7 ms·

Oh man. The infinite loops of impossible verification by large companies that should know better are massive pain peeve of mine. This goes right to the top for

• integralid 8mo ago
  No need to look for malicious intentions, this is just a feature that costs money so it's very low (or zero) priority for profit driven organisations. I wonder if finding people responsible and spamming then with their own service emails would make the team care enough to fix this. But of course that's mostly dubious, probably illegal, and shouldn't be a responsibility of some vigilante hacker
  • loloquwowndueo 8mo ago
    With AI these days it’d cost almost zero money. /s
  • b112 8mo ago
    If bartenders are legally (including criminally!) liable in some jurisdictions for their customers, then certainly a chain of legal liability can exist in other industries.
    • Pxtl 8mo ago
      Yes but bartenders overserving is a crime done by a working-class person and not a wealthy business.
    • CydeWeys 8mo ago
      What are you envisioning exactly?
      • b112 8mo ago
        Am I supposed to envision something? When pointing out that legal parallels exist, to enact a solution, must I envision that solution?
  • justinclift 8mo ago
    > No need to look for malicious intentions, this is just a feature that costs money so it's very low (or zero) priority for profit driven organisations. Malicious in-attention then, by the profit driven org? :)
  • wat10000 8mo ago
    What is the word for harming other people in order to make more money for yourself, if not "malicious"?
• rationalist 8mo ago
  Someone constantly adds my Gmail address as their Gmail account's backup address. I constantly remove it whenever Gmail sends me the notification. I can't help but think there is some method for the other person to steal my Gmail account if I never remove my email as their backup.
  • Romario77 8mo ago
    I logged in several times to other people's accounts and reset their passwords. But it's too tiring, people keep adding my email. I hope it's because I have small simple email and not because they want to steal it.
    • nativeit 8mo ago
      You’re confessing to several actual felonies here, may want to change strategies.
      • kstrauser 8mo ago
        “…and so I made him the owner of my account, and he used that to remove himself from it!” “We’ll be right over.”
        • thatguy0900 8mo ago
          You forgot the part where he reset their email he didn't own and change their passwords so they couldn't get back into it
          • kstrauser 8mo ago
            I think you’re misreading this. OP has an email account. Someone else signed up for some website that doesn’t verify that you own the address before allowing you to log in and use the service. If the site did verify it, the user wouldn’t have been able to log in because OP would have been getting the verification emails, and not the user. Later, after OP told the user and they failed to change their address, OP logged into the site and changed their password, putting an end to the spam they were receiving from the user’s actions. I don’t have an ethical qualm with this. He didn’t want to sign up for the service. Someone else signed his email address up for it. Legally, I can’t imagine that being prosecutable.
• plagiarist 8mo ago
  I prefer "please verify your account" to "thanks for joining" by a lot. The former presumably does not verify when I ignore it. The latter should be illegal but somehow isn't. I do wish there was a requirement for some sort of "no" button that would stop sending sign up requests entirely.
  • Aachen 8mo ago
    Any idea what the incentive is for them to put in an email address they can't access? I run a few websites that accept an email address (all noncommercial, I have no interest in spamming anyone). One of them is the "contact me" feature on my personal website. To prevent spam, I had people just put in their email address and it'll automatically email them my email address. This works perfectly to this day, haven't got a single spam email on any of the addresses I've handed out, but the ratio of emails sent out to received is probably 50 to 1. Why would anyone put an email address in there if not to contact me? I've been wondering if it's used by mail bombing services, idk if that's a thing but I know of the concept of annoying someone by signing them up for a hundred newsletters. My site doesn't send recurring emails, though, and it doesn't allow putting more than two email addresses per month in, per /24 IPv4 block (and even more strict on v6). It's useless for mail bombing services but the (presumed) bots keep submitting a steady rate of maybe 2 new email addresses per day, each time from a new ISP in a random country. No email addresses is ever submitted twice. No rhyme or reason to it. If anyone can make sense of this, that might help me in stopping the abuse
    • plagiarist 8mo ago
      One way to do phishing attacks is to inject some payload in an automated mailing so malicious content comes from a valid email address. I wonder if they're testing whatever mail entry they can find with addresses they have access to in attempt to find something usable?
  • prmoustache 8mo ago
    > The former presumably does not verify when I ignore it. That doesn't prevent a huge majority of them from sending you notification emails all the time even if you never verify.
