6 ms·

Good to see that Stockholm syndrome is alive and well.

netfl0 5y ago
I also found this story quite unsettling. Glad I’m not alone.
BoorishBears 5y ago
Wait til you find out about what other systems you rely on have imperfect fraud detection. There isn't a platform any large number of people use that is exempt from this.
- AnthonyMouse 5y ago
  > There isn't a platform any large number of people use that is exempt from this. I can think of a few. TCP/IP, email, BitTorrent, TLS, RSS. Millions of people use Linux. A single digit percentage of people, but millions of people. Not even counting the majority of servers on the internet. And the way Linux does it proves that you can do it that way. The largest platforms just don't.
  - BoorishBears 5y ago
    This is abusing semantics to the point you just make yourself look unknowledgeable. And honestly I feel like you know better... TCP/IP? Protocol. Email? You mean SMTP the protocol, or email platforms like GMail that people get locked out of all the time, or you mean a tiny platform with a fraction of the users? BitTorrent... the protocol. TLS... the protocol. Are you joking callling this a platform? RSS... same. Linux the OS? Because Linux sure doesn't have a centralized platform built into it last I checked. When you forget your Linux password where's the reset link? - Like to be clear, my statement is tautological. For any useful definition of "platform with large number of users" you need to have fraud protection. It's not really an ideological thing, anyone who's run any platform of a meaningful size knows you get attackers, and attackers scale. So you need to defend against attacks, and legitimate users can accidentally trigger any form of attack detection, human or otherwise.
    - AnthonyMouse 5y ago
      > Email? You mean SMTP the protocol, or email platforms like GMail that people get locked out of all the time, or you mean a tiny platform with a fraction of the users? Email is a platform. Anyone on any provider can email anyone else on any provider. And then you can choose one you trust not to lock you out, or run your own. The others are the same. A platform is something you build other things on top of. HTTPS is built on top of TLS. Webmail services are built on top of HTTPS and SMTP. You want a more traditional platform? Java. > Linux the OS? Because Linux sure doesn't have a centralized platform built into it last I checked. Who said anything about centralization? The centralization is the source of the defect. > When you forget your Linux password where's the reset link? Boot from live installer and reset the password. But also, why is "password resets" necessary for something to be a platform?
      - cmeacham98 5y ago
        I'm going to assume you're acting in good faith and just haven't seen this definition of platform. The one everyone else in this thread is using is "an application or website that serves as a base from which a service is provided" (that's straight from Merriam-Webster) Examples include (also from M-W): "music streaming platforms" "has built a cloud-computing platform for use by others" "billions of photos scraped from Facebook and other social media platforms" The only one that really could count in your examples is email, and if you think that doesn't have problems try setting up your own server and sending to gmail, hotmail, and other large providers without getting sent to spam or outright bounced.
        AnthonyMouse 5y ago
        That's definition (b) from M-W. Definition (a) is "operating system." Though that's kind of a layman's oversimplification and it's more specifically the operating system's API implementation, which is why Java qualifies by providing the same thing. But also, how does email not fit under (b)? Or Signal etc.?
        5y ago
  - cmeacham98 5y ago
    TCP/IP: Not really a "platform", but if you consider the internet as a platform: Your ISP puts you on a CGNAT with an abuser, or you random into a floating IP that is blacklisted as a bad actor Email: Try setting up your own email server and sending to $largeESP BitTorrent: Not a platform, but: This issue exists one layer up at the level of BitTorrent trackers (without which BT is mostly useless) TLS+RSS: Same as TCP/IP Linux: Not a platform, but you could probably get banned from package mirrors if you get the same IP as some asshole trying to DOS them and waste bandwidth
