Hacker News Reader

Comment by rmason | Hacker News Reader

While it's not exactly the same thing but Facebook needs to tighten up their rules. I got in a squabble with someone who wanted my FB identity.

Even though I didn't follow him he filled out a form online and had me declared deceased. It took me close to a week, with the intervention of a friend who worked at Facebook, to get my account back.

How can someone who you don't even follow back be allowed to do something like this to someone? I had to prove that I was alive, complete with photos of me with my drivers license.

But why is a complete stranger without any proof whatsoever able to have me declared dead? Facebook needs to rethink these rules. Seems to me in this case the guys widow should be the one who has final say over his account.

View on HN

You can also go to usps.com and declare someone has moved and have all their mail sent to somewhere else (probably don't pick your own address if you don't want to get caught).

I don't know about the USPS's implementation, but the UK's Royal Mail not only collects ID for this service, but sends an unredirectable letter to your old address saying 'we're starting a redirect, contact us if this is odd'. So it is possible to do sanely. Like Facebook, I suppose - require a scanned death certificate?

USPS sends the same letter and requires you to answer several questions before doing it

No they don't. My roommate moved out a few months ago, I watched him fill out the mail forwarding form (with his name and my/our address). Not only did no confirmation letter show up in my mailbox -- in fact I stopped getting my own mail for several days and when I confronted the USPS worker, he said, "Oh, I thought your apartment was vacant now." I got pretty mad and he just shrugged, not even an apology.

I had to get my car's title reissued from the DMV (I had just bought it off my roommate as he was leaving), and also had a paycheck disappear (was working 1099 remotely and paid monthly via check) because both things were coming in the mail that week and disappeared never to be seen again. (Luckily the guy I was subcontracting from paid for his own stop payment and reissued the check)

Yeah, when I moved a few years ago I also got no confirmation. So after the move, I sent a letter to my old address, with no return address, to see if it got redirected.

(Although my letter did, I'm pretty sure my first Ventra card was lost in the mail anyway. With the insanity of the switch it got delayed a couple months, and ended up getting sent out right about when I moved)

Or you can just send an email asking if user is still alive.

Last time I did this, the "we're starting a redirect, contact us if this is odd" letter was sent after the redirect started, and it was helpfully redirected to the new address!

Seamless!

The USPS sends two - one to your old address and one to your new address. The one sent to your old address does indicate that they’re redirecting - that is, it is sent after the fact, it is not asking for confirmation or providing a grace period before they do - but it is marked clearly as something that should not be forwarded.

I suppose it could have been forwarded by accident (at scale screw ups do happen), but perhaps you confused one with the other?

>Like Facebook, I suppose - require a scanned death certificate?

This whole discussion is completely absurd.

What went so wrong that we want to send our government IDs and death certificates to one of the companies with worse records with respect to their users' data?

The real solution is to stop using Facebook.

Amen to that. Monetization of friendships (and "friendships") is evil.

But beyond any of that, the idea that a Facebook account needs to correlate to real world consequences, and real world facts is beyond stupid.

I can buy ten phones, create ten free email addresses, and create ten facebook accounts, tonight, and no one can stop me, or challenge what I've done, as long as it's not invasive and obnoxious to other users.

Nor should it be possible to draw reproach for doing such a thing. There are real reasons for users to want to create dummy accounts like that, and as usual, there's no reason 99 people need to suffer because one asshole has to misbehave.

Facebook, as a walled garden, is fated to forever lack practical utility. It's like a rain gutter that empties into a sewage facility you can never see inside. If you know that you can crack open a mercury thermometer and dump it into the drain, don't drink the lemonade they're selling outside the front gate, unless you can prove it's not contaminated by your thermometer disposal activities.

The USPS also sends a notification to the old address.

They require a credit/debit card that they charge a $1 to. That cards billing address must be either the old address or the new address. So yea, its easy, but it's not that easy.

Though now that I think about it i wonder if you could use those visa giftcards that let you edit your address. Maybe it is indeed that easy.

USPS requires the credit/debit card charge if you fill out the form online. IIRC, they charge nothing if you do it in person, but you may be required to show ID.

Nope. Fill out form, hand in (or IIRC, drop in any mail box). They may glance to make sure you signed it, but nothing more.

Maybe enough to skip through the automated checks, maybe not. I suppose it depends on whether it's being done through an ID verification service or just a payment processor putting a hold on the card.

The gift card number wouldn't be visible to the ID verification services as a credit or deposit account, and that'll certainly knock points off in their scoring system.

I suspect it would just shift the point where someone eventually notices either way.

Anyone can change their credit card billing address to anything they want.

That does leave a paper trail for the postal inspector looking for a collar.

You correct a $1 preauthorization without capture occurs that veirfy AVS part of Zip code and disappeares from yiur account within 48 hours. So only Zip code of new/old card is required at the office, unless you do it online then whole address is being verified.

Usps system recognizes gift cards and do not allow those, so is majority of online services for example Digital Ocean (due to using their boxes for spam)

AVS can check the numeric part of the address as well as the zip code.

As I understand it, though, this would still green-light "1234 Sixth Street" for "1234 Wilson Avenue." I also suspect it's less than bulletproof on some weird format addresses

Yes, the Visa gift cards work, at least as of a few years ago. Most of them will let you change the "billing zip code" online as often as you like, or simply always return success on Address Verification System (AVS) queries.

