4 ms·

Let me break down exactly why I think the language in what appears to be a lawyer-driven PR pot-bashing is so terrible, because if your plan was to go back to i

Let me break down exactly why I think the language in what appears to be a lawyer-driven PR pot-bashing is so terrible, because if your plan was to go back to internal G+ with "someone on HN said a lawyer wrote it" little will probably change. > Established GCP customers... > Online customers with established payment history... What exactly qualifies as being "established"? In the first example, additional stipulations around billing arrangements are imposed, but in the latter it remains unclear. > ...review for flagged fraud accounts... > ...event that fraud or account compromise activity is detected... You gotta stop using the f-bomb like that. This piece is supposed to be a follow on to a story of a customer who apparently was conducting completely non-fraudulent activity within their account. Your copy should, like your culture, assume "innocent until proven guilty". Saying something is "flagged for fraud" in a PR piece breaks that rule. > We will provide ways for customers to pre-verify their accounts with us if they desire... Sounds very passive-aggressively optional. Nor does it tell me what I actually gain here, or even a hint of what might be involved for verification or how potentially simple or easy it may or may not be - do I need my counsel to post via registered service on company letterhead confirmation of my organisation's official trading details, or do I click an link in an email? > There are also steps that customers can take to help us protect their accounts including... The word "protect" is suitable if you were a bank, and you wanted to encourage customer behaviour to prevent them being victims to fraudsters. But you're not, so really this language is suggesting customers need to "protect" themselves from your algorithms and automated systems, which is kind of inappropriate to be saying.

ebikelaw 8y ago
I suspect they'll treat it as a secret since telling you the magic formula for established accounts will compromise their anti-abuse regime. It is the same reason there are no docs about how to become a high-reputation email origin from Gmail's perspective. It's a trade secret.
- kajecounterhack 8y ago
  > they'll treat it as a secret since telling you the magic formula for established accounts will compromise their anti-abuse regime This is accurate. >> Online customers with established payment history... > What exactly qualifies as being "established"? In the first example, additional stipulations around billing arrangements are imposed, but in the latter it remains unclear. They can't tell you. Bad actors will even binary search the parameters of your fraud detection (source: I worked in fraud detection). Minimizing the information feedback loop to the baddies is super important to avoid becoming a loss function they can optimize against. This is true of every fraud department. Abuse detection is cat-and-mouse. Say as a provider I track your true IP through proxies by embedding some flash that calls home. You figure it out and block flash or do some clever sandboxing. I work with proxy providers to build blacklists. You somehow get the blacklist and just avoid all proxies on it. Etc etc.
  - slededit 8y ago
    Fraud detection needs to be balanced against the massive amounts of bad will being generated. It seems like anti-fraud has taken over. If Google keeps this up they aren't going to have many real customers to "protect".
    - kajecounterhack 8y ago
      Yeah, false positives are expensive. They aren't trying to make these mistakes :(
  - TheIronYuppie 8y ago
    Being "established" requires any of the following (from the original post) - all free: - Provide a valid phone number where we can reach you in the event of suspicious activity on your account. - Provide one or more billing admins to your account. - Provide a secondary payment method in case there are problems charging your primary method. - Contact our sales team to see if you qualify for invoice billing instead of relying on credit cards.

ebikelaw 8y ago

I suspect they'll treat it as a secret since telling you the magic formula for established accounts will compromise their anti-abuse regime. It is the same reason there are no docs about how to become a high-reputation email origin from Gmail's perspective. It's a trade secret.

kajecounterhack 8y ago
> they'll treat it as a secret since telling you the magic formula for established accounts will compromise their anti-abuse regime This is accurate. >> Online customers with established payment history... > What exactly qualifies as being "established"? In the first example, additional stipulations around billing arrangements are imposed, but in the latter it remains unclear. They can't tell you. Bad actors will even binary search the parameters of your fraud detection (source: I worked in fraud detection). Minimizing the information feedback loop to the baddies is super important to avoid becoming a loss function they can optimize against. This is true of every fraud department. Abuse detection is cat-and-mouse. Say as a provider I track your true IP through proxies by embedding some flash that calls home. You figure it out and block flash or do some clever sandboxing. I work with proxy providers to build blacklists. You somehow get the blacklist and just avoid all proxies on it. Etc etc.
- slededit 8y ago
  Fraud detection needs to be balanced against the massive amounts of bad will being generated. It seems like anti-fraud has taken over. If Google keeps this up they aren't going to have many real customers to "protect".
  - kajecounterhack 8y ago
    Yeah, false positives are expensive. They aren't trying to make these mistakes :(
- TheIronYuppie 8y ago
  Being "established" requires any of the following (from the original post) - all free: - Provide a valid phone number where we can reach you in the event of suspicious activity on your account. - Provide one or more billing admins to your account. - Provide a secondary payment method in case there are problems charging your primary method. - Contact our sales team to see if you qualify for invoice billing instead of relying on credit cards.