    - AnthonyMouse 5y ago
      > TCP/IP: Not really a "platform", but if you consider the internet as a platform: Your ISP puts you on a CGNAT with an abuser, or you random into a floating IP that is blacklisted as a bad actor So then you use a VPN. It's also not the same thing because that's being done by endpoints instead of the platform as an intermediary. > This issue exists one layer up at the level of BitTorrent trackers (without which BT is mostly useless) Modern BitTorrent uses a DHT for this. Trackers, to the extent that they still exist, are just to make peer discovery faster. > Linux: Not a platform, but you could probably get banned from package mirrors if you get the same IP as some asshole trying to DOS them and waste bandwidth There are many independent package mirrors and also you can access them from any IP address (e.g. using a VPN again). Also, this: http://manpages.ubuntu.com/manpages/bionic/man8/apt-p2p.8.html http://manpages.ubuntu.com/manpages/bionic/man8/apt-p2p.8.ht...
  - georgyo 5y ago
    TCP/IP relies on your ISP routing you. They can disown you, taking you offline. Email is fairly dependent on DNS which is fairly dependent on a domain. Your TLD can deregister your domain, and domain hijacking is still a thing. Similarly, most people do not have an appetite to self host email and are subject to the whims of their provider. BitTorrent is a decent example, DHT are fairly robust but also not easily searched. The discovery method of BitTorrent is frequently subject to DMCA takedowns. These takedowns have taken down legitimate torrents as well. TLS and RSS are not platforms, and fall victim to the same thing as email. The internet is built on many levels of trust, but just because we trust in it doesn't mean it isn't possible to deplatform at very low levels.
    - hermitdev 5y ago
      Not to mention self hosting your email will likely mean facing an uphill battle against spam filters blocking you. And seriously, fighting that alone could become a full time job unless you don't care to email.
    - AnthonyMouse 5y ago
      > TCP/IP relies on your ISP routing you. They can disown you, taking you offline. They can cancel your service, obviously, but that prevents you from using Verizon, not from using TCP/IP. You go sign up for AT&T or Comcast or Starlink and you can still communicate with anyone on the internet. > Email is fairly dependent on DNS which is fairly dependent on a domain. Which is why I didn't list DNS. But dependencies are something else. In theory anyone can deny you access to anything by putting you in prison, but by then you're really arguing that preventing this is impossible because a military could wrongfully kill you, rather than talking about whether some specific thing is the thing causing it.
- lelanthran 5y ago
  > Wait til you find out about what other systems you rely on have imperfect fraud detection. > > There isn't a platform any large number of people use that is exempt from this. Okay, but with the other platforms that I can think off[1], my computer and phone still continue working. I can effectively work without those platforms and do not need to purchase a new computer or phone. [1] Maybe I'm thinking of the wrong ones (Twitter, FB, AMZ, etc). Which platforms were you referring to?
  - philderbeast 5y ago
    lets start with bank's for instance? how do you feel about getting locked out of all your money for a false-positive fraud detection?
    - midasuni 5y ago
      Not too bad as I have far more recourse than getting locked out of Apple or google.
    - lelanthran 5y ago
      > lets start with bank's for instance? > > how do you feel about getting locked out of all your money for a false-positive fraud detection? I don't feel bad about it - it happened once or twice in the last 30 years and it was relatively trivial to fix[1]. I also don't mind that they freeze spending if they think my account was hijacked in any way. [1] Go into a branch with my ID, look at the transactions they think is fraud, declare that they are not, and get my account unfrozen. The whole process took about 60m, from leaving my front door to withdrawing money again.
      - BoorishBears 5y ago
