7 ms·

I believe it is time for regulatory support. I know it is fashionable to mock the EU regulatory efforts in the US, but the EU has a tendency to step in once som

• llanowarelves 4y ago
  It and food regulation are some of the things they have way better.
• creato 4y ago
  Phone companies are regulated, and the solution to this problem is basically for google to allow itself to become vulnerable to social engineering, just like phone companies are.
  • Semaphor 4y ago
    I don't know what the situation in Germany is, but as I only ever hear about those issues from the US, I assume its something ridiculously bureaucratic, which might actually be a plus in this case?
    • MattGaiser 4y ago
      https://www.enisa.europa.eu/news/enisa-news/beware-of-the-sim-swapping-fraud https://www.enisa.europa.eu/news/enisa-news/beware-of-the-si... Here is an EU article warning about it.
      • Semaphor 4y ago
        According to the linked [0] report, of the two providers in Germany that were asked, one had 1-10 incidents, and one 11-30. In a year. So I guess those issues exist, it’s just a minority issue. The related German Wikipedia page [1] and almost all articles I can find also mainly talk about the USA. It seems you can usually add another required password for phone changes, but mainly it’s just not an issue. No ridiculously bureaucratic requirements, though. [0]: https://www.enisa.europa.eu/publications/countering-sim-swapping https://www.enisa.europa.eu/publications/countering-sim-swap... [1]: https://de.wikipedia.org/wiki/SIM-Swapping https://de.wikipedia.org/wiki/SIM-Swapping
    • carlmr 4y ago
      So in Germany, you need to prove your identity to buy a SIM card. You can't really buy an anonymous phone, because every SIM card is tied to someone's identity. This probably doesn't prevent SIM swapping entirely, but you will need to also steal the other SIM card you're swapping the number to.
      • Semaphor 4y ago
        Ah, I guess I forgot about that. Yeah, you either need to intercept the new SIM sent to the original customer, or defeat the identification procedure. That adds quite the hurdle compared to countries that have no such requirements.
      • account42 4y ago
        At least for now you can still easily anonymously buy (activated) sims from other european countries.
        • carlmr 4y ago
          But I think you can't use those for taking over a number in a SIM swap.
  • CamperBob2 4y ago
    No, just require them to answer their phone. Charge a fee if necessary.
  • rini17 4y ago
    Whereas currently your google account can be taken over without any social engineering at all.
• YeBanKo 4y ago
  Does EU have any regulation to prevent it? I hoped that the latest Digital Markets Act would have any provision against it, but afaik it didn’t.
  • weberer 4y ago
    No, people in the EU also have the same thing happen with Google.
    • carlmr 4y ago
      This is not clear. Even if it is regulated, the question is if anybody ever successfully sued to get this right, and then the question is what is the fine that would be given. Is it large enough to make the company change its ways in the future?
  • iicc 4y ago
    GDPR Article 16 gives you the right to have inaccurate personal information amended, taking in to account the purpose of the information. A phone number used for this purpose would definitely identify a person, and so qualify as personal information.
    • ghaff 4y ago
      Presumably you need to prove who you are to make changes to your record however. GDPR doesn’t give me the right or require a company to change a phone number if I call them up and tell them to change the number for some random name without proof of identity.
  • PointlessLogin 4y ago
    > Does EU have any regulation to prevent it? Yes Article 22 of the GDPR. Essentially it sates that if automated decision making occurs, you must be able to appeal to a human. https://www.gdpr-toolkit.co.uk/individuals-rights/the-rights-related-to-automated-decision-making-and-profiling/ https://www.gdpr-toolkit.co.uk/individuals-rights/the-rights... This is aside from common law, which might give some protection in that entities managing your goods (and maybe your data?), even voluntarily, have a have a duty of care to keep them safe.
• safety1st 4y ago
  I have a bunch of business documents owned by a Gmail account. I was concerned that one of these random lockouts could happen to me and basically shut down my business, so I set up a Google Workspace account. ...Only to find that you can't transfer ownership of a Google Doc from a Gmail account to a Workspace account because "security." So at this point we have docs scattered across all kinds of Google accounts and domains which is the least secure thing I could imagine, great job Google. 100% in support of regulating the pants off of this company as well as evaluating alternatives to them.
  • unilynx 4y ago
    I agree we need more regulation.. But are you sure about this problem? If you create Shared drives in a Google workspace, they take ownership of anything I move into it (after dismissing a warninge explaining what will happen), even if I take files in folders shared to me from someone else's gmail account (The ownership model of drive was indeed terrible before they implemented the shared/team drives.)
