I manage a computer lab in a residential reentry setting. The shared computers intentionally reset completely after every session so that documents, credentials, and personal information are not left for the next person. Residents use the machines for resumes, job applications, schoolwork, password resets, and communicating with employers.
The challenge is email authentication. Many residents already use Gmail, but Google treats each login as a new device after every reset and often requires a phone verification code. Most residents have personal phones but do not have regular access to them while they are here. We tried using a staff phone for verification, but there are limits on how many accounts can use one number. Creating new accounts with a privacy-focused provider has also caused manual verification delays because many accounts are being created from the same IP address.
I am not looking to bypass MFA or weaken the security of the lab. I want residents to retain ownership of their accounts and ideally keep using their addresses after leaving, while avoiding a process that staff must constantly manage. How do other shared computer labs, libraries, or similar programs handle email access, account recovery, and two-factor authentication at scale? Would hardware security keys, passkeys, managed mailboxes, or an organizational email system be a better fit?
4 Answers
A shared staff phone running an authenticator app may work technically, and authenticator apps generally do not impose the same phone-number limit as SMS verification. However, putting authentication for many personal accounts on one organizational device creates ownership, privacy, and account-recovery concerns. If you use this approach, document who controls the device, make sure residents retain independent recovery methods, and remove the staff device when they leave.
Rather than trying to make consumer Gmail accounts behave like a kiosk service, consider a managed mailbox system for the program. A domain-based setup through a business or nonprofit email platform would let you control provisioning, recovery, and security policies. Residents could use those addresses for applications and school-related work while they are enrolled, while still keeping their personal accounts separate. The downside is planning for departures, mailbox retention, forwarding, and what happens when someone leaves without notice.
A managed system seems much easier to support, but the address would ideally remain useful after someone leaves. We would need a clear policy for exporting mail, forwarding messages, and transferring or closing the account.
If the organization has an eligible nonprofit or public-sector arrangement, investigate managed workspace licenses rather than free consumer accounts. Some business email platforms can apply trusted-location policies, device management, or stronger enrollment and recovery controls. I would be cautious about simply exempting the lab's IP address from MFA, though: a shared public location is exactly where you want strong authentication, and an IP can be shared or compromised. The better solution is a managed identity and a second factor that the individual can retain.
Hardware security keys such as basic YubiKeys could be a good compromise. A resident would use their personal phone or another trusted method once to add the key to their account, then use the key for later sign-ins on the wiped computers. When they leave, the key can be removed from the account and reset for someone else, or issued permanently if the budget allows. You would need an inventory and recovery process for people who leave unexpectedly.
That is appealing because the personal phone would only be needed during setup. The main challenge would be tracking and reissuing keys when residents leave suddenly, so I will discuss the inventory and ownership process with our IT staff.
That is my concern too. The phone would stay with staff, but I do not want the program to become the long-term owner of residents' personal accounts.