        If Google and Apple started collecting government identification documents for everyone ahead of time it'd be pretty trivial too... Right now sometimes after the problem occurs you can provide those, but it's tough because they don't have those sitting around for every account. - Also fraud in this case is often being considered a bad actor yourself, most people haven't dealt with that from a bank. That's like the bank thinking the transactions you would admit to having made being fraudulent, so identifying you isn't really enough.
- josephcsible 5y ago
  The issue isn't automated fraud detection systems. The issue is the lack of humans who can override them when they're wrong.
  - BoorishBears 5y ago
    Except there are humans who can and their strict orders are to never do that. People don't realize, yes sometimes these companies are just ignoring CS, but when it comes to lockouts they want the humans to stonewall you. Otherwise what's the point of the automated fraud detection? The human operator will just become the new target, and SMS attacks are a great example of why that doesn't work
    - josephcsible 5y ago
      Are you saying that permanently locking legitimate people out of their accounts is acceptable collateral damage just to make fraud a bit more difficult?
      - BoorishBears 5y ago
        Are you incapable of making an argument that isn't a garbage-tier leading question? Like sorry but that pisses me off a bit, have the basic decency to present your point without the theatrics... - It's acceptable to make a system that makes it incredibly hard to get your account unlocked in very rare cases just to make fraud a lot more difficult. You see hundreds of these posts a year and billions of people use these devices a day.
        josephcsible 5y ago
        "Incredibly hard" or impossible? And again, are hundreds of people a year acceptable collateral damage?
        BoorishBears 5y ago
        Impossible or incredibly hard? Well impossible right? Because OP did not get back their account. Once your account is locked it is impossible to get it back, the bits that make up your account are instantly wiped right? Some L9 at google waves a magic wand and it's gone. No one who ever got wrongly locked out of a Google account has ever gotten it back, so it's impossible right? - And yes, hundreds out of billions is acceptable collateral damage. In case you didn't know, all systems are subject to similar tradeoffs, even ones of life and death. Planes aren't just designed with safety in mind, trade offs are made knowing they could cost lives because no one could afford to travel on a plane that was twice as safe for 10 times the cost. The water you drink is treated knowing that X incidences of illness and death occur for Y amount of contaminates because no one can afford water that's significantly more expensive for marginal benefit. Fraud is the same. You have to accept hundred out of a billion chances of going wrong because no one will pay not just a monetary cost, but a convenience cost. Most people won't be happy if Apple requires ID to make an iCloud account for example...
deleted 5y ago
[deleted]
WillPostForFood 5y ago
I read it more like a serf begging his lord to commute his death sentence. He has no power, so all he can do is flatter and ask forgiveness.
- joecot 5y ago
  He's deeply bought into the Apple ecosystem. He noted his Macbook arrived while he was fighting his account ban. I'm guessing iphone, ipad, thousands in music and movies on itunes, at least hundreds in apps, and an apple account required for all of it. As a Google user I'm not in tremendously better shape, but my PCs don't require Google to function, and at least I could load a different ROM on my phone if needed. Not that Android is tremendously useful outside the Google ecosystem.
  - tomjakubowski 5y ago
    > but my PCs don't require Google to function Macs don't require an Apple account to function either.
    - NotSammyHagar 5y ago
      Can you get os updates without an apple account? My Mac always bugs me for my apple ID when updating things. I'd be happy to get rid of that, maybe it's for apps.
      - mlyle 5y ago
        Yah, it's just for apps.
        greyface- 5y ago
        Pre-Catalina, major OS version updates were distributed as apps on the Mac App Store, and required an Apple ID to download. You're right that this isn't the case today, though.
    - 5y ago

