Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Updating our inactive account policies

blog.google

Post reply on HN
Print view View original

151–160 of 225 posts

Re: Updating our inactive account policies

#151

Post by kccqzy »

lamontcg wrote: post #124

If compromised accounts is the problem, then google could change the authorization on them, and require proof to get back into them. Of course that would require some kind of functional consumer-oriented support line where a human working at google could receive identifying information, check that against Google's internal records and public databases (your old phone numbers, addresses, etc) and check against the con…

> Of course that would require some kind of functional consumer-oriented support line where a human working at google could receive identifying information, check that against Google's internal records and public databases (your old phone numbers, addresses, etc) and check against the contents of the account and the old logs in order to determine that the person was who they said they were.

This is a highly unreliable, easily gamed non-solution to the problem. If people are determined enough to compromise your accounts, it's easy enough for them to find your old phone numbers, addresses, etc. Websites like https://www.fastpeoplesearch.com/ exist, and it provides generally accurate information on people.

Humans are always the weakest link. If you allow a random person to convince a Google employee that are the owner of the account, they are going to be tricked.

People on HN are always very quick to come to the conclusion that Big Tech not doing something is because of cost, whereas the reality is that the thing HN commenter proposes but Big Tech is not doing is flawed in the first place.

Re: Updating our inactive account policies

#152

Post by kortilla »

silverpepsi wrote: post #145

This is unbelievably generous, I'm happy. I feel like people forget Hotmail et al. circa 2001 when 60 days passed and you lost everything. Sometimes you could keep your account and just the data was wiped out. This was ABSOLUTELY THE NORM on the internet. Google overturned it single-handedly. In Texas my automatic payment for my storage garage where I have $10,000s of my designer clothing collection didn't go through…

Find a different storage provider. Seizing possessions is a pain in the ass and only shady ones would try to make that the business model.

Re: Updating our inactive account policies

#153

Post by culturestate »

silverpepsi wrote: post #145

This is unbelievably generous, I'm happy. I feel like people forget Hotmail et al. circa 2001 when 60 days passed and you lost everything. Sometimes you could keep your account and just the data was wiped out. This was ABSOLUTELY THE NORM on the internet. Google overturned it single-handedly. In Texas my automatic payment for my storage garage where I have $10,000s of my designer clothing collection didn't go through…

> I didn't use my Hong Kong subway card for 9 years and the balance was still there … the NY subway system 100% would have stolen my money

FWIW, most Octopus cards do expire eventually. If you don’t use it for three years, it’ll be deactivated and they’ll deduct a $15-per-year admin fee until either your balance is gone or you reactivate the card.

The only way to avoid this is to have a special concession card (seniors, kids, etc) or to buy an Octopus outright[1], which most people don’t do. The tourist Octopus, notably, can only be bought outright.

1. https://www.octopus.com.hk/en/consumer/customer-service/faq/...

Re: Updating our inactive account policies

#154

Post by Ekaros »

I wonder if this opens up the addresses for reuse? As these could potentially allow many types of attacks. Or even accessing other accounts.

Data can be deleted, but if gmail addresses can be reused in just 2 years that is rather short...

Re: Updating our inactive account policies

#155

Post by tivert »

dingusdew wrote: post #119
cj wrote: post #79

Earlier quoted context omitted.

Photobucket (remember them!) kept hundreds and hundreds of photos in my account with them despite complete inactivity for over a decade. I simply forgot the account existed, and remembered one day to find a ton of amazing decade old photos. There’s something to be said for doing things that earn your company respect from consumers. Had photobucket deleted my decade old photos because I didn’t log in frequently enough…

See, I read this situation as entirely differently. Google is not being unreasonable in understanding that they can't afford to store all data from everyone indefinitely. They are not being unreasonable that it is a potential security risk. Where they are being unreasonable is that they have basically gotten everyone addicted to their "free" product, and then, a decade after promoting the idea that no one should run…

> That Google account that your dead friend had that you keep on your buddy list because it gives you memories? Gone. That Facebook account with your dead family members photos and timeline? Gone. The Twitter account with all the tweets from you child who died too soon? Gone.

