Hacker News Reader

Comment by victorhooi | Hacker News Reader

I actually dissected the authors example above - and they actually don't really help prove his/her point.

The first example - was basically fraud, that probably got picked up in hijacking/bot-net detection (based on public statements).

The second - I can't comment, as there are no public statements.

The third - the author made a public statement, and seems to harbour no ill-will to Google after it was explained to him what actually happened. I can't comment on that conversation, but I will say that in general, Google does a lot to protect its users from all kinds of security issues and attacks.

View on HN

As responded on the third, a process that relies on the subject being well enough known or connected enough to bypass common process isn't a scalable solution.

If someone has to know to e-mail you personally to help fix an issue, that concept doesn't scale to x million accounts.

I'm not trying to get at Google specifically here, I'm suggesting that as all the tech. companies move more of people's digital lives to the cloud, these accounts become more important and how they deal with ToS violations, reactivations and the like will require a lot of thought.

The third - the author had already kickstarted a normal recovery process by https://accounts.google.com/signin/recovery.

However, these things take a while to process.

As I commented elsewhere - if your account got hijacked - the last thing you want is for the hijacked to get back in, via some automated form.

I had to deal with exactly this nightmare scenario for a friend a few months back. Two email accounts, one from Gmail, one from another (unnamed) provider. The hijacker tried to get back in, several times (and did on the other one).

Knowing that the bar is reasonably high that only you yourself can get back in (even if it may take a few days) is very reassuring.

Trust me - if it's between waiting 2-3 days, versus having somebody get back in, pilfer all your email and commit identity fraud, I would pick the former more secure any day of the year.

Reply on news.ycombinator.com