I also found this story quite unsettling. Glad I’m not alone.

Wait til you find out about what other systems you rely on have imperfect fraud detection. There isn't a platform any large number of people use that is exempt from this.

AnthonyMouse 5y ago
> There isn't a platform any large number of people use that is exempt from this. I can think of a few. TCP/IP, email, BitTorrent, TLS, RSS. Millions of people use Linux. A single digit percentage of people, but millions of people. Not even counting the majority of servers on the internet. And the way Linux does it proves that you can do it that way. The largest platforms just don't.
- BoorishBears 5y ago
  This is abusing semantics to the point you just make yourself look unknowledgeable. And honestly I feel like you know better... TCP/IP? Protocol. Email? You mean SMTP the protocol, or email platforms like GMail that people get locked out of all the time, or you mean a tiny platform with a fraction of the users? BitTorrent... the protocol. TLS... the protocol. Are you joking callling this a platform? RSS... same. Linux the OS? Because Linux sure doesn't have a centralized platform built into it last I checked. When you forget your Linux password where's the reset link? - Like to be clear, my statement is tautological. For any useful definition of "platform with large number of users" you need to have fraud protection. It's not really an ideological thing, anyone who's run any platform of a meaningful size knows you get attackers, and attackers scale. So you need to defend against attacks, and legitimate users can accidentally trigger any form of attack detection, human or otherwise.
  - AnthonyMouse 5y ago
    > Email? You mean SMTP the protocol, or email platforms like GMail that people get locked out of all the time, or you mean a tiny platform with a fraction of the users? Email is a platform. Anyone on any provider can email anyone else on any provider. And then you can choose one you trust not to lock you out, or run your own. The others are the same. A platform is something you build other things on top of. HTTPS is built on top of TLS. Webmail services are built on top of HTTPS and SMTP. You want a more traditional platform? Java. > Linux the OS? Because Linux sure doesn't have a centralized platform built into it last I checked. Who said anything about centralization? The centralization is the source of the defect. > When you forget your Linux password where's the reset link? Boot from live installer and reset the password. But also, why is "password resets" necessary for something to be a platform?
    - cmeacham98 5y ago
      I'm going to assume you're acting in good faith and just haven't seen this definition of platform. The one everyone else in this thread is using is "an application or website that serves as a base from which a service is provided" (that's straight from Merriam-Webster) Examples include (also from M-W): "music streaming platforms" "has built a cloud-computing platform for use by others" "billions of photos scraped from Facebook and other social media platforms" The only one that really could count in your examples is email, and if you think that doesn't have problems try setting up your own server and sending to gmail, hotmail, and other large providers without getting sent to spam or outright bounced.
      - AnthonyMouse 5y ago
        That's definition (b) from M-W. Definition (a) is "operating system." Though that's kind of a layman's oversimplification and it's more specifically the operating system's API implementation, which is why Java qualifies by providing the same thing. But also, how does email not fit under (b)? Or Signal etc.?
        5y ago
- cmeacham98 5y ago
  TCP/IP: Not really a "platform", but if you consider the internet as a platform: Your ISP puts you on a CGNAT with an abuser, or you random into a floating IP that is blacklisted as a bad actor Email: Try setting up your own email server and sending to $largeESP BitTorrent: Not a platform, but: This issue exists one layer up at the level of BitTorrent trackers (without which BT is mostly useless) TLS+RSS: Same as TCP/IP Linux: Not a platform, but you could probably get banned from package mirrors if you get the same IP as some asshole trying to DOS them and waste bandwidth
  - AnthonyMouse 5y ago
    > TCP/IP: Not really a "platform", but if you consider the internet as a platform: Your ISP puts you on a CGNAT with an abuser, or you random into a floating IP that is blacklisted as a bad actor So then you use a VPN. It's also not the same thing because that's being done by endpoints instead of the platform as an intermediary. > This issue exists one layer up at the level of BitTorrent trackers (without which BT is mostly useless) Modern BitTorrent uses a DHT for this. Trackers, to the extent that they still exist, are just to make peer discovery faster. > Linux: Not a platform, but you could probably get banned from package mirrors if you get the same IP as some asshole trying to DOS them and waste bandwidth There are many independent package mirrors and also you can access them from any IP address (e.g. using a VPN again). Also, this: http://manpages.ubuntu.com/manpages/bionic/man8/apt-p2p.8.html http://manpages.ubuntu.com/manpages/bionic/man8/apt-p2p.8.ht...
- georgyo 5y ago
  TCP/IP relies on your ISP routing you. They can disown you, taking you offline. Email is fairly dependent on DNS which is fairly dependent on a domain. Your TLD can deregister your domain, and domain hijacking is still a thing. Similarly, most people do not have an appetite to self host email and are subject to the whims of their provider. BitTorrent is a decent example, DHT are fairly robust but also not easily searched. The discovery method of BitTorrent is frequently subject to DMCA takedowns. These takedowns have taken down legitimate torrents as well. TLS and RSS are not platforms, and fall victim to the same thing as email. The internet is built on many levels of trust, but just because we trust in it doesn't mean it isn't possible to deplatform at very low levels.
  - hermitdev 5y ago
    Not to mention self hosting your email will likely mean facing an uphill battle against spam filters blocking you. And seriously, fighting that alone could become a full time job unless you don't care to email.
  - AnthonyMouse 5y ago