    • safety1st 4y ago
      Very interesting! Looks like we would need to upgrade our Workspace plan (and basically double our cost) to use this feature, which is not great, but it might be a solution.
  • buro9 4y ago
    We're only talking a few docs by a single account... it is possible, semi-manually: https://medium.com/@buro9/one-account-all-of-google-4d2929066951#5778 https://medium.com/@buro9/one-account-all-of-google-4d292906... The Drive section of that. But in essence: Share the files, make a copy once shared, delete the shared file and only the copy exists. Better though: Don't use Google Drive for business critical docs if you're not a very high spend Google customer able to talk with an account manager. If you're a small/hobby user or individual, keep critical docs offline as well as online. Just consider it part of your business continuity plan.
    • 4y ago
• jpalomaki 4y ago
  This is a problem that is is very hard to solve on the global scale. Right now Google is not asking information that would allow them to really verify my identity. Not sure if people would like Google to start demanding that kind of information, like personal identity code (for countries where it is available), passport numbers, home addresses etc. Without strong identity checks, the system is prone to fraud. Black hats can either social e engineer their way around the support agents or use leaked personal data to impersonate people to gain access to their accounts.
  • deleted 4y ago
    [deleted]
  • jesterson 4y ago
    And that's totally fine. People should not treat IT services as something reliable, it is extremely unreliable and prone to many issues thing. Once it will be understood, losing xx-years accounts wouldn't be a problem. I know this is controversial idea, but the more I see cases like that, the more I am sure about it
    • paganel 4y ago
      > And that's totally fine. People should not treat IT services as something reliable, Problem is the "society" around us (for lack of a better word) treats IT services as something reliable, see how more and more countries go digital/electronic only when it comes to payments or relationship with the government.
      • jesterson 4y ago
        Exactly. that's why governments love IT and push it - they weaponise it against citizens.
    • rexf 4y ago
      Websites & apps treat your e-mail or phone number as your identity. Is it ideal? No, but it's reality. Until everyone can agree on a better system, your e-mail is your online identity across countless websites. This makes losing your e-mail (with no customer support to regain access) a huge vulnerability in everyone's personal life.
• fauigerzigerk 4y ago
  Yes the EU does do that sometimes, but roaming charges aren't exactly a great example. What happened there is that relatively wealthy people who travel a lot got themselves a rebate that average earners are now having to pay for through their phone bills. If roaming charges were high because there wasn't enough competition in the market then that's what the EU should have tackled. Otherwise high prices will just move on to other items on our phone bills and the whole thing becomes a game of whack-a-mole that the best connected special interest groups will always win. Governments should regulate to make sure that markets actually work and that everybody has basic rights such as getting access to their own data after proving who they are.
  • brnt 4y ago
    _Every_ European travels internationally. Have you seen our borders? If we drive 500km in any direction we probably crossed at least 3 borders. Really, the people that don't are rare.
    • fauigerzigerk 4y ago
      Some people travel _far_ more than others and you can be pretty sure that the distribution mirrors the wealth distribution. I have seen our borders. I am European myself, with roots in more than one country.
      • shaky-carrousel 4y ago
        Ah, no, not really. My family is not exactly wealthy, and they traveled frequently to France by car. And with Ryanair is incredibly cheap to travel nowadays.
        • hk__2 4y ago
          Yep. I’m always amazed when I hear Italian students with no money saying they went to Paris or London for less than €10 with Ryanair. For those who don’t like planes, there are low-cost bus companies over the whole continent. Trains are more expensive, but a Paris-Milan is still only €40 if you book in advance. The Instagram/TikTok feeds of 20-25 y/o are full of these lists of European cities you can visit in a weekend with a low budget. See also: Erasmus.
• weberer 4y ago
  Alright, sure, I agree with you. What now?
• Roark66 4y ago
  It seems that in EU customer protection revolves around making sure one doesn't get scammed out of their money, warranties are honored in time, things delivered actually match what was described at time of purchase etc. All of this falls apart if the goods/service is free... And one can't really argue Google is a monopoly with regards to email services (search and ads are quite separate). So I doubt EU could do anything about it unless one uses paid services.
  • michaelt 4y ago
    Presumably jwr means regulation more broadly than just consumer protection. For example GDPR, right to be forgotten, cookie warnings etc show the EU is more than happy to pass regulations that impact ad-supported services. The current regulations may be ineffective or poorly enforced - but it shows they're able and willing to pass laws.
  • PointlessLogin 4y ago
    > I doubt EU could do anything about it unless one uses paid services Just because a service is free does not mean consumer protection and data protection laws (including GDPR) no longer apply. Why would you think otherwise?
    • anotherhue 4y ago
      Without ‘consideration’ ( payment) one can usually argue that no contract exists for the laws to be inserted into. Closing that loop hole was valuable.