• cucumber3732842 8mo ago
  The point of the system is what it does. They can't just say "we don't want to deal with small timers who will not pay us big bucks doing nonstandard things" without pushback but they can write the policy so that a huge fraction of those use cases fall into some crack that can only be got out of by incurring the kind of expense that's a non-starter for those users. Your municipal code is rife with examples of this.
  • db48x 8mo ago
    This is a catchy aphorism, but not really true. Things can be badly implemented so that they fail to achieve their purpose.
    • praestigiare 8mo ago
      People often have trouble with this saying, and that trouble often boils down to the difference between intent and purpose. The people who create a system have some intent for it. The system may or may not effectively achieve that intent, may or may not outlive the initial conditions that surrounded its creation, and may or may not have side effects. Purpose is something humans assign. It is sometimes linked to intent. A carpenter's hammer is intended to drive and pull nails, and that is often also its purpose. The purpose of the hammer I keep in my basement is breaking open walnuts. The phrase is stating that the purpose we should assign to systems when judging them is their outcome, and not the intent behind them.
      • db48x 8mo ago
        Sometimes intent and outcomes matter, but the aphorism is simply not a good guide to understanding reality. It should be discarded. The classic example is a hospital for treating cancer patients. Suppose that one third of the patients are successfully treated, while the other two thirds die of their cancer. Is the purpose of the hospital to kill two thirds of the patients? Clearly not, but that is the outcome.
        • praestigiare 8mo ago
• squeefers 8mo ago
  > Either people who do this for a living have no clue how to do their job, how naive. most of the world work to survive, not because its their dream vocation. they probably dont care as much as you do
• duped 8mo ago
  A chronic problem is the idea that if something can't be automated with a human in the loop then it simply can't be done at scale. Technologists will do anything except employ humans to solve social problems.
  • jagged-chisel 8mo ago
    s/technologists/venture capitalists/
• Pxtl 8mo ago
  Ah the old "reverse identity theft". Relevant xkcd: https://xkcd.com/1279/ https://xkcd.com/1279/ Yeah, I get the same regularly.
  • thesuitonym 8mo ago
    Smartly, I got firstnamemiddleinitiallastname@gmail.com. I never get anybody else' details. On the other hand... Occasionally someone gets my info because some careless person entered my email address into their system incorrectly. You'd think this problem would be solved by moving to a custom domain, but I still once in a while find someone completely ignore what I put into the form and sign me up as firstnamelastname@gmail.com.
• AtreidesTyrant 8mo ago
  happens with apple products all the time
• MereInterest 8mo ago
  > Oh man. The infinite loops of impossible verification by large companies that should know better are massive pain peeve of mine. I got hit by this from google. 1. Gmail added requirement for 2FA on my primary email address. Since I had no phone number on file, it instead used my recovery email address. Thankfully, I still had the password for my recovery email address, and could continue to (2). 2. Gmail added requirement for 2FA on my recovery email address. Since I had no phone number on file, it instead used by recovery's recovery email address. Thankfully, I still had the password for my recovery's recovery email address, and could continue to (3). 3. SBC Communications no longer exists, as it merged with AT&T in 2005. Email addresses at `sbcglobal.net` were maintained up until around 2021-ish, when they started purging any mailboxes that had been idle for more than 12 months. Fundamentally, this was google's fault for misusing a recovery email for 2FA. Unfortunately, the only way to fix it would be to contact AT&T, asking them to pretty please update the email settings for somebody who hadn't been a paying customer for two decades.
  • deepsun 8mo ago
    > Fundamentally, this was google's fault Or yours, for not caring about 2FA. It's been a common practice for many years, and strongly recommended by most identity services, as well as OWASP and NIST recommendations. What would you do in Google's place?
    • Telaneo 8mo ago
      Not add 2fa automatically, but instead prompt with options to add it. This probably doesn't comply with the relevant recommendations, but cutting a user of from their email is worse in my opinion.
      • deepsun 8mo ago
        I'm sure Google prompted author for years begging to turn the 2FA on, as well as warning that they will enforce it on day X. Author ignored them all.