    > TCP/IP relies on your ISP routing you. They can disown you, taking you offline. They can cancel your service, obviously, but that prevents you from using Verizon, not from using TCP/IP. You go sign up for AT&T or Comcast or Starlink and you can still communicate with anyone on the internet. > Email is fairly dependent on DNS which is fairly dependent on a domain. Which is why I didn't list DNS. But dependencies are something else. In theory anyone can deny you access to anything by putting you in prison, but by then you're really arguing that preventing this is impossible because a military could wrongfully kill you, rather than talking about whether some specific thing is the thing causing it.
lelanthran 5y ago
> Wait til you find out about what other systems you rely on have imperfect fraud detection. > > There isn't a platform any large number of people use that is exempt from this. Okay, but with the other platforms that I can think off[1], my computer and phone still continue working. I can effectively work without those platforms and do not need to purchase a new computer or phone. [1] Maybe I'm thinking of the wrong ones (Twitter, FB, AMZ, etc). Which platforms were you referring to?
- philderbeast 5y ago
  lets start with bank's for instance? how do you feel about getting locked out of all your money for a false-positive fraud detection?
  - midasuni 5y ago
    Not too bad as I have far more recourse than getting locked out of Apple or google.
  - lelanthran 5y ago
    > lets start with bank's for instance? > > how do you feel about getting locked out of all your money for a false-positive fraud detection? I don't feel bad about it - it happened once or twice in the last 30 years and it was relatively trivial to fix[1]. I also don't mind that they freeze spending if they think my account was hijacked in any way. [1] Go into a branch with my ID, look at the transactions they think is fraud, declare that they are not, and get my account unfrozen. The whole process took about 60m, from leaving my front door to withdrawing money again.
    - BoorishBears 5y ago
      If Google and Apple started collecting government identification documents for everyone ahead of time it'd be pretty trivial too... Right now sometimes after the problem occurs you can provide those, but it's tough because they don't have those sitting around for every account. - Also fraud in this case is often being considered a bad actor yourself, most people haven't dealt with that from a bank. That's like the bank thinking the transactions you would admit to having made being fraudulent, so identifying you isn't really enough.
josephcsible 5y ago
The issue isn't automated fraud detection systems. The issue is the lack of humans who can override them when they're wrong.
- BoorishBears 5y ago
  Except there are humans who can and their strict orders are to never do that. People don't realize, yes sometimes these companies are just ignoring CS, but when it comes to lockouts they want the humans to stonewall you. Otherwise what's the point of the automated fraud detection? The human operator will just become the new target, and SMS attacks are a great example of why that doesn't work
  - josephcsible 5y ago
    Are you saying that permanently locking legitimate people out of their accounts is acceptable collateral damage just to make fraud a bit more difficult?
    - BoorishBears 5y ago
      Are you incapable of making an argument that isn't a garbage-tier leading question? Like sorry but that pisses me off a bit, have the basic decency to present your point without the theatrics... - It's acceptable to make a system that makes it incredibly hard to get your account unlocked in very rare cases just to make fraud a lot more difficult. You see hundreds of these posts a year and billions of people use these devices a day.
      - josephcsible 5y ago
        "Incredibly hard" or impossible? And again, are hundreds of people a year acceptable collateral damage?
        BoorishBears 5y ago
        Impossible or incredibly hard? Well impossible right? Because OP did not get back their account. Once your account is locked it is impossible to get it back, the bits that make up your account are instantly wiped right? Some L9 at google waves a magic wand and it's gone. No one who ever got wrongly locked out of a Google account has ever gotten it back, so it's impossible right? - And yes, hundreds out of billions is acceptable collateral damage. In case you didn't know, all systems are subject to similar tradeoffs, even ones of life and death. Planes aren't just designed with safety in mind, trade offs are made knowing they could cost lives because no one could afford to travel on a plane that was twice as safe for 10 times the cost. The water you drink is treated knowing that X incidences of illness and death occur for Y amount of contaminates because no one can afford water that's significantly more expensive for marginal benefit. Fraud is the same. You have to accept hundred out of a billion chances of going wrong because no one will pay not just a monetary cost, but a convenience cost. Most people won't be happy if Apple requires ID to make an iCloud account for example...

deleted 5y ago

[deleted]

WillPostForFood 5y ago

I read it more like a serf begging his lord to commute his death sentence. He has no power, so all he can do is flatter and ask forgiveness.

joecot 5y ago
He's deeply bought into the Apple ecosystem. He noted his Macbook arrived while he was fighting his account ban. I'm guessing iphone, ipad, thousands in music and movies on itunes, at least hundreds in apps, and an apple account required for all of it. As a Google user I'm not in tremendously better shape, but my PCs don't require Google to function, and at least I could load a different ROM on my phone if needed. Not that Android is tremendously useful outside the Google ecosystem.
- tomjakubowski 5y ago
  > but my PCs don't require Google to function Macs don't require an Apple account to function either.
  - NotSammyHagar 5y ago
    Can you get os updates without an apple account? My Mac always bugs me for my apple ID when updating things. I'd be happy to get rid of that, maybe it's for apps.
    - mlyle 5y ago
      Yah, it's just for apps.
      - greyface- 5y ago
        Pre-Catalina, major OS version updates were distributed as apps on the Mac App Store, and required an Apple ID to download. You're right that this isn't the case today, though.
  - 5y ago