7 ms·

This is a problem that is is very hard to solve on the global scale. Right now Google is not asking information that would allow them to really verify my ident

This is a problem that is is very hard to solve on the global scale. Right now Google is not asking information that would allow them to really verify my identity. Not sure if people would like Google to start demanding that kind of information, like personal identity code (for countries where it is available), passport numbers, home addresses etc. Without strong identity checks, the system is prone to fraud. Black hats can either social e engineer their way around the support agents or use leaked personal data to impersonate people to gain access to their accounts.

deleted 4y ago
[deleted]
jesterson 4y ago
And that's totally fine. People should not treat IT services as something reliable, it is extremely unreliable and prone to many issues thing. Once it will be understood, losing xx-years accounts wouldn't be a problem. I know this is controversial idea, but the more I see cases like that, the more I am sure about it
- paganel 4y ago
  > And that's totally fine. People should not treat IT services as something reliable, Problem is the "society" around us (for lack of a better word) treats IT services as something reliable, see how more and more countries go digital/electronic only when it comes to payments or relationship with the government.
  - jesterson 4y ago
    Exactly. that's why governments love IT and push it - they weaponise it against citizens.
- rexf 4y ago
  Websites & apps treat your e-mail or phone number as your identity. Is it ideal? No, but it's reality. Until everyone can agree on a better system, your e-mail is your online identity across countless websites. This makes losing your e-mail (with no customer support to regain access) a huge vulnerability in everyone's personal life.
  - jesterson 4y ago
    Then don't use it? If there would be more reluctance against ubiquitous (and pointless) IT services, perhaps the situation with overreliance wouldn't have happened.
- throwaway15908 4y ago
  I dont know why you get down voted because you are absolutely right. I would go even further and demand regulators to define standards to enable migration or self hosting.
  - jesterson 4y ago
    Unfortunately HN crowd is more and more resembling reddit communities, where emotional downvoting is a way to express themselves instead of maintaining well argumentative discussion. Doesn't surprise me anymore
rvba 4y ago
> Right now Google is not asking information that would allow them to really verify my identity. I have a google account made in 2004 (it is nearly 18 years old) and some time ago youtube started to ask me to verify my age by sending my ID or using a credit card. I think it was a "bug" on their side, since a google search showed a lot of other people complaining about this -> verify your age.. on a 15+ year old youtube account.
fauigerzigerk 4y ago
>Right now Google is not asking information that would allow them to really verify my identity. Why can't they offer identity verification as an option? It's not exactly difficult to do technically.
- supernova87a 4y ago
  Can you imagine how complicated this is, and controversial? How to do this exactly? Do you want Google to be proving who people are by fingerprints, irises? Google has never gotten into this business. There would be so many issues. And is collecting biometric info an absolute bulletproof way to verify identity? And doesn't have pitfalls compared to current system? Then how about just ID documents? Who would provide the locations to verify these documents? How many hundreds of types of documents would be suitable to prove identity? And thousands of locations would be necessary to serve everyone. Would they be honest / absolutely trustworthy? Do you know how many people out there are waiting to try impersonating people by forging documents, given the money at stake, and how many outlets (that you'd have to employ as verification agents) would be susceptible to corruption to defraud people who'd relied on these documents as proof of their identity (and keys to their online accounts)? If you register with an identity document, and that becomes your method of proof, what if someone located in another country asserts that they're you with some different form of a document that says your name on it? It's extremely complicated.
  - praxulus 4y ago
    Google is already in the payments business, which requires a significant amount of identity verification. They aren't at the level you're describing, but they're also not completely new to the business of verifying IDs, albeit via uploaded photographs rather than physical kiosks.
  - mistercheph 4y ago
    It doesn't matter how complicated it is, given how critical a google account can be in a person's life, Google has an obligation to make a good faith effort to resolve issues like these, and if that obligation is not expressed in their terms of service, then legislatures and regulators should compel them by force of law. The fact is that Google is already in the business of authenticating identities and actually does so in circumstances where the law compels them to, but they have deemed it too expensive to do so in the context of recovering accounts, where they remain uncompelled. As it stands, the GDPR compels Google to make a meaningful attempt to authenticate whether you are the legitimate account holder when you submit an SAR or Data Deletion Request. But, Google, under no circumstances will attempt to identify you if you fail or are deemed ineligible for their automated account recovery process, unless you are eligible for their "In cases of nepotism or media pressure" emergency account recovery procedure.
highwaylights 4y ago
The identity checks also introduce their own vulnerabilities, in the form of social engineering where there wasn't an escalation route before. Solutions like yubikeys and passkeys theoretically solve this problem, but open other problems: not least what if you lose the key or the device that the passkey is stored on? Then you're no longer you as far as the authenticating party (Google in this case) is concerned. What's more, whoever stole your phone is you as far as they care, because that's all they have to say who is who. Your devices should require further authentication (password/biometrics) but is that a guarantee? Could Google or anyone else really guarantee that any client device connecting to their service is unhackable, bearing in mind that many of their users may be on cheaply made and fully out-of-support Android devices or Windows XP? It's a really hard problem to solve.
account42 4y ago
Since this should only be a last resort you could limit any recovery to accounts that have no recent logged in activity to reduce risk. Google at least have your past IP addresses which should allow law enforcment to identify you (at least narrow the question down to a handful of people who could all be asked if they have a claim to the account unless you only ever accessed it from public networks). Doing all that detective work is not going to be cheap but right now you don't even have the option to pay for it if your online account is worth a lot to you.