And unless you're the account owner, good luck archiving any of that. I believe Facebook is extremely hostile to scraping, and I don't think Twitter is very easy, either.

Re: Updating our inactive account policies

#156

Post by pcthrowaway »

krackers wrote: post #74
pcthrowaway wrote: post #59

I have a google account I haven't been able to log into for some time, because even though I know the password, it flagged "suspicious activity" at some point and has required me to verify with a phone number I no longer have, from when I lived in the U.S. (I now live in Canada, but it did let me log in from Canada when I first moved here) I was hoping that some day, someone would register that phone number and I'd b…

>and I'd be able to convince them to give me an authentication code Unless you got to know them well (as in personally face to face), a stranger asking for a 2fa code would appear to be an elaborate phishing campaign.

Most people honestly don't care.

Also, my name is google-able and some "white pages" style sites still list my old phone number, so I could verify my identity in other ways.

You'd be surprised what people will do if you talk them into it, lots of people wouldn't hesitate to give their own credentials up, they're not going to take issue giving a 2fa code for something they're not in the process of signing into.

This isn't a silicon valley area code or any other area where people are tech-savvy, I'd wager there's a 99% chance that whoever registers the number could be persuaded. I can literally have my family with the same (rare) last name meet them face to face.

Re: Updating our inactive account policies

#157

Post by pcthrowaway »

vxNsr wrote: post #149
pcthrowaway wrote: post #59

I have a google account I haven't been able to log into for some time, because even though I know the password, it flagged "suspicious activity" at some point and has required me to verify with a phone number I no longer have, from when I lived in the U.S. (I now live in Canada, but it did let me log in from Canada when I first moved here) I was hoping that some day, someone would register that phone number and I'd b…

If the number isn’t in service why not try signing up with some pbx and getting that number shouldn’t cost more than $30. If you truly believe you have some btc locked away there that’s a small price to pay to get it back.

I always figured I'd get access one day, and being unable to sell before then (if I even had BTC there) wouldn't necessarily be a bad thing.

But also, can you register a specific U.S. number as a person in another country? Seems like a lot of hassle and possibly more expensive than $30, if it's even possible.

Re: Updating our inactive account policies

#159

Post by withinboredom »

nitwit005 wrote: post #103
withinboredom wrote: post #6

This ... is not what is going on. When I worked at $bigcorp serving billions in traffic, what happened is that botnets would create accounts and leave them dormant for weeks/months/years (thousands of them), then start doing their bot thing. Account age says a lot when it comes to trust (usually) and spam detection. That's more than likely what they're seeing, not 'compromised' accounts. All this does is tell the spa…

That's possible, but the storage costs of unused accounts is probably significant. Given billions of users, they probably have several hundred million of them. Previous company I worked for had to create a process to clean up unused developer accounts. The fact that they were free to sign up meant we eventually got quite an impressive amount of them.

Meh, you move that data to cold storage and if they ever come back, it just takes longer to log in. They are already physically migrating data to closer data centers for you, so it isn’t any more complex than what they’re already doing.

Re: Updating our inactive account policies

#160

Post by Aeolun »

nhinck2 wrote: post #126
Aeolun wrote: post #120

Earlier quoted context omitted.

> it's a for-profit company that gives you free products in exchange for ads Exactly. If I stop using their free services, do I stop seeing their ads though? Because that’s kind of required to make this argument work. Or it’s just Google gets to delete my data because they have all the power in this relationship? I get to keep being fed ads, make Google money, lose my data, and cost Google less at the same time. Ther…

> Exactly. If I stop using their free services, do I stop seeing their ads though? How would you be seeing their ads if you aren't using their services?

Have you gone to any site on the internet in say, the last 20 years?
Post reply on HN