4 ms·

The thing that baffles me the most is that literally no one at Google has thought of this. They should be having meetings where they come up with scenarios like

by gnu8 3y ago

The thing that baffles me the most is that literally no one at Google has thought of this. They should be having meetings where they come up with scenarios like this and plan out realistic ways of dealing with them. Google isn't responsible enough to run an email service, it's a toy business where techbros fuck around all day.

lazide 3y ago
They have and do. The issue is fraud and account compromises are so common (due to password reuse being the norm and every other site under the sun getting compromised), that they’re in a catch-22. Support can be Social Engineered easily (especially if you don’t spend massive amounts of money on it). Making support not socially engineer-able is essentially impossible too with their user base, as the user base is too diverse. Technical solutions currently suck, even if we ignore that most of the population is unable to effectively use them. There is no consistent way across their user base to even verify a person exists, let alone that they are who they say they are, let alone that they are who created or owns the account! And no one even puts the closest local equivalent into their Google account for legitimate reasons anyway. Like who would want to upload their Birth certificate? Or passport? Or DL/ID? That’s a terrible idea. And many people don’t have the US equivalent to one anyway. Not to mention, deep fakes have gotten really good. Not that a US company is going to have much luck identifying a fake (or real!) Belgian equivalent for instance anyway. So they go with heuristics, which always have edge cases, try to hide what rules they use to avoid being gamed at scale, and hope for the best. Not great. But seriously, what else are they going to do?
- gnu8 3y ago
  Thank you for the thoughtful reply. I will admit I was fulminating a bit. I'm just extremely frustrated that their solution to edge cases is to drop them on the floor and there's nothing to be done. No individual Google user actually matters to the company, but many people actually need their email account. The asymmetry of power and money here just isn't sustainable.
  - lazide 3y ago
    I get it. It really sucks. Banks doing it too is also really shitty. I didn’t take it personally, I hope you didn’t either. At some point I’m hoping a sane plateau becomes apparent. Or at least a realistic ‘plan B’ for how to recover from this. Generative AI though is really poisoning the online well, and I don’t know what we’re going to do about it. Captchas were never great, but near as I can tell they’re literally only stopping real humans now, for instance. When someone can easily gin up thousands of impossible-to-tell-they’re fake IDs for people that never existed? That breaks almost every verification process anyone has right now. Except in person ‘show up and provide the actual physical ID’. and that’s the reality we live in.

by gnu8 3y ago

lazide 3y ago

They have and do. The issue is fraud and account compromises are so common (due to password reuse being the norm and every other site under the sun getting compromised), that they’re in a catch-22. Support can be Social Engineered easily (especially if you don’t spend massive amounts of money on it). Making support not socially engineer-able is essentially impossible too with their user base, as the user base is too diverse. Technical solutions currently suck, even if we ignore that most of the population is unable to effectively use them. There is no consistent way across their user base to even verify a person exists, let alone that they are who they say they are, let alone that they are who created or owns the account! And no one even puts the closest local equivalent into their Google account for legitimate reasons anyway. Like who would want to upload their Birth certificate? Or passport? Or DL/ID? That’s a terrible idea. And many people don’t have the US equivalent to one anyway. Not to mention, deep fakes have gotten really good. Not that a US company is going to have much luck identifying a fake (or real!) Belgian equivalent for instance anyway. So they go with heuristics, which always have edge cases, try to hide what rules they use to avoid being gamed at scale, and hope for the best. Not great. But seriously, what else are they going to do?

gnu8 3y ago
Thank you for the thoughtful reply. I will admit I was fulminating a bit. I'm just extremely frustrated that their solution to edge cases is to drop them on the floor and there's nothing to be done. No individual Google user actually matters to the company, but many people actually need their email account. The asymmetry of power and money here just isn't sustainable.
- lazide 3y ago
  I get it. It really sucks. Banks doing it too is also really shitty. I didn’t take it personally, I hope you didn’t either. At some point I’m hoping a sane plateau becomes apparent. Or at least a realistic ‘plan B’ for how to recover from this. Generative AI though is really poisoning the online well, and I don’t know what we’re going to do about it. Captchas were never great, but near as I can tell they’re literally only stopping real humans now, for instance. When someone can easily gin up thousands of impossible-to-tell-they’re fake IDs for people that never existed? That breaks almost every verification process anyone has right now. Except in person ‘show up and provide the actual physical ID’. and that’s the reality we live in.