5 ms·

I completely disagree. There have been complaints after complaints about people being locked out of accounts, and there are no easy ways to recover - often no

I completely disagree. There have been complaints after complaints about people being locked out of accounts, and there are no easy ways to recover - often no way at all. To say that the paid support you're paying for can't help you access the service you're paying for, that's a bit rich. > Restoring your access to a locked account is simply less important than ensuring strangers can't "restore" access to your account. That's a false dichotomy. If you can pay, say, $200, and get 30 minutes with a tech who has access to your email and can go through a manual, interactive process to verify you are who you say you are - for example, if you can prove you hold the credit card that's been used to pay for Google One for the past couple of years - well, these "strangers" are going to have to work REALLY hard to "restore" their access to your account. Probably well more than $200 and more than it costs to install a keylogger and sniff your password anyway.

tptacek 5y ago
It doesn't so much matter if you like the current state of affairs; it is what it is. If paid Google support could easily reset accounts (or, really, reset accounts at all), the accounts of paid support subscribers would regularly get taken over. Try to design an account recovery program for a service with, say, more than 10,000 clients to see why. Think through what you'd hope Google would be able to do here. How do they authorize the request to unlock the account? Now imagine a well-funded adversary that knows exactly how Google's processes work (probably because they continuously pay for accounts and have them reset, to track what Google's doing). What's the reliable signal Google can use here, one the majority of their users actually have access to, that they can quickly execute on? There are companies that have relatively quick Account Recovery processes through customer support. But those companies either aren't worth defrauding, or are regularly but quietly defrauded.
- jfim 5y ago
  At least for accounts that have services that have a billing address, they could send a postcard with a special code to unlock the account. In the case of the OP, that would have solved the problem.
  - ghaff 5y ago
    Historically, that's how things like PINs were often reset. Of course, the more frictions and tie-ins to physical things you throw in, the more people will have legitimate sob stories about how they don't have that phone number any longer or they just moved and so forth. There's always going to be tradeoffs.
  - tptacek 5y ago
    To what address would Google send such a postcard? What do you do about the problem of estranged spouses and the like triggering recovery to break into their partners or ex-partners account? It's a mess. All the options are. Remember, this is the most valuable account most people possess.
    - vageli 5y ago
      > What do you do about the problem of estranged spouses and the like triggering recovery to break into their partners or ex-partners account? It's a mess. All the options are. Nothing? Google sends postcards to verify business addresses already. If it's good enough for the bank to send me a card and PIN via post it should be good enough for Google. We have laws in place to deal with estranged spouses breaking into accounts.
      - tptacek 5y ago
        What happens when you don't already have a verified address? None of this is easy.
        underdeserver 5y ago
        Everything you say is true but I think the weights on your arguments are off. A well funded adversary WILL take over your Google account. They'll do it by installing a keylogger and stealing your cookies, they'll do it because they know what signals the account recovery process is looking for - much better than you do, they'll do it because hacking you is far easier than hacking Google. (Two-factor authentication done properly, with printed backup codes in a safe location, can prevent hijacking most of the time.) Second, Google accounts constantly do get hijacked every day. This draconian status quo might have been justified if it would prevent all hijackings, but it doesn't. Third, my Google account is not my most important account. My bank account and portfolio which hold my life savings are arguably more important. But somehow I'm not worried at all about losing access to them. Again, no system is perfect and it's mathematically impossible to identify the correct person for every account. But I still believe you can get the same false positive and false negative ratios without getting blog post after blog post from people who are completely stuck.

tptacek 5y ago

It doesn't so much matter if you like the current state of affairs; it is what it is. If paid Google support could easily reset accounts (or, really, reset accounts at all), the accounts of paid support subscribers would regularly get taken over. Try to design an account recovery program for a service with, say, more than 10,000 clients to see why. Think through what you'd hope Google would be able to do here. How do they authorize the request to unlock the account? Now imagine a well-funded adversary that knows exactly how Google's processes work (probably because they continuously pay for accounts and have them reset, to track what Google's doing). What's the reliable signal Google can use here, one the majority of their users actually have access to, that they can quickly execute on? There are companies that have relatively quick Account Recovery processes through customer support. But those companies either aren't worth defrauding, or are regularly but quietly defrauded.

jfim 5y ago
At least for accounts that have services that have a billing address, they could send a postcard with a special code to unlock the account. In the case of the OP, that would have solved the problem.
- ghaff 5y ago
  Historically, that's how things like PINs were often reset. Of course, the more frictions and tie-ins to physical things you throw in, the more people will have legitimate sob stories about how they don't have that phone number any longer or they just moved and so forth. There's always going to be tradeoffs.
- tptacek 5y ago
  To what address would Google send such a postcard? What do you do about the problem of estranged spouses and the like triggering recovery to break into their partners or ex-partners account? It's a mess. All the options are. Remember, this is the most valuable account most people possess.
  - vageli 5y ago
    > What do you do about the problem of estranged spouses and the like triggering recovery to break into their partners or ex-partners account? It's a mess. All the options are. Nothing? Google sends postcards to verify business addresses already. If it's good enough for the bank to send me a card and PIN via post it should be good enough for Google. We have laws in place to deal with estranged spouses breaking into accounts.
    - tptacek 5y ago
      What happens when you don't already have a verified address? None of this is easy.
      - underdeserver 5y ago
        Everything you say is true but I think the weights on your arguments are off. A well funded adversary WILL take over your Google account. They'll do it by installing a keylogger and stealing your cookies, they'll do it because they know what signals the account recovery process is looking for - much better than you do, they'll do it because hacking you is far easier than hacking Google. (Two-factor authentication done properly, with printed backup codes in a safe location, can prevent hijacking most of the time.) Second, Google accounts constantly do get hijacked every day. This draconian status quo might have been justified if it would prevent all hijackings, but it doesn't. Third, my Google account is not my most important account. My bank account and portfolio which hold my life savings are arguably more important. But somehow I'm not worried at all about losing access to them. Again, no system is perfect and it's mathematically impossible to identify the correct person for every account. But I still believe you can get the same false positive and false negative ratios without getting blog post after blog post from people who are completely stuck.