Most stores don't routinely keep surveillance footage around very long, though I have suspicions about Target.

The deterrent against this is serious prison time. That's mail fraud, a federal crime that could hypothetically get you 20 years in prison. Standard sentencing guidelines mean you would almost certainly not get that 20 years, but it's still not the sort of crime you'd commit casually.

Change-of-address scam moved UPS corporate headquarters to tiny Rogers Park apartment, feds say

http://www.chicagotribune.com/news/local/breaking/ct-met-ups...

Don't pick UPS's HQ address either, they're probably going to notice...

https://www.npr.org/sections/thetwo-way/2018/05/10/610102872...

I can see why the opposite might be valid, if you recently lost someone the last thing you want is argue with Facebook that yes, that loved one is indeed dead.

Probably needs some better rules but that part needs to be as painless as possible

For that case, though, there is a very valid way to verify the status of the deceased: The death certificate.

Indeed, at least in the US, it’s expected that you’ll need several copies of the death certificate to handle bank accounts, etc. I doesn’t seem like a burdensome requirement to ask for one.

Why not err on the side of caution and leave the profile alone until someone, with adequate documentation and at a time of their choosing, contacts FB about converting or deleting the profile? I don't think leaving it up does any harm.

I had a friend die in sufficiently unfortunate circumstances to attract media attention. It was definitely a good thing that Facebook deactivated his account very quickly upon request (I doubt the person who asked for it to be deactivated had access to the death certificate at the time) before journalists used it as a source of photographs and people to ask for quotes.

Years ago I took it upon myself to cancel a record of the month club membership belonging to a work colleague who died suddenly. They would not do a thing without a copy of the death certificate, so I had to tell them that all I could do then was recommend they keep sending the records and they'd have to eventually try suing him for payment.

I can offer Facebook two choices to verify death if a third party alleges it. Either provide the death certificate or the name of the funeral home.

If Facebook was smart they'd make it super simple for the funeral directors to provide this information directly to them. I lost my dad late last year and had to answer a number of questions for the funeral director.

All the funeral director would have to do is ask if the deceased had any social media accounts and do you want me to contact them on your behalf?

> All the funeral director would have to do is ask if the deceased had any social media accounts and do you want me to contact them on your behalf?

This would make a great plot for a novel, a disgruntled funeral director starts "killing" people digitally by marking various accounts permanently deactivated after death. And thanks to advances in genetic engineering, even showing up in person isn't enough to prove they're who they claim to be anymore, so they can't drive, work, buy anything, or communicate with anyone.

I dig this, and want to have a crack at a short story for it. Do you mind?

LastPass seems to have a decent system (thankfully I haven't needed to test it yet):

1) I set an "emergency heir" contact

2) They can request access at any time

3) I'm sent an email notifying me of the request

4) If I don't deny the request in X amount of time (custom, I think), they are granted complete access to my account

Granted there's a potential for abuse; but that's somewhat mitigated by only allowing 1-2 people to make the request and if someone already has access to my email they can cause all sorts of other trouble without having me declared digitally dead. It shouldn't be hard for Facebook to implement something similar.

That's exploitable. Hack the heirs email, wait until you are on a holiday, hit them with a request for access. You won't respond in time because you're climbing Mount Everest or diving in the Marianas Trench (the heir might really be a heir in either of those scenarios) and then access will be granted.

All systems are exploitable given enough time and effort. At that point they may as well just"hack" the actual account owners email.

In cases like that you'd set set the time window to be longer than you expect to be off the grid.

Granted it is a slightly larger attack surface but it relies on 1) knowing the heir (wife, parent, child, friend) 2) gaining access to their email 3) Relying on the original owner having an inadequate time window 4) the owner going somewhere they are completely cut off from the world. It could happen, but that's a vanishingly small opportunity.

You’re going up Everest? Cool, change X to 40 days.

No, you'd have to hack the heir's LastPass account.

Also, as others have mentioned (including the parent), the length of time is customizable as well.

Or you could just skip the middle man and hack the target's last pass account.

Anything can be exploited if the criteria for exploiting it is somehow breaking into an arbitrarily secured network/facility.

I have mine set to 30 days (maximum).

Honestly, If I'm in a situation where I'm without internet for 30 days its involuntary and I'm fine with releasing access.

Why? Why is the priority to shut down an account? That should not be what is important.

And yet my friend who actually died, and whom I've sent them multiple obituaries profile is still up like usual some 5 years later.

The easy way to fix this is to contact Facebook and declare Mark Zuckerberg deceased, no?

> widow

To be picky, I recall the article saying "partner" in that they were not legally married… not that it takes anything away from your points otherwise.

I've noticed in the last few years that many Europeans use the word "partner" even if they're married. It seems to be part of the Euro version of being over politically correct.

How is it "over politically correct" to use the word partner?

s/politically correct/respectful/ usually works well, and shows that people using the term intend disrespect.

But in this case, I think we are just maintaining privacy. You don't need to know whether I'm married or not, or the gender of the person.

I use the term "partner" because I'm in a civil partnership. Same legalities as being married but without the terminology and ceremony, not to be politically correct, respectful, or to maintain privacy.

So it depends on where you're from, partner could be the legally correct term as opposed to just meaning "significant other"

Not politically correