Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How likely is losing a Google account?

jefftk.com

Post reply on HN
Print view View original

251–260 of 305 posts

Re: How likely is losing a Google account?

#251

Post by morpheos137 »

berniedurfee wrote: post #245
morpheos137 wrote: post #231

Earlier quoted context omitted.

Google certainly could charge a very small fee for existing gmail, youtube, etc, accounts and make a bunch of money. In fact there is a pretty strong argument that they are leaving money on the table by not doing so. Imagine you like your gmail and you have had it for the past decade. If Google charges only $1 per year across say a billion users that is a billion dollars. Even if they lose some users at the margin it…

Charge for the service and show you ads and sell your data like cable. It’s a win, win, win! I long for a post advertising world. What cataclysmic event or human evolutionary change could cause that, I wonder. Is there any sci-fi that has a world without advertising or is that so far-fetched it’s unimaginable to even futurists?

Funny enough advertising was relatively small part of the economy until the last several decades. Now it is an "industry" in the multi-trillion dollar range.

Even funnier, if Google search worked effectively for product discovery the vast majority of advertising would not be necessary.

Re: How likely is losing a Google account?

#252

Post by cNuckIGGER »

edent wrote: post #5

Yup - happened to me. https://shkspr.mobi/blog/2015/11/the-day-google-deleted-me/ "Luckily" I had enough identity documents to prove to Google's satisfaction that I was who I said I was. But even after I recovered the account, it was all screwed up. Since then I've dropped my reliance on Google. I don't use them for sign-in, my mail gets regularly backed up, I use alternative apps where I can. Google scale only works…

[dead]

Re: How likely is losing a Google account?

#253

Post by nmjenkins »

jefftk wrote: post #113
jeffbee wrote: post #29

Earlier quoted context omitted.

"I can reach a human" is a huge security vuln. I don't want people social engineering my identity provider.

This isn't just a hypothetical: a few years ago Fastmail support was socially engineered into giving access to a HN user's account: https://news.ycombinator.com/item?id=15855081

(Architect of Fastmail's login/account recovery protocols here.)

Firstly, I will say this incident was unacceptable, and we were deeply sorry about it. However, it is also the only time it has happened in our over 20 year history (to the best of our knowledge of course). We already had several projects underway to improve the security of account recovery at the time, which unfortunately hadn't quite landed yet. Since then we have introduced an automated recovery tool with a very carefully designed flow (more info: https://www.fastmail.com/blog/security-account-recovery/) that securely handles most common cases (e.g., forgotten password, or user's account stolen due to password reuse/phishing). Human support is still available, but any account recovery request can only be handled by senior support agents who have undergone rigorous training, and in the case of any doubt are escalated all the way up to our senior security engineers.

Elsewhere it's been mentioned that different people may have different priorities in balancing ensuring they don't lock themselves out, versus ensuring an attacker can never access their account. We provide some flexibility here. If a user has 2FA enabled, we must verify two separate means of verification to grant access, whether via our automated tool or support-assisted recovery. Users can also submit a support ticket to request we add a note to their account to never do human-assisted recovery.

I realise it's very hard to assess the security competence of an organisation from the outside, and for what it's worth, we think the Google security team also do an excellent job. But overall I think we do a very good job of keeping users secure while not locking them out of their own account.

Re: How likely is losing a Google account?

#254

Post by rektide »

fencepost wrote: post #198
rektide wrote: post #152

Earlier quoted context omitted.

Yes, well, Google & all sites also has a right to defend the network against attackers, which these people constitute. They actively degraded the site's quality & looked like & were an attack. Ultimately I think it's the right of these sites to handle matters as they may, and to a large degree caveat emptor us users. But I also very much want there to be forgiveness somewhere in these systems. The historical, classic…

My concern is that Google has built a system in which for a large portion of the population it's the one who controls whether individuals are allowed access to the Internet (via Android devices dominating the low-end of the smartphone market and many people now using smartphones as their primary/only access), and in addition it controls one of the dominant online entertainment options. So, control of whether you can…

> My concern is that Google has built a system in which for a large portion of the population it's the one who controls whether individuals are allowed access to the Internet, and in addition it controls one of the dominant online entertainment options. So, control of whether you can get online plus decisions about that which can be based on what you do while online.

Neither Google Search, nor Android, nor Youtube require a Google account.

If you want to follow someone on Youtube, Microsoft Edge will let you do so, without an account. Because it's just a web property & not an app, this sort of thing is trivially easy to do.

> There are probably a lot of people out there for whom a week in jail would be less of a long-term life disruption than loss of their Google account.

This is really a great point, and I totally agree. It makes me wish for two things: as you say, a lot more use of temporary bans. AFAIK Google does not do this anywhere. This is a powerful warning & wake up, with less long term impact. Second, a "strikes" policy that has some forgiveness built in. Someone who is one offense away from a forever-ban is in a miserable spot for their whole life, and they should have some ability to get back into graces. That should be part of the system too.

Re: How likely is losing a Google account?

#255

Post by rektide »

vorpalhex wrote: post #250
rektide wrote: post #152

Earlier quoted context omitted.

Yes, well, Google & all sites also has a right to defend the network against attackers, which these people constitute. They actively degraded the site's quality & looked like & were an attack. Ultimately I think it's the right of these sites to handle matters as they may, and to a large degree caveat emptor us users. But I also very much want there to be forgiveness somewhere in these systems. The historical, classic…

They posted an emoji in chat because the streamer told them to. Of his own chat. The chat has slow mode. Not like they can ddos the service. That's not an attack. Google should be ashamed of themselves for having an automated system that banned thousands without any kind of human loop review.