      • kdomanski 4y ago
        One can argue that under US legal system only.
  • kergonath 4y ago
    > All of this falls apart if the goods/service is free... That was very true, but I think this is changing. Recent dealings with Facebook and the privacy regulations give some hope there. > And one can't really argue Google is a monopoly with regards to email services EU regulations do not care about monopolies. The main issue is abuse of dominant position, which Google definitely has. The mobile carriers is an appropriate comparison, I think. None of them has anything like a dominant position across the continent, but their collective behaviour was suboptimal and costly for the customers, which was a strong enough motivation for the EC to intervene. I can see a blanket regulation about the processes that need to be put in place to close or recover accounts. In the same way that these companies are required to have dedicated people for GDPR requests. Also note that EU regulations are much less concerned about random customers than American laws. The EU framework is all about competition and how to preserve it, under the arguable belief that quantitatively increasing competition will benefit the final customers.
• maxehmookau 4y ago
  > Ridiculously high roaming charges, for example, have been eliminated through regulation. It should also be noted that as soon as that regulation no longer applied (Brexit), high roaming charges were immediately brought back in to effect. EU-style regulation works.
  • anotherhue 4y ago
    Also note it applied to roaming within the EU. You’re still in their clutches if you go further afield. Rationale was that treating people from one EU country differently than from another was against the union. Imagine paying inter-state roaming in the US.
    • maxehmookau 4y ago
      The new UK system makes no sense. My current mobile provider (O2) will offer me unlimited data usage in the USA but will charge several pounds a day extra to use my phone in France. Companies will charge what they're allowed until either the market forces them to behave, or failing that, the government.
      • MichaelZuo 4y ago
        O2 doesn't control the networks in France? You sure it's not the French telecom(s) setting the rates?
• ho_schi 4y ago
  I'm with you. But why only when dominant? A human interaction possibility shall be part of any crucial service. Companies shall spend money for this and pay well trained personal. I know it is often vice versa and especially what mega corps try to avoid and therefore it must be enforced? Amazon is doing that rather good. With Google I had a hard time when an order failed, they weren't able to tell me why and re-rooted my calls to the wrong country because of my phone number...
• hrbf 4y ago
  While I’m generally all for consumer protections, you cannot secure against cases like this. The person affected was obviously ignoring repeated prompts for a current phone number, on a free account nonetheless. The only reliable alternative I see is requiring a government photo ID containing a permanent physical address on account creation. I wouldn’t want that, would you? And even then, some would manage to create impossible situations. It sucks, really hard. No other way to paint it. I’m not arguing for Google here. Still, the user has responsibilities too. If you ignore an oil warning light on your car for too long, eventually the engine breaks.
  • nosianu 4y ago
    > If you ignore an oil warning light on your car for too long, eventually the engine breaks. The comparison falls flat though when you consider that you can pay money and get the car fixed and still have the car in the end. The complaint is not "fix my self-inflicted problems for free for me", it is that there is no way to get anything fixed even if one is willing to pay and acknowledge it's one's own fault.
    • hrbf 4y ago
      It is not meant as a strict comparison and I believe you know that. IIRC, HN asks to take the strongest points of an argument, not the weakest.
      • highwaylights 4y ago
        To be fair, the parent is focusing on the crux of the problem though. If this has happened (and I can think of a few other ways for this to all go wrong that involve less carelessness on the part of the account holder) it’s quite substantially more serious than having to pay to fix a car. There are very real consequences to not having access to an e-mail account that reach far beyond the hassle of creating a new one. They reach far beyond even losing your current emails. Google (and others) slick account creation funnels belie the seriousness of what you’re doing and the devastating consequences if anything goes wrong. Regulation is needed urgently, but will only happen when enough famous-but-not-famous-enough-to-get-special-treatment people complain.
• jwr 4y ago
  Adding to my own comment: one thing I forgot about is Google Maps, which reached "basic utility" status in some countries. If your address is wrong on Google Maps, you will have problems, because people will be unable to find your place. Google provides a way to "submit corrections", but there is no accountability, and these corrections might or might not get applied. In my case, they are sometimes applied: some phones will show the right location, and some will show the wrong one. Again, no accountability.
  • anotherhue 4y ago
    We experience this also, every delivery needs manual correction because they rely on Google and Google is just plain wrong.
• threatofrain 4y ago
  We have a situation where someone turned on an option for enhanced security, combined with the fact that Google doesn’t ask for further solid information like biometrics or social security number. This person wasn’t locked out by magic algorithm. What solution could Google offer without creating a security backdoor? Google might not ever be sure as to the identity of the account holder.