deleted 4y ago

[deleted]

jesterson 4y ago

And that's totally fine. People should not treat IT services as something reliable, it is extremely unreliable and prone to many issues thing. Once it will be understood, losing xx-years accounts wouldn't be a problem. I know this is controversial idea, but the more I see cases like that, the more I am sure about it

paganel 4y ago
> And that's totally fine. People should not treat IT services as something reliable, Problem is the "society" around us (for lack of a better word) treats IT services as something reliable, see how more and more countries go digital/electronic only when it comes to payments or relationship with the government.
- jesterson 4y ago
  Exactly. that's why governments love IT and push it - they weaponise it against citizens.
rexf 4y ago
Websites & apps treat your e-mail or phone number as your identity. Is it ideal? No, but it's reality. Until everyone can agree on a better system, your e-mail is your online identity across countless websites. This makes losing your e-mail (with no customer support to regain access) a huge vulnerability in everyone's personal life.
- jesterson 4y ago
  Then don't use it? If there would be more reluctance against ubiquitous (and pointless) IT services, perhaps the situation with overreliance wouldn't have happened.
throwaway15908 4y ago
I dont know why you get down voted because you are absolutely right. I would go even further and demand regulators to define standards to enable migration or self hosting.
- jesterson 4y ago
  Unfortunately HN crowd is more and more resembling reddit communities, where emotional downvoting is a way to express themselves instead of maintaining well argumentative discussion. Doesn't surprise me anymore

rvba 4y ago

> Right now Google is not asking information that would allow them to really verify my identity. I have a google account made in 2004 (it is nearly 18 years old) and some time ago youtube started to ask me to verify my age by sending my ID or using a credit card. I think it was a "bug" on their side, since a google search showed a lot of other people complaining about this -> verify your age.. on a 15+ year old youtube account.

fauigerzigerk 4y ago

>Right now Google is not asking information that would allow them to really verify my identity. Why can't they offer identity verification as an option? It's not exactly difficult to do technically.

supernova87a 4y ago
Can you imagine how complicated this is, and controversial? How to do this exactly? Do you want Google to be proving who people are by fingerprints, irises? Google has never gotten into this business. There would be so many issues. And is collecting biometric info an absolute bulletproof way to verify identity? And doesn't have pitfalls compared to current system? Then how about just ID documents? Who would provide the locations to verify these documents? How many hundreds of types of documents would be suitable to prove identity? And thousands of locations would be necessary to serve everyone. Would they be honest / absolutely trustworthy? Do you know how many people out there are waiting to try impersonating people by forging documents, given the money at stake, and how many outlets (that you'd have to employ as verification agents) would be susceptible to corruption to defraud people who'd relied on these documents as proof of their identity (and keys to their online accounts)? If you register with an identity document, and that becomes your method of proof, what if someone located in another country asserts that they're you with some different form of a document that says your name on it? It's extremely complicated.
- praxulus 4y ago
  Google is already in the payments business, which requires a significant amount of identity verification. They aren't at the level you're describing, but they're also not completely new to the business of verifying IDs, albeit via uploaded photographs rather than physical kiosks.
- mistercheph 4y ago
  It doesn't matter how complicated it is, given how critical a google account can be in a person's life, Google has an obligation to make a good faith effort to resolve issues like these, and if that obligation is not expressed in their terms of service, then legislatures and regulators should compel them by force of law. The fact is that Google is already in the business of authenticating identities and actually does so in circumstances where the law compels them to, but they have deemed it too expensive to do so in the context of recovering accounts, where they remain uncompelled. As it stands, the GDPR compels Google to make a meaningful attempt to authenticate whether you are the legitimate account holder when you submit an SAR or Data Deletion Request. But, Google, under no circumstances will attempt to identify you if you fail or are deemed ineligible for their automated account recovery process, unless you are eligible for their "In cases of nepotism or media pressure" emergency account recovery procedure.

highwaylights 4y ago

The identity checks also introduce their own vulnerabilities, in the form of social engineering where there wasn't an escalation route before. Solutions like yubikeys and passkeys theoretically solve this problem, but open other problems: not least what if you lose the key or the device that the passkey is stored on? Then you're no longer you as far as the authenticating party (Google in this case) is concerned. What's more, whoever stole your phone is you as far as they care, because that's all they have to say who is who. Your devices should require further authentication (password/biometrics) but is that a guarantee? Could Google or anyone else really guarantee that any client device connecting to their service is unhackable, bearing in mind that many of their users may be on cheaply made and fully out-of-support Android devices or Windows XP? It's a really hard problem to solve.

account42 4y ago

Since this should only be a last resort you could limit any recovery to accounts that have no recent logged in activity to reduce risk. Google at least have your past IP addresses which should allow law enforcment to identify you (at least narrow the question down to a handful of people who could all be asked if they have a claim to the account unless you only ever accessed it from public networks). Doing all that detective work is not going to be cheap but right now you don't even have the option to pay for it if your online account is worth a lot to you.