        • 8mo ago
• duxup 8mo ago
  Oh man we had a person leave unexpectedly who controls our Apple organization for our dev accounts. I'm several months into me making requests, getting responses at least a week later for each email where the responder ... didn't really read my message. Then they ask for documents ... but they forgot to send me the secure link ... another week+ for them to do what they said they were going to do. Now one of my documents didn't include a sentence they needed ... One of the requests was for a business card ... I haven't had a business card made with my name on it in 20 years. The amazing thing is that I bet scammers working this system can get through this faster than I can. At this point they should just give me control because no way would some scammer fail this much at this ungodly process.
  • praestigiare 8mo ago
    Scammers can definitely get through it faster than you can. Whenever you attempt to address abuse in a system by increasing the complexity of that system, you implicitly bias it towards those with the time and inclination to study it, which always includes those with intent to abuse it, and generally does not include your users.
  • mxuribe 8mo ago
    I'm in a similar boat...and over the weeks where i have been sending the requested docs/files...Apple reps come back and state that one of docs i sent them was not valid...so i ask them to clarify their "definition" of the doc..and they just either reply with unhelpful comments, or delay a little and delay things further. When someone asks for a copy of a payslip and you send it...but then Apple says its not a payslip, i genuinely am sad about the overall state of the world...I dislike apple and all these big tech providers for their abusive control/power and at the same time vast layers and levels of incompetence. :-(
    • duxup 8mo ago
      I’ve been shocked by the poor support. I didn’t expect speed but what I’ve experienced has been what feels like bottom of the barrel outsourced support you get from some no name brand company….
• Arrowmaster 8mo ago
  I'm currently in the endless email loop because someone named Raymond used one of my Gmail names to register with State Farm. One of their agents even emails me directly when he gets really behind on his payments but won't do anything when I tell them it's the wrong email. In the past when this happens I usually reset the password and change the email to some anon throwaway but I can't do that without Raymonds DOB (don't quote me on that, been a while since I tried).
  • smelendez 8mo ago
    This exact thing happened to me with a State Farm agent. After a few months, I told them I was concerned about the privacy ramifications and would have to report it to their state insurance regulator, and it was very quickly fixed.
• jacekm 8mo ago
  A couple of years ago someone associated my email with their bank account in Santander UK. I tried to get in touch with Santander but turned out that the only way to do so is to either make an international call (I don't live in UK) or send them a paper letter. I gave up and just routed these emails to separate folder.
  • subscribed 8mo ago
    I meticulously report every single of emails like this as spam. Every single one. If it _could_ be read as a phishing attempt, I report them as phishing. Etc.
    • zenoprax 8mo ago
      "Wrong recipient" seems beyond the scope of what you can expect a spam filter to handle with accuracy. Wouldn't marking it as spam just degrade the signal to noise ratio of legitimate email? I'd rather get a few misses here and there than have to trawl through my spam folder which I only check once or twice a year when something doesn't show up right away.
• oooyay 8mo ago
  It's entirely on us as citizens to leaving them as pet peeves instead of crafting them into strategic law that makes them not only illegal but shunned. A little bit of structure goes a long way here.
• derefr 8mo ago
  > along the ubiquitous "please verify your account" emails with NO OPTION to click "that's NOT me, somebody misused my email" What would you expect clicking that "wasn't me" link to do? In 99% of cases, the user who signed up with your address already can't do any more with that account unless you positively confirm it was you; and the site also won't send you any more email because they don't consider the email verified (and so sending to it might result in their emails getting sent to spam -> their email-sending reputation score going down.) So things are already in the state you'd want them to be in, no? The only problem I can think of with that state is that now you can't sign up "fresh" for an account with the same provider, because now there's already an account associated with your email address sitting there in their DB in the pending-email-verification state. (But you still can acquire that account, by clicking "forgot/reset password" and going through that flow, which will inevitably go through your email, as anything like a 2FA setup flow always waits behind email verification.)
  • vintermann 8mo ago
    > and the site also won't send you any more email because they don't consider the email verified Netflix, for one, didn't do this. They kept allowing this guy to "resend his confirmation email" periodically over several months (I never had a Netflix account). My theory is that it was an affiliate scam of some sort; someone probably got paid for everyone who signed up with his code. So he "signed up" thousands of random mails in the hope that some of them would click through on the "you're almost ready to start your Netflix journey!" mail and actually subscribe to Netflix.
• BobbyTables2 8mo ago
  Once got one of those with a disclaimer that clicking any link was giving permission to subscribe me… I believe they included the “unsubscribe” link too…