4 ms·

This kind of issue is absurdly common. I’ve seen basically the same thing with Microsoft, Amazon and Google—personally and with others. With Google, it’s well-

This kind of issue is absurdly common. I’ve seen basically the same thing with Microsoft, Amazon and Google—personally and with others. With Google, it’s well-documented that sometimes, even if you don’t have 2FA turned on and you know your password, they simply won’t let you log in without some sort of additional verification… which may not be possible. This hit me once while overseas, I think I managed to get in by tunnelling through my VPS in Australia. And if you can’t do this, you’re stuck, because Google simply doesn’t have support. With Amazon, I was finally able to find one way of contacting them that didn’t require signing in, and when I finally got to a human, the problem was immediately fixed.

TacticalCoder 1y ago
[dead]
wat10000 1y ago
These businesses are all about scale. Each user makes them a paltry amount of money, but they have an enormous number of users. A single support incident that reaches a paid worker on their side costs them more than the profit you’ve brought them for the year. It probably costs them more than the profit you’ll bring them for your entire life. With less scale-y businesses, it’s worth it for them to put some effort into fixing problems, as an investment in your future business. Here, the only reason would be to avoid reputational damage. And who’s going to stop using Google or Microsoft because some guy had trouble getting support? There’s a story (no doubt apocryphal) about Bill Gates telling people working on Windows that a customer calling their support line cost as much as the profit they made selling that copy of Windows. The point was to make it so Windows users didn’t need to call support by making Windows work better. The modern equivalent of this would be to make sure that users can’t reach expensive support in the first place.
- jalapenos 1y ago
  I feel like once they've gotten everyone on the planet using their services, and then fucked them all over, maybe then there'll be a market un-fucking them over.
- danielscrubs 1y ago
  With enough eyeballs all bugs are shallow. What would be the opposite? With enough blindfolds all bugs are unimportant?
  - airtonix 1y ago
    [dead]
- aucisson_masque 1y ago
  If business are all about scale then you are not fixing one user problem but you are fixing the same problem experienced by thousands or millions of user. There is no excuse for being lazy.
  - wat10000 1y ago
    That’s the thing, sometimes a user’s problem requires a fix that’s specific for them. Their account gets into a bad state and needs to be unstuck. There’s no fixing that for millions of users, only fixing it for each user, millions of times.
GoblinSlayer 1y ago
>even if you don’t have 2FA turned on Presumably the excuse is that it happens because you don't use 2fa and your ip changed, but I heard 2fa might not save you either.
random3 1y ago
Exactly! The OP’s surprisal is surprising, given that 95% of all support interactions across the board are exactly like this. In fact, the internal support - i.e. the support for employees is just as bad and nonsensical. It goes pretty much like this. If your problem needs “reasoning” that entails more than matching a direct solution, you’re getting the default answer that’s the closest match to the solution. The only difference between live support and support docs is that live support has access to some of your data and controls over some flows (e.g. reset password) Now the real kick - it’s like this across the board outside of tech. If you go to a hospital with a problem that is not the 95 or 99 or whatever they are “tuned” to deal with, your pretty much fucked, unless you can be resourceful or luck enough to navigate the structure until you find someone that actually knows how to. Bureaucracies? Same. It’s effectively the same dumb machinery with dumb human cogs that you’re always dealing with. I think it’s simply the “limit” of average human intelligence and find it hard to believe AI will end up being dumber than this.
- mikekaganski 1y ago
  > The OP’s surprisal is surprising, given that 95% of all support interactions across the board are exactly like this If your point is "it is today's norm, let's accept it and shut up", I feel the opposite. If the "norm" is like that, expressing it aloud is my way of contributing to society.
  - carlosjobim 1y ago
    That is clearly not his point.
- bigbacaloa 1y ago
  [dead]
- sam_lowry_ 1y ago
  Nexus by Yuval Harari covers bureaucracy in the same vein.
- tarsinge 1y ago
  Bureaucracy didn’t emerge in the 21th, contrary to lack of customer support for big companies. Bureaucracy is a symptom part of the enshittification, the root cause is Monopoly (direct or through organized shareholders across an industry). You don’t need support or good service when customers don’t have the choice to go elsewhere.
esulteric 1y ago
Google wiped all my codes from their authenticator app It really drove home that trusting my identity and online presence to these entities that do not care or even know how to be responsible about it is a very bad idea.
- mkesper 1y ago
  Always use an open source OTP app for something like that.
  - rstuart4133 1y ago
