4 ms·

Customer support that has access to google accounts, that can give everyone telling a sob story to some customer service rep access to your account?

dereg 4y ago
It certainly beats having to send an email to a faceless "support" address that ends up sending me the same 4 boilerplate questions when I try to figure out why my business locations' rule-compliant map listings were suspended from My Business even when I spend $15k per month on Google ads, sure. It hurts my business (there hasn't been a resolution since when the issue arose four years ago), but it's not nearly the hurt that the folks the librarian is helping are feeling. Maybe, just maybe, if people are sobbing, maybe there's a good reason why! And maybe, just maybe, if you don't want to receive such support, you can advocate for a system in which you could opt out of all such processes entirely, instead of arguing that any form of account remediation shouldn't exist.
nick__m 4y ago
Your concern while valid seems solvable. They could preauthorize a random token amount on credit card with matching details, have you call the number on the back of your card to figure out that amount and then you have to input that number to authorize the access in an oath like flow. Please tell me if you see something wrong with my procedure? edit: I saw something wrong, I have forgotten about the vast unbanked population in the rest of the world as we don't have that problem in Canada¹ 1) https://www.gfmag.com/global-data/economic-data/worlds-most-unbanked-countries https://www.gfmag.com/global-data/economic-data/worlds-most-...
- lolinder 4y ago
  The disadvantaged people who the librarian talks about (selling their phone to make ends meet) may not have a credit card to charge.
- wjko21 4y ago
  As with every other "simple solution" to a complex problem there are a few flaws: a) google will have to require a credit card in order to open an email b) person opening an email account must actually have a line of credit, e.g.: many of the people mentioned in the OP will not have it c) opens a new attack vector on google accounts, e.g.: people who secured their emails using 2FA app for example can now be attacked via a credit card process
  - thayne 4y ago
    a and c can be solved by making it an option for 2fa instead of requiring it.
    - wjko21 4y ago
      but you already know what will happen next, don't you? People would stop using 2FA, then some donkey on government contract with access to nuclear weapons gets hacked, and everybody would lose their mind: "how could google be so stupid to allow people not use 2FA?!?!?!"
      - thayne 4y ago
        I'd be asking why was someone using gmail for anything related to nuclear weapons.
        wjko21 4y ago
        I don't know if you are being sarcastic or naive here... Why would Hillary use her own email server for critical government correspondence? I don't know! Reasons I guess. People on all levels tend do stupid stuff every once in a while
lolinder 4y ago
This comment does raise a serious concern. The primary reason why cell phone numbers are bad for 2FA is sim swapping, which can only occur because there is a customer support rep who can fall for it. Email is largely immune to that right now because customer support generally cannot let you into an account you locked yourself out of. This isn't to say that this is an unsolvable problem, it's not, but it's definitely worth talking about.
- saalweachter 4y ago
  I'd like to see the Post Office (in the US) get involved. Post offices are geographically ubiquitous, already deal with identity verification, and already have to maintain the trustworthiness of their workforce. I'd like to see a system where (a) an account [whether GMail, Facebook, Schwab or Bob's Online Pet Food Mart] can be tied to a real-world identity and (b) when you lose access, you can go to the local post office to verify your identity and get a one-time recovery token for a given account.
  - bee_rider 4y ago
    Google already has the ability to generate one time use recovery codes, at least for gmail accounts -- not sure if it is generally integrated into their Authenticator app. You could generate some recovery codes and put them in a safe deposit box or something I guess. This sort of solution (and your post office idea) can be, but they don't satisfy the last resort customer service role, for people who haven't set these kinds of recovery options up.
    - stevenjgarner 4y ago
      This IS the reply Shelley Rosen needs to see, understand and impart to her patrons. It does not cost anything, it is secure and it works. I feel 2FA is a class libraries should be teaching. I am off to my local library to volunteer as a resource for that specific purpose. Anybody going to join me at their local library? I was going to make the recovery code comment myself, but instead I did a search to see if anyone else had done so. Kudos. If would vote this comment to the top of the discussion if I only could. IMO it should be (part of) a PSA.