Ah my apologies, that is ridiculous. I should have read in. I thought it was a case of them being told to go flood another channel.

Right now we don't really have any way to know: was this corrected? Maybe Google doesn't do this anymore! But we have no idea. It would be a more moral & just stance for Google to actually talk about this kind of stuff, but, like most companies, there is little communication or updates on how these things work. The triplines are all invisible, the effect happens at digital speed. I find that to be one of the worst things about where we are; it is a intense info-industrial mechanization.

I still don't see how except automation we expect to build affordable at-scale systems. But the AI deciding your are an enemy & flipping the bit suddenly, like it does, is reckless, cruel, & shoddy.

Re: How likely is losing a Google account?

#256

Post by t0bia_s »

efsavage wrote: post #111
the_snooze wrote: post #103

Earlier quoted context omitted.

>Any company with a business model that takes your money and gives you service is inherently more secure than one that sells your eyeballs to advertisers in exchange for giving you free stuff. If anything, companies try to double-dip and serve multiple masters. See: the security and privacy mess in smart TVs. Last I checked, LG wasn't giving their TVs away.

> If anything, companies try to double-dip and serve multiple masters. See: the security and privacy mess in smart TVs. Last I checked, LG wasn't giving their TVs away. This is true, and you transition from customer to eyeballs once you take delivery of the product, but it is also tempered by the fact that they would like to sell you your next TV as well.

Why not a projector connected to NAS or RPi as media center that is free of ad craps?

Re: How likely is losing a Google account?

#257

Post by redeeman »

jasmer wrote: post #108
gary_0 wrote: post #69

Earlier quoted context omitted.

Any company with a business model that takes your money and gives you service is inherently more secure than one that sells your eyeballs to advertisers in exchange for giving you free stuff. The former companies have a direct incentive to keep giving you service as part of their core business. The latter are really only paying attention to the money they get from advertisers.

"is inherently more secure than one that sells your eyeballs to advertisers in exchange for giving you free stuff. " Not necessarily, and in fact this case I would disagree. I trust Google's security 10x more than that of FastMail. The 'advertising company' reaps in billions of $ with which they can get all sorts of good engineers for 0-day research, exploits, updates. They have a lot more of a reputation to defend.…

> They have a lot more of a reputation to defend.

that didnt stop them from having vulnerabilities in gmail that allowed anyone to fake the dkim verification and pretend to be the CEO of google, which they then ignored until someone did in fact do this, to prove it :)

Re: How likely is losing a Google account?

#258

Post by nirvdrum »

jeffbee wrote: post #224
nirvdrum wrote: post #68

Earlier quoted context omitted.

I'll take the limited risk. I've had to contact Fastmail support and it was a breath of fresh air. It's a bit absurd that something so fundamental as email has essentially no support from a company as large as Google; it's not a bug-free product. I suppose eliminating humans is a security win, but HN is full of stories of AI systems failing and banning accounts for essentially nothing. Not having a human to appeal to…

> AI systems failing and banning accounts for essentially nothing. The strongest statement you can make about the standard HN Google account outrage post is that the complainant is unaware of or unwilling to admit to the behavior that got their account suspended. Drawing the conclusion that all such complaints are false positives is not warranted by the evidence.

Unless you're implying that the false positive rate is 0%, then it's still a concern for me. I've seen cases where the user obviously did something in error but had no chance to appeal. E.g., they uploaded a photo that got flagged and then lost access to their email, domains, YouTube content, any form of social login, etc. My email account is too important to me to risk with an automated system without an option to appeal to a human. That risk is much higher to me than someone social engineering their way into my Fastmail account.

To me, this is analogous to backing up your BitLocker key with your online Microsoft account. Is it the optimal approach to security? No, but the far more likely risk factor is losing your key locally and then losing access to all of your data. I'll take the peace of mind that comes with knowing I can speak to a human if things go sideways. As an added benefit, I've been able to speak to a human when routine service issues have come up and it's been a pleasant experience.

Re: How likely is losing a Google account?

#259

Post by somerandomness »

gary_0 wrote: post #69
guptaneil wrote: post #13

It's true that every service has to deal with the same policy and lockout problems, but that doesn't lead to the conclusion that the risk is the same. I pay for FastMail because 1. if something goes wrong, I can reach a human without needing to write a viral blog post first. Other services pay for a customer service department. 2. I trust FastMail more to not shut down their product because they got bored. Sure Gmail…

Any company with a business model that takes your money and gives you service is inherently more secure than one that sells your eyeballs to advertisers in exchange for giving you free stuff. The former companies have a direct incentive to keep giving you service as part of their core business. The latter are really only paying attention to the money they get from advertisers.

The solution is to subscribe to Google One

Re: How likely is losing a Google account?

#260

Post by sanjayio »

edent wrote: post #64
bryanrasmussen wrote: post #16

Earlier quoted context omitted.

but there is not process or person that has ever existed that has been infallible, therefore you are arguing that Google scale does not work?

That's correct. Google boasts that it doesn't do customer service because it can't scale to meet the demands of their user base. That can only work if their systems and processes never cause a user to have to go further than an FAQ page or community support. Given that Google are fallible, you end up in a situation where users' have a poor experience and cannot contact someone to resolve it.

So strange, what if I wanted to pay $500 to be helped? It seems like there should be an option if desperate.
Post reply on HN