    Nowhere near paranoid enough. Always take the "manual" OTP option, take a backup copy of the code you copy and pasted. I use my password manager Then, always export the contents of you entire password manager database, encrypt it with the same password you use for you password manager with the pdkf2 rounds set to an absurdly high number and place it in a public place on the internet. Lots of places will host it for free.
waste_monk 1y ago
It is true that google's (lack of) customer support is awful. >it’s well-documented that sometimes, even if you don’t have 2FA turned on and you know your password, they simply won’t let you log in without some sort of additional verification However, this isn't quite fair on google - it's not arbitrary "sometimes", it's that accounts get locked if there's been unusual or suspicious activity that may indicate an attempt to compromise the account, such as failed login attempts or logins from a new location. The account is locked from single-factor (password only) authentication for a period of time to prevent compromise (which isn't disclosed but as I understand can vary and is usually a week or two), but will allow login with an MFA challenge. If the account is locked and there are no MFA methods set up or other means of recovery like backup passwords, how are they meant to verify that it's you recovering the account and not an attacker? Supposing you did manage to talk to a live google support agent, you'd still have the same problem of not being able to verify ownership of the account.
- danlitt 1y ago
  I think this is quite fair criticism of google. The idea of the account being locked and requiring MFA to verify is something they made up without consulting the user. If they're going to do this "suspicious account" locking, they must make MFA mandatory beforehand. If they haven't got MFA from the user, they must trust the password. If that means my account gets compromised, that's my problem. Note that there is no question who owns the account. That's what the password is for!
  - waste_monk 1y ago
    > If they're going to do this "suspicious account" locking, they must make MFA mandatory beforehand. This should probably be the case - I am not a big fan of passkeys [1] but hopefully this will help make non-SMS, phishing resistant MFA available to the masses. Still, Google are in a difficult position where on the one hand they have people angry about being locked out, and yet if they didn't they would have people angry about their accounts being compromised. > If that means my account gets compromised, that's my problem. It is also the problem of everyone on your contacts list, the operators of other services which use Google OAuth for login, anyone who might recieve spam from your compromised account, and so on. Reducing harm by temporarily restricting the account when heuristics indicate it may be compromised is not unreasonable IMO. >Note that there is no question who owns the account. That's what the password is for! This is unfortunately not as true as we would like it to be. Have a look at the list of compromised services on Have I Been Pwned [2] - not all of these include passwords, and many that do would be hashed (and hopefully salted) rather than plaintext, but it still happens often enough to be of great concern. [1] WebAuthN / Passkey technology is fine in the general sense, and I am quite happy to use it with a hardware security key (such a Yubikey or Titan) or emulated in a password manager. However I think the recent push towards having it tied to a TPM on a device such as a phone is a bit short-sighted, simply because these devices are prone to being lost or damaged. If you set up passkey MFA on the phone and don't enrol a backup method, then lose your phone, you have also lost the account. Probably these services should require 2+ MFA methods configured. [2] https://haveibeenpwned.com/PwnedWebsites https://haveibeenpwned.com/PwnedWebsites
a012 1y ago
Oh man, I’m pulling my hair right now because Google _decided_ consistently that someone else has my password and locked them out. They’re so proud of themselves about it I can imagine. But in reality, I’m trying to login my Gmail account on my second iPhone which is next to my original Android that has this Gmail account installed. When I logged in on the iPhone they showed a code and asked me to pick the same code on the Android, I did follow but they insisted that it wasn’t enough and still locked me out.
doener 1y ago
The complete lack of any human customer service that is actually answering is the reason I‘ll never again trust my private eMails to be managed by Google. https://t3n.de/news/google-e-mails-geld-604458/ https://t3n.de/news/google-e-mails-geld-604458/
kazinator 1y ago
The common thread is that all these tech giants concentrate on scaling their ability to deliver the product and generate revenue, making service for exceptional situations a lower priority, with solutions that do not scale. While you are consuming product and paying, you are basically identical to everyone else doing that (except for your varying personal info). That can be scaled in straightforward ways. If you have some problem that requires attention to your account, that doesn't scale well. Even if it could, it's not worth it to them; it's off the happy, revenue-generating path.

