4 ms·

I've had requests like this from family members supposedly "stuck overseas" etc. These types of requests are often scams. My boss recently emailed me (from a w

I've had requests like this from family members supposedly "stuck overseas" etc. These types of requests are often scams. My boss recently emailed me (from a weird email) saying the landlords payment hadn't gone through and we needed to wire them the money pronto and they were stuck traveling and couldn't do it. This was a scam. In my neighborhood folks rent out houses for great deals, the landlord is temporarily traveling and can't meet. A fair number of these turn out to be scams. I just mention this because if some low level support agent providing support to FREE accounts was able to reset an account based on this narrative - and no phone access - that would be HUGE security HOLE. If google starts allowing recovery of passwords by folks overseas who are "stuck overseas" with no documents - game over. We are focusing on the folks getting locked out, but google is doing a fair bit to keep folks from getting taken over. I have a 2FA key (hardware) they ask me for once a month. I'm not sure how someone takes over my account unless they get access to my computer with remote access and then maybe re-uses a session somehow? Even then I have to re-auth when doing security steps... so it's a bit weird to have an account takeover like this. My request. For a fee of $1,000, an in person visit, fingerprints, and research effort, communication with existing account holder for any disputes (ie, someone sold them the account) google would allow for an account recovery. This last step is what is missing. Charge $2,500 even. In some cases that would be worth it and allow them to make a pretty good job on recovery. Even wipe the account / lock all old messages so they are unreadable on recovery.

extheat 5y ago
I’m not sure money would be a great solution here. Malicious actors would be able to fork that over for important targets. IMO this is definitely something that should go through the legal system rather than any honor system. If people lie to the authorities in any respectable country, that’s a criminal offense and could mean jail time.
- tempnow987 5y ago
  The money pays google for the work needed to validate. Just showing up in person is a huge control. A ton of scams rely on no one ever showing up IN PERSON. Let google troll through google photos etc, run face match, ask you questions about what you did when, send someone to visit your living situation or work etc. Perfect? No, but maybe a better compromise.
  - ghaff 5y ago
    Yep. Some financial services transactions switched to allowing electronic/telephonic transactions during the pandemic. My broker basically switched back to certain transactions requiring in-person confirmation in some way or another. It's a nuisance but it also shuts down a lot of avenues of fraudulent activity.
- tempestn 5y ago
  Impersonating someone to take over their account is already illegal in most 'respectable' countries, but generally the people doing this either can't be traced (at least not cost-effectively) and/or don't live in one of those countries. I think the point of the money here isn't to dissuade bad actors trying to take over accounts, but to allow Google to hire the people necessary to do proper identity verification for account recovery, when there's no automated option available. It would provide a last resort for people who are legitimately in situations like that of the OP. The problem I see with that is that things aren't worth Google's time unless they have the potential to make (or save) billions of dollars. If this is a problem that only ever affects a handful of people, I don't see how they would ever have sufficient incentive to do something about it, even if they could charge for the service.
grammers 5y ago
Exactly, 2FA with yubico or similar is a must. I love that my Tutanota supports this. But also make sure to get the recovery sorted for yourself - just in case you lose your key or password. To me that's the biggest threat as so much important information is in there. It's good that no one can hack it (if you have 2FA), but even better if you've made sure you don't lose access either!

extheat 5y ago

I’m not sure money would be a great solution here. Malicious actors would be able to fork that over for important targets. IMO this is definitely something that should go through the legal system rather than any honor system. If people lie to the authorities in any respectable country, that’s a criminal offense and could mean jail time.

tempnow987 5y ago
The money pays google for the work needed to validate. Just showing up in person is a huge control. A ton of scams rely on no one ever showing up IN PERSON. Let google troll through google photos etc, run face match, ask you questions about what you did when, send someone to visit your living situation or work etc. Perfect? No, but maybe a better compromise.
- ghaff 5y ago
  Yep. Some financial services transactions switched to allowing electronic/telephonic transactions during the pandemic. My broker basically switched back to certain transactions requiring in-person confirmation in some way or another. It's a nuisance but it also shuts down a lot of avenues of fraudulent activity.
tempestn 5y ago
Impersonating someone to take over their account is already illegal in most 'respectable' countries, but generally the people doing this either can't be traced (at least not cost-effectively) and/or don't live in one of those countries. I think the point of the money here isn't to dissuade bad actors trying to take over accounts, but to allow Google to hire the people necessary to do proper identity verification for account recovery, when there's no automated option available. It would provide a last resort for people who are legitimately in situations like that of the OP. The problem I see with that is that things aren't worth Google's time unless they have the potential to make (or save) billions of dollars. If this is a problem that only ever affects a handful of people, I don't see how they would ever have sufficient incentive to do something about it, even if they could charge for the service.

grammers 5y ago

Exactly, 2FA with yubico or similar is a must. I love that my Tutanota supports this. But also make sure to get the recovery sorted for yourself - just in case you lose your key or password. To me that's the biggest threat as so much important information is in there. It's good that no one can hack it (if you have 2FA), but even better if you've made sure you don't lose access either!