dereg 4y ago

It certainly beats having to send an email to a faceless "support" address that ends up sending me the same 4 boilerplate questions when I try to figure out why my business locations' rule-compliant map listings were suspended from My Business even when I spend $15k per month on Google ads, sure. It hurts my business (there hasn't been a resolution since when the issue arose four years ago), but it's not nearly the hurt that the folks the librarian is helping are feeling. Maybe, just maybe, if people are sobbing, maybe there's a good reason why! And maybe, just maybe, if you don't want to receive such support, you can advocate for a system in which you could opt out of all such processes entirely, instead of arguing that any form of account remediation shouldn't exist.

nick__m 4y ago

Your concern while valid seems solvable. They could preauthorize a random token amount on credit card with matching details, have you call the number on the back of your card to figure out that amount and then you have to input that number to authorize the access in an oath like flow. Please tell me if you see something wrong with my procedure? edit: I saw something wrong, I have forgotten about the vast unbanked population in the rest of the world as we don't have that problem in Canada¹ 1) https://www.gfmag.com/global-data/economic-data/worlds-most-unbanked-countries https://www.gfmag.com/global-data/economic-data/worlds-most-...

lolinder 4y ago
The disadvantaged people who the librarian talks about (selling their phone to make ends meet) may not have a credit card to charge.
wjko21 4y ago
As with every other "simple solution" to a complex problem there are a few flaws: a) google will have to require a credit card in order to open an email b) person opening an email account must actually have a line of credit, e.g.: many of the people mentioned in the OP will not have it c) opens a new attack vector on google accounts, e.g.: people who secured their emails using 2FA app for example can now be attacked via a credit card process
- thayne 4y ago
  a and c can be solved by making it an option for 2fa instead of requiring it.
  - wjko21 4y ago
    but you already know what will happen next, don't you? People would stop using 2FA, then some donkey on government contract with access to nuclear weapons gets hacked, and everybody would lose their mind: "how could google be so stupid to allow people not use 2FA?!?!?!"
    - thayne 4y ago
      I'd be asking why was someone using gmail for anything related to nuclear weapons.
      - wjko21 4y ago
        I don't know if you are being sarcastic or naive here... Why would Hillary use her own email server for critical government correspondence? I don't know! Reasons I guess. People on all levels tend do stupid stuff every once in a while

lolinder 4y ago

This comment does raise a serious concern. The primary reason why cell phone numbers are bad for 2FA is sim swapping, which can only occur because there is a customer support rep who can fall for it. Email is largely immune to that right now because customer support generally cannot let you into an account you locked yourself out of. This isn't to say that this is an unsolvable problem, it's not, but it's definitely worth talking about.

saalweachter 4y ago
I'd like to see the Post Office (in the US) get involved. Post offices are geographically ubiquitous, already deal with identity verification, and already have to maintain the trustworthiness of their workforce. I'd like to see a system where (a) an account [whether GMail, Facebook, Schwab or Bob's Online Pet Food Mart] can be tied to a real-world identity and (b) when you lose access, you can go to the local post office to verify your identity and get a one-time recovery token for a given account.
- bee_rider 4y ago
  Google already has the ability to generate one time use recovery codes, at least for gmail accounts -- not sure if it is generally integrated into their Authenticator app. You could generate some recovery codes and put them in a safe deposit box or something I guess. This sort of solution (and your post office idea) can be, but they don't satisfy the last resort customer service role, for people who haven't set these kinds of recovery options up.
  - stevenjgarner 4y ago
    This IS the reply Shelley Rosen needs to see, understand and impart to her patrons. It does not cost anything, it is secure and it works. I feel 2FA is a class libraries should be teaching. I am off to my local library to volunteer as a resource for that specific purpose. Anybody going to join me at their local library? I was going to make the recovery code comment myself, but instead I did a search to see if anyone else had done so. Kudos. If would vote this comment to the top of the discussion if I only could. IMO it should be (part of) a PSA.