TacticalCoder 1y ago

[dead]

wat10000 1y ago

These businesses are all about scale. Each user makes them a paltry amount of money, but they have an enormous number of users. A single support incident that reaches a paid worker on their side costs them more than the profit you’ve brought them for the year. It probably costs them more than the profit you’ll bring them for your entire life. With less scale-y businesses, it’s worth it for them to put some effort into fixing problems, as an investment in your future business. Here, the only reason would be to avoid reputational damage. And who’s going to stop using Google or Microsoft because some guy had trouble getting support? There’s a story (no doubt apocryphal) about Bill Gates telling people working on Windows that a customer calling their support line cost as much as the profit they made selling that copy of Windows. The point was to make it so Windows users didn’t need to call support by making Windows work better. The modern equivalent of this would be to make sure that users can’t reach expensive support in the first place.

jalapenos 1y ago
I feel like once they've gotten everyone on the planet using their services, and then fucked them all over, maybe then there'll be a market un-fucking them over.
danielscrubs 1y ago
With enough eyeballs all bugs are shallow. What would be the opposite? With enough blindfolds all bugs are unimportant?
- airtonix 1y ago
  [dead]
aucisson_masque 1y ago
If business are all about scale then you are not fixing one user problem but you are fixing the same problem experienced by thousands or millions of user. There is no excuse for being lazy.
- wat10000 1y ago
  That’s the thing, sometimes a user’s problem requires a fix that’s specific for them. Their account gets into a bad state and needs to be unstuck. There’s no fixing that for millions of users, only fixing it for each user, millions of times.

GoblinSlayer 1y ago

>even if you don’t have 2FA turned on Presumably the excuse is that it happens because you don't use 2fa and your ip changed, but I heard 2fa might not save you either.

random3 1y ago

Exactly! The OP’s surprisal is surprising, given that 95% of all support interactions across the board are exactly like this. In fact, the internal support - i.e. the support for employees is just as bad and nonsensical. It goes pretty much like this. If your problem needs “reasoning” that entails more than matching a direct solution, you’re getting the default answer that’s the closest match to the solution. The only difference between live support and support docs is that live support has access to some of your data and controls over some flows (e.g. reset password) Now the real kick - it’s like this across the board outside of tech. If you go to a hospital with a problem that is not the 95 or 99 or whatever they are “tuned” to deal with, your pretty much fucked, unless you can be resourceful or luck enough to navigate the structure until you find someone that actually knows how to. Bureaucracies? Same. It’s effectively the same dumb machinery with dumb human cogs that you’re always dealing with. I think it’s simply the “limit” of average human intelligence and find it hard to believe AI will end up being dumber than this.

mikekaganski 1y ago
> The OP’s surprisal is surprising, given that 95% of all support interactions across the board are exactly like this If your point is "it is today's norm, let's accept it and shut up", I feel the opposite. If the "norm" is like that, expressing it aloud is my way of contributing to society.
- carlosjobim 1y ago
  That is clearly not his point.
bigbacaloa 1y ago
[dead]
sam_lowry_ 1y ago
Nexus by Yuval Harari covers bureaucracy in the same vein.
tarsinge 1y ago
Bureaucracy didn’t emerge in the 21th, contrary to lack of customer support for big companies. Bureaucracy is a symptom part of the enshittification, the root cause is Monopoly (direct or through organized shareholders across an industry). You don’t need support or good service when customers don’t have the choice to go elsewhere.

esulteric 1y ago

Google wiped all my codes from their authenticator app It really drove home that trusting my identity and online presence to these entities that do not care or even know how to be responsible about it is a very bad idea.

