterns.

So while this may be a small-ish thing to ask for, I'm a little concerned about the consequences. We're literally asking to offer the most vulnerable and marginalized members of society shittier security and ignoring the effects of this.

> Are we OK with Google just shutting off accounts in that scenario? Are we prepared to accept that the members of our community experiencing being unhoused will find themselves constantly creating new accounts as their old ones are shut off or rendered unusual from the consequences of purposely-low-security-for-the-vulnerable?

I am, yes, if the alternative is that they loose access to their account every few months!

Also, at least this way people have the ability to keep their accounts truly safe if they choose a strong, unique password. If Google just locks them out no matter what, there's no recourse.

> I am, yes, if the alternative is that they loose access to their account every few months!

Good to hear, though I confess to a bit of confusion. The issue I pointed to is that they're going to lose access to their accounts frequently as their accounts get breached, abused, and shut off. As opposed to losing access because they lost their phone number.

> Also, at least this way people have the ability to keep their accounts truly safe if they choose a strong, unique password. If Google just locks them out no matter what, there's no recourse.

As described in the Twitter thread, we're talking about people who already struggle to remember their passwords. I doubt this will improve if we require basically regular people to have strong passwords, but perhaps you have reason to think differently.

Basically I think you're trading one cause of lockout without recourse for another cause of lockout without recourse with this proposal. This does not strike me as progress. For my own part, I think Google is the wrong place to be trying to address this issue - perhaps porting phone numbers within the Lifeline phone program would be better.

I don't think people's accounts are getting hacked anywhere near three times per year. And while remembering passwords is a problem, surely it's easier than remembering a password and keeping track of a second factor device?

You're right, people's accounts aren't getting hacked that often. This is because of a wide array of security measures - the ones you're suggesting be disabled. The frequency of breaches goes up significantly without those in place, especially when coupled with the kind of weak password likely to be chosen by struggling, marginalized, vulnerable people whose priority is not keeping bots at bay.

In short - yes, but the consequences defeat the point.

If Google is going to position itself as the face of the internet, then it has to live up to that responsibility; it can’t go, hm yes, use our browser and our email service and our phones, but only if you fit into this category of prescribed users.

Of course they can. It's the only thing they've ever done. I honestly can't think of a company that thinks less of its users than Google does - that's because in their view, they have no users - they only have eyeballs, that are worth anywhere from fractional cents to hundreds of dollars every time they can grab them.

Using "support" and "Google" in the same sentence is laughable. They barely support the ad clients that pay their freight. Google's entire business model is built around NEVER providing support for the users of their technologies, and killing off any products that don't monetize.

Gmail is a perfect fit in theory. Google provides a product, workspace, where you can hand out gmail addresses and reset them at need. Given that the cost of providing such accounts is actually less because the support burden falls on the city it might be possible to convince Google to provide them at less than the standard cost.

> They didn't design it with this use case in mind.

Where on the gmail page does it say "not for homeless people, sorry"?

Adding (and forcing) 2FA was a recent decision from Google, which came a long time after Gmail the product was already introduced. There are millions of accounts which were created long before anyone had an idea what a smartphone was, let alone phone-based 2FA.

The problems are downstream of that.

Not having 2FA is going to allow some portion of users to get hacked. When those users do get hacked they will need a way to regain control of the account. Methods of regaining access to an account are notorious for bad actors social engineering their way to gaining control of accounts.

2FA relieves some of that, because even if you do get hacked you can provide a token from the authenticator that was attached to the account, proving that you do in fact own that account.

> I think it's excessively paternalistic to not provide that option.

I don't find it paternalistic. The goal is to cut down on support costs by reducing the number of users who get hacked and need assistance regaining access to their accounts, and to force users to have a method of demonstrating they own the account even if they can't log in. That it confers some additional security to users is nice, but not really the end goal.

> Not having 2FA is going to allow some portion of users to get hacked. When those users do get hacked they will need a way to regain control of the account.

I don't think they do! This would be part of the tradeoff.

Currently, people who cannot use or rely on 2FA are getting locked out of their accounts even if they weren't hacked and knew their password! Isn't that worse?

What, how?

I got "hacked", I mean yeah it was a hack using an Android phone and Google's automated recovery system.

If not for the latter, my incredibru strong password would've saved me.

They also removed the phone and backup email from that account because I recovered the account once.

I sure hope 2FA cannot be removed once someone gains access (not without a call to the 2FA number/whatever) lol.

Either way, I'm not using it because it's a pain in the ass. I already hate that they lock me out if I try to log in from another country.

Gee, yeah I travel between EU countries, that's very unusual for most people.

> Currently, people who cannot use or rely on 2FA are getting locked out of their accounts even if they weren't hacked and knew their password! Isn't that worse?

Not if it's happening to fewer people than the alternative.

> Currently, people who cannot use or rely on 2FA are getting locked out of their accounts even if they weren't hacked and knew their password! Isn't that worse?

I don't think so. You seem to presume the end state of both is that the user is locked out, which is only half true.

With a lost 2FA device, the user and everyone else is locked out of the account.

With a compromised account, the user may be locked out but the hacker is not. The hacker is free to impersonate the user to social services, hospitals, potential employers, etc. If there's no mechanism for the user to regain control of the account, the hacker will have that access until the user can contact all of those people and give them a new email address. That could take a while, especially if we're considering that the user has a high chance of not having a phone at the moment.

But the locked account is much more likely than the compromised password in the real world.

Doesn’t Google offer the option of disabling 2FA?

> I don't find it paternalistic. The goal is to cut down on support costs by reducing the number of users who get hacked and need assistance regaining access to their accounts, and to force users to have a method of demonstrating they own the account even if they can't log in. That it confers some additional security to users is nice, but not really the end goal.

So we should be mindful of Google's profit margins, instead of homeless people's access to vital services?

If the service is truly vital it should be provided by the government, not Google. The government would also be free to set security policies and provide support at the level and cost demanded by the public. It is not and should not be the role of a private enterprise to act as a backstop for the fabric of society when it is not in their interests or their customers' overall interests.

The vital services are provided by the government, but require an email address. Some people have trusted Google to be their email provider, and Google is failing some of those people by denying them access unnecessarily.

If vital services rely on email, email is a vital service

I'm saying that if the public/government doesn't feel like Google's security policies are compatible with the homeless, the simplest solution is to set up a government-run email host.

Sure, the government should.

But we should also expect Google to give a small crap about the troubles it's putting some of its users through, especially when this is so important to some of its most vulnerable users, and adding an option to disable 2FA is such a small feature for a Mega corporation.

umm you DO know that Gmail isn't only free email, right? Like, just use another one which doesn't force 2FA. Why is this become an issue? I don't get it

It's security vs homeless access to vital services. I think it's a diffiult line to draw

I don't think it's difficult!

• The people who want security get to keep all the security they get today.

• The people who don't think about security and leave default settings intact keep all the security they get today.

• The people who explicitly ask for less security get less security.

• Some of the homeless will get increased access to vital services.

It's a win-win—unless you believe, for some reason, that people should have security forced on them even if they explicitly ask to not have it. I fundamentally don't understand this mindset. People should have the right to do dangerous things if they are warned of the risks involved.

>The people who explicitly ask for less security get less security.

The problem with that is less security is almost always more usable than more security, which leads to the greater amount of people being in that state, which is not just a danger to the user making the choice, it is a danger to others.

Not sure why this is being downvited. You could argue that forcing security upon users is why everyone knows about password-based logon today. Same could be said about the initiative for HTTPS everywhere.

Unless the requirement is extremely onerous, very few people will go into settings to check if it can be circumvented. For homeless people, it seems that it is indeed extremely onerous, so they or those who help them will have a reason to do this, but few others.

Keeping wrong people out is only half of what is required for security. You also have to let the right people in.

Is Google a vital service or is email a vital service?

Neither. Gmail is an email provider which has provided access to an account that these people have registered with providers of vital services.

And? Not every service is homeless-friendly. That's fine. There are literally hundreds of free email services.

Why is it fine? Why should we not ask and expect that one of the largest corporations on the planet make a tiny effort to improve the lives of some of its users at very little cost to them?

Sure, homeless people and those who help them should pick an alternate free email service. And the government should either set up its own email or stop requiring email contact for this sort of thing. But for people who are already Google users, Google should also try to make their lives significantly easier with a tiny bit of effort (allow someone to explicitly disable 2FA for gmail - with all the warnings and cautions that they can).

We should probably not force private companies to spend (or lose, no difference) money to solve societal problems that they are in no way responsible for.

That's like forcing pepboys to change the tires of senior citizens for free because social security isn't paying enough.

Maybe we should put our efforts towards fixing problems instead of asking private companies to put a bandaid on it at their expense.

This seems like something the homeless services are best positioned to fix by providing email hosting to their clients. They know their clients are actual humans, not hackers, so can provide the continuity that the giant providers can't.

That's almost exactly what Google has done. Here's how you turn off 2FA on your account:

1. Go to myaccount.google.com

2. Press "Security"

3. Press "2 step verification"

4. Enter your password

5. Press "Turn off"

6. Confirm the dialog that says "Turning off 2-Step Verification will remove the extra security on your account, and you’ll only use your password to sign in."

I recall that the problem was broader than 2FA. They also re-verify accounts that have been idle, or that are being accessed from a new location. Or issues if you've forgotten the password and don't have a phone.

This is exactly it. And if you don't have a verification method on file, Google will just lock the account if it thinks something about your browser or IP address is unusual. Even if you know your password.

Speaking as a long-time Gmail user who doesn't have a mobile, this is kind of terrifying. Sounds like I need to look into moving to Fastmail or somesuch pronto.

If you have a backup email on your account, that's sufficient (assuming you can get into the backup email), at least in my experience.

Those steps don’t actually turn off 2FA for Google accounts.

If you login from a new computer or unrecognized IP, Google forces you to use the YouTube app on your phone to enter a “code” to login. It sometimes doesn’t even let you get a text code. God forbid I lose my phone or delete the YouTube app and login from a new IP. I don’t know how I would even get into my account.

I don’t know how this isn’t a wider spread issue affecting more people but I guess Google developers live in a perfect world where the YouTube app auth can never fail and you never lose your phone.

That's Weird, I've never had to do that. I can just login to Google with my username/password. If it doesn't recognize the device it just pushes a notification of the sign in to my phone

That's exactly what they are describing - the push notification to the phone _that the user has lost_.

It's just a notification, it can be ignored (for me). I don't usually even notice its there until hours later. You don't have to acknowledge it in any way.

It also has nothing to do with the YouTube app, and there is no code I have to enter anywhere.

I've never had any form of 2FA on my Google account.

You may have never experienced it, but it does happen. Not just a notification.

I never said it doesn't happen?? I literally even specified "(for me)."

I believe you, I'm extremely surprised I didn't see this considering I've logged in from all sorts of sketchy IPs/VPNs.

Then don’t use Google for email. There are plenty of other free email providers that do not employ that much security. Problem solved

My problem isn’t that gmail is too secure, it’s that the 2FA setting doesn’t actually turn off what it’s supposed to turn off. Not sure if this is a bug or intended behavior.

Just use another email provider. There are many other free ones and reasonably priced paid services. The paid services tend to better listen to their users since they’re the real customers

Have you actually tried disabling 2FA? Because I just did. I followed the steps above then signed in to Google from a clean browser profile with password only. No problem. Then I connected to a VPN in a different country and signed in from another clean profile. Again, no problem.

If you have 2FA enabled, then yes, of course it will ask you for the second factor if you're doing something unusual.

But with 2FA disabled, logging in with just a password works fine.

I have no idea what part of Google's fingerprinting panopticon decided it was okay to let you in from a clean profile, but I can promise you that in the past, I have been locked out. Yes, 2FA was turned off. And there are lots of other reports of this happening around the web, and even here on HN, so I'm not unique.

Yes, I’ve tried turning it off and on multiple times and it still makes me do 2FA.

Yup. I had 2-factor turned off and tried to login to an old gmail account from maybe 5 years prior.

I had the right password and recovery email but I wanted to txt a code to a phone number I didn’t have any more.

That seems insane to me. Right password, access to “recovery email” and still blocked.

What ended up working for me was trying to login when I took a vacation back to the same city when I last logged in.

Didn’t get asked for the OTP code, so could get in and update the number.

I wouldn’t have such an issue if Google had customer support and let you send other proof of identity. But they don’t.

And now I’m getting weird requests to confirm I logged in from the YouTube app on other devices. YouTube?

While your proposal is perfectly reasonable, I couldn't help but notice that your opening was an example of the "'think of the kids + terrorism'" mentioned by GP.

> Look, I'd love to stop CP distribution in America! Really, I would! But Google's encryption policies are preventing law enforcement from intercepting pedophile communications now, today.

It's the same "think of [vulnerable group]" type of statement.

The purpose of that sentence was to bring us back to the issue at hand. GP was essentially saying (as I interpreted it) that we should focus on the root causes of homelessness instead of worrying about day-to-day concerns like how the homeless access email. I think we should do both, especially when the latter would be relatively simple.

But also, yes, there are in fact many times when it's important to consider the needs of different groups of people! That isn't to say that the ends always justify the means—it depends on what the means are—but reasonable accommodations should be made where possible.

> Google could put a toggle in Google Account settings titled something like "Allow anyone who knows my password to log in to my Google account (less secure)."

Google allows someone of your choosing, who must also have a GMail account, to takeover one's account after x months of inactivity. It's not great but it's better than nothing and it has the benefit of being an option that exists today.

I can understand your statement, but by doing that you will find that A LOT of people will check the insecure options because “that a not going to happen to me”.

Remember you have the “rescue keys” from google to avoid these kind of problems.

The bigger problem is how you teach those people how to use the services in their situation.

How about just don't use Google services, Tutanota is free and is just as good.

The case workers could have an email account to use as the recovery email account. This already exists.

While I don't think that's a bad idea in some situations, it means trusting the case worker with access to the entire account (as they could use the recovery email to reset the password). It's also an extra burden to put on the case worker, and the individual who has to coordinate with the case worker.

Additionally, this only exists in some magical, fantastical world where the unhoused only have one case worker. In reality the unhoused bounce between a patchwork of government and non-profit services, and because of the soul-crushing workload and emotional labor of those jobs the individuals in each role are also subject to frequent turnover. So the only way this would work is an account that's shared between everyone who might work with that unhoused client at each organization (there are often multiple handling different aspects such as housing, mental health, money for groceries, etc.), and as clients move geographically or do other things that make them eligible or ineligible for each organization's services, that recovery account would also need to change or transition to some new org. Even a single recovery email address is just a totally unworkable solution for the reality they face.

That wouldn't help at all unless it was the default.

Why? The homeless aren't stupid, and we have libraries and other institutions that can provide education.

The state could run an email service.

Reply on news.ycombinator.com