Hacker News Reader

Comment by everforward | Hacker News Reader

The problems are downstream of that.

Not having 2FA is going to allow some portion of users to get hacked. When those users do get hacked they will need a way to regain control of the account. Methods of regaining access to an account are notorious for bad actors social engineering their way to gaining control of accounts.

2FA relieves some of that, because even if you do get hacked you can provide a token from the authenticator that was attached to the account, proving that you do in fact own that account.

> I think it's excessively paternalistic to not provide that option.

I don't find it paternalistic. The goal is to cut down on support costs by reducing the number of users who get hacked and need assistance regaining access to their accounts, and to force users to have a method of demonstrating they own the account even if they can't log in. That it confers some additional security to users is nice, but not really the end goal.

View on HN

> Not having 2FA is going to allow some portion of users to get hacked. When those users do get hacked they will need a way to regain control of the account.

I don't think they do! This would be part of the tradeoff.

Currently, people who cannot use or rely on 2FA are getting locked out of their accounts even if they weren't hacked and knew their password! Isn't that worse?

What, how?

I got "hacked", I mean yeah it was a hack using an Android phone and Google's automated recovery system.

If not for the latter, my incredibru strong password would've saved me.

They also removed the phone and backup email from that account because I recovered the account once.

I sure hope 2FA cannot be removed once someone gains access (not without a call to the 2FA number/whatever) lol.

Either way, I'm not using it because it's a pain in the ass. I already hate that they lock me out if I try to log in from another country.

Gee, yeah I travel between EU countries, that's very unusual for most people.

> Currently, people who cannot use or rely on 2FA are getting locked out of their accounts even if they weren't hacked and knew their password! Isn't that worse?

Not if it's happening to fewer people than the alternative.

> Currently, people who cannot use or rely on 2FA are getting locked out of their accounts even if they weren't hacked and knew their password! Isn't that worse?

I don't think so. You seem to presume the end state of both is that the user is locked out, which is only half true.

With a lost 2FA device, the user and everyone else is locked out of the account.

With a compromised account, the user may be locked out but the hacker is not. The hacker is free to impersonate the user to social services, hospitals, potential employers, etc. If there's no mechanism for the user to regain control of the account, the hacker will have that access until the user can contact all of those people and give them a new email address. That could take a while, especially if we're considering that the user has a high chance of not having a phone at the moment.

But the locked account is much more likely than the compromised password in the real world.

Doesn’t Google offer the option of disabling 2FA?

> I don't find it paternalistic. The goal is to cut down on support costs by reducing the number of users who get hacked and need assistance regaining access to their accounts, and to force users to have a method of demonstrating they own the account even if they can't log in. That it confers some additional security to users is nice, but not really the end goal.

So we should be mindful of Google's profit margins, instead of homeless people's access to vital services?

If the service is truly vital it should be provided by the government, not Google. The government would also be free to set security policies and provide support at the level and cost demanded by the public. It is not and should not be the role of a private enterprise to act as a backstop for the fabric of society when it is not in their interests or their customers' overall interests.

The vital services are provided by the government, but require an email address. Some people have trusted Google to be their email provider, and Google is failing some of those people by denying them access unnecessarily.

If vital services rely on email, email is a vital service

I'm saying that if the public/government doesn't feel like Google's security policies are compatible with the homeless, the simplest solution is to set up a government-run email host.

Sure, the government should.

But we should also expect Google to give a small crap about the troubles it's putting some of its users through, especially when this is so important to some of its most vulnerable users, and adding an option to disable 2FA is such a small feature for a Mega corporation.

umm you DO know that Gmail isn't only free email, right? Like, just use another one which doesn't force 2FA. Why is this become an issue? I don't get it

It's security vs homeless access to vital services. I think it's a diffiult line to draw

I don't think it's difficult!

• The people who want security get to keep all the security they get today.

• The people who don't think about security and leave default settings intact keep all the security they get today.

• The people who explicitly ask for less security get less security.

• Some of the homeless will get increased access to vital services.

It's a win-win—unless you believe, for some reason, that people should have security forced on them even if they explicitly ask to not have it. I fundamentally don't understand this mindset. People should have the right to do dangerous things if they are warned of the risks involved.

>The people who explicitly ask for less security get less security.

The problem with that is less security is almost always more usable than more security, which leads to the greater amount of people being in that state, which is not just a danger to the user making the choice, it is a danger to others.

Not sure why this is being downvited. You could argue that forcing security upon users is why everyone knows about password-based logon today. Same could be said about the initiative for HTTPS everywhere.

Unless the requirement is extremely onerous, very few people will go into settings to check if it can be circumvented. For homeless people, it seems that it is indeed extremely onerous, so they or those who help them will have a reason to do this, but few others.

Keeping wrong people out is only half of what is required for security. You also have to let the right people in.

Is Google a vital service or is email a vital service?

Neither. Gmail is an email provider which has provided access to an account that these people have registered with providers of vital services.

And? Not every service is homeless-friendly. That's fine. There are literally hundreds of free email services.

Why is it fine? Why should we not ask and expect that one of the largest corporations on the planet make a tiny effort to improve the lives of some of its users at very little cost to them?

Sure, homeless people and those who help them should pick an alternate free email service. And the government should either set up its own email or stop requiring email contact for this sort of thing. But for people who are already Google users, Google should also try to make their lives significantly easier with a tiny bit of effort (allow someone to explicitly disable 2FA for gmail - with all the warnings and cautions that they can).

We should probably not force private companies to spend (or lose, no difference) money to solve societal problems that they are in no way responsible for.

That's like forcing pepboys to change the tires of senior citizens for free because social security isn't paying enough.

Maybe we should put our efforts towards fixing problems instead of asking private companies to put a bandaid on it at their expense.

Reply on news.ycombinator.com