mkesper 1y ago
Always use an open source OTP app for something like that.
- rstuart4133 1y ago
  Nowhere near paranoid enough. Always take the "manual" OTP option, take a backup copy of the code you copy and pasted. I use my password manager Then, always export the contents of you entire password manager database, encrypt it with the same password you use for you password manager with the pdkf2 rounds set to an absurdly high number and place it in a public place on the internet. Lots of places will host it for free.

waste_monk 1y ago

It is true that google's (lack of) customer support is awful. >it’s well-documented that sometimes, even if you don’t have 2FA turned on and you know your password, they simply won’t let you log in without some sort of additional verification However, this isn't quite fair on google - it's not arbitrary "sometimes", it's that accounts get locked if there's been unusual or suspicious activity that may indicate an attempt to compromise the account, such as failed login attempts or logins from a new location. The account is locked from single-factor (password only) authentication for a period of time to prevent compromise (which isn't disclosed but as I understand can vary and is usually a week or two), but will allow login with an MFA challenge. If the account is locked and there are no MFA methods set up or other means of recovery like backup passwords, how are they meant to verify that it's you recovering the account and not an attacker? Supposing you did manage to talk to a live google support agent, you'd still have the same problem of not being able to verify ownership of the account.

danlitt 1y ago
I think this is quite fair criticism of google. The idea of the account being locked and requiring MFA to verify is something they made up without consulting the user. If they're going to do this "suspicious account" locking, they must make MFA mandatory beforehand. If they haven't got MFA from the user, they must trust the password. If that means my account gets compromised, that's my problem. Note that there is no question who owns the account. That's what the password is for!
- waste_monk 1y ago
  > If they're going to do this "suspicious account" locking, they must make MFA mandatory beforehand. This should probably be the case - I am not a big fan of passkeys [1] but hopefully this will help make non-SMS, phishing resistant MFA available to the masses. Still, Google are in a difficult position where on the one hand they have people angry about being locked out, and yet if they didn't they would have people angry about their accounts being compromised. > If that means my account gets compromised, that's my problem. It is also the problem of everyone on your contacts list, the operators of other services which use Google OAuth for login, anyone who might recieve spam from your compromised account, and so on. Reducing harm by temporarily restricting the account when heuristics indicate it may be compromised is not unreasonable IMO. >Note that there is no question who owns the account. That's what the password is for! This is unfortunately not as true as we would like it to be. Have a look at the list of compromised services on Have I Been Pwned [2] - not all of these include passwords, and many that do would be hashed (and hopefully salted) rather than plaintext, but it still happens often enough to be of great concern. [1] WebAuthN / Passkey technology is fine in the general sense, and I am quite happy to use it with a hardware security key (such a Yubikey or Titan) or emulated in a password manager. However I think the recent push towards having it tied to a TPM on a device such as a phone is a bit short-sighted, simply because these devices are prone to being lost or damaged. If you set up passkey MFA on the phone and don't enrol a backup method, then lose your phone, you have also lost the account. Probably these services should require 2+ MFA methods configured. [2] https://haveibeenpwned.com/PwnedWebsites https://haveibeenpwned.com/PwnedWebsites

a012 1y ago

Oh man, I’m pulling my hair right now because Google _decided_ consistently that someone else has my password and locked them out. They’re so proud of themselves about it I can imagine. But in reality, I’m trying to login my Gmail account on my second iPhone which is next to my original Android that has this Gmail account installed. When I logged in on the iPhone they showed a code and asked me to pick the same code on the Android, I did follow but they insisted that it wasn’t enough and still locked me out.

doener 1y ago

The complete lack of any human customer service that is actually answering is the reason I‘ll never again trust my private eMails to be managed by Google. https://t3n.de/news/google-e-mails-geld-604458/ https://t3n.de/news/google-e-mails-geld-604458/

kazinator 1y ago

The common thread is that all these tech giants concentrate on scaling their ability to deliver the product and generate revenue, making service for exceptional situations a lower priority, with solutions that do not scale. While you are consuming product and paying, you are basically identical to everyone else doing that (except for your varying personal info). That can be scaled in straightforward ways. If you have some problem that requires attention to your account, that doesn't scale well. Even if it could, it's not worth it to them; it's off the happy, revenue-generating path.