5 ms·

If compromised accounts is the problem, then google could change the authorization on them, and require proof to get back into them. Of course that would requi

If compromised accounts is the problem, then google could change the authorization on them, and require proof to get back into them. Of course that would require some kind of functional consumer-oriented support line where a human working at google could receive identifying information, check that against Google's internal records and public databases (your old phone numbers, addresses, etc) and check against the contents of the account and the old logs in order to determine that the person was who they said they were. That would also solve the problem of so many people in the comments who have old google accounts that they've lost the 2FA/passwords to who are locked out of their accounts, they'd now have a process to go through in order to prove who they are and that they owned the account and get it back. But that would cost Google a lot more money than just even hanging onto the storage, so they're gonna nuke it and make it all go away. Big Tech really needs to be regulated more like a government agency.

kccqzy 3y ago
> Of course that would require some kind of functional consumer-oriented support line where a human working at google could receive identifying information, check that against Google's internal records and public databases (your old phone numbers, addresses, etc) and check against the contents of the account and the old logs in order to determine that the person was who they said they were. This is a highly unreliable, easily gamed non-solution to the problem. If people are determined enough to compromise your accounts, it's easy enough for them to find your old phone numbers, addresses, etc. Websites like https://www.fastpeoplesearch.com/ https://www.fastpeoplesearch.com/ exist, and it provides generally accurate information on people. Humans are always the weakest link. If you allow a random person to convince a Google employee that are the owner of the account, they are going to be tricked. People on HN are always very quick to come to the conclusion that Big Tech not doing something is because of cost, whereas the reality is that the thing HN commenter proposes but Big Tech is not doing is flawed in the first place.
- lamontcg 3y ago
  No, I'm suggesting that you need to prove who you are using a high level of authentication (ideally things like passports). That identification can then be used to associate you with addresses, e-mails, phone numbers, etc using sources like credit agencies and probably Google's own existing information, which can then be associated with the logs on the account. And this should be used for accounts with significant amounts of inactivity so it isn't a process that could be used for actively used accounts. I'm not suggesting that Google employees just trust someone who just says they lived somewhere and had some phone number.

kccqzy 3y ago

> Of course that would require some kind of functional consumer-oriented support line where a human working at google could receive identifying information, check that against Google's internal records and public databases (your old phone numbers, addresses, etc) and check against the contents of the account and the old logs in order to determine that the person was who they said they were. This is a highly unreliable, easily gamed non-solution to the problem. If people are determined enough to compromise your accounts, it's easy enough for them to find your old phone numbers, addresses, etc. Websites like https://www.fastpeoplesearch.com/ https://www.fastpeoplesearch.com/ exist, and it provides generally accurate information on people. Humans are always the weakest link. If you allow a random person to convince a Google employee that are the owner of the account, they are going to be tricked. People on HN are always very quick to come to the conclusion that Big Tech not doing something is because of cost, whereas the reality is that the thing HN commenter proposes but Big Tech is not doing is flawed in the first place.

lamontcg 3y ago
No, I'm suggesting that you need to prove who you are using a high level of authentication (ideally things like passports). That identification can then be used to associate you with addresses, e-mails, phone numbers, etc using sources like credit agencies and probably Google's own existing information, which can then be associated with the logs on the account. And this should be used for accounts with significant amounts of inactivity so it isn't a process that could be used for actively used accounts. I'm not suggesting that Google employees just trust someone who just says they lived somewhere and had some phone number.