5 ms·
Everything you say is true but I think the weights on your arguments are off. A well funded adversary WILL take over your Google account. They'll do it by inst
by underdeserver 5y ago
Everything you say is true but I think the weights on your arguments are off.
A well funded adversary WILL take over your Google account. They'll do it by installing a keylogger and stealing your cookies, they'll do it because they know what signals the account recovery process is looking for - much better than you do, they'll do it because hacking you is far easier than hacking Google. (Two-factor authentication done properly, with printed backup codes in a safe location, can prevent hijacking most of the time.)
Second, Google accounts constantly do get hijacked every day. This draconian status quo might have been justified if it would prevent all hijackings, but it doesn't.
Third, my Google account is not my most important account. My bank account and portfolio which hold my life savings are arguably more important. But somehow I'm not worried at all about losing access to them.
Again, no system is perfect and it's mathematically impossible to identify the correct person for every account. But I still believe you can get the same false positive and false negative ratios without getting blog post after blog post from people who are completely stuck.
- tptacek 5y agoI'm not going to debate any of this stuff, because it's not the point I came here to make. My point is that the problem this person is having is with Account Recovery, The Hardest Problem in Authentication, not with poor customer support. You're welcome to argue that Google should take Account Recovery, The Hardest Problem in Authentication less seriously. All signs point to them taking it more and more seriously, but that doesn't mean you can't campaign.
- underdeserver 5y agoWhat signs are you seeing? My point is different. Recovery is the hardest problem in authentication, but when you're as big and as significant as Google is, you owe it to your users, paying or not, to get it right, however hard it is.
- tptacek 5y agoIf you've got a straightforward solution, implement it and make several billion dollars. I'm not being glib.
- underdeserver 5y agoNah, I'm talking about edge cases Beyond the 99% of cases which I assume they get right, recovery is a cost center. There's a single potential client (maybe two if you add Facebook) who seems to be showing no interest in getting it right. Not the best business proposition.
- tptacek 5y agoCouldn't be wronger. This is a huge problem for everyone.
- underdeserver 4y agoIn the sense of the general account recovery problem, yes. I'm pretty sure it's mathematically provable to be impossible. But the account recovery problem facing Netflix or Github is different from the one facing smaller companies which is different from the one facing Google. I honestly doubt there is a one-size-fits-all solution, I definitely don't have it, but I'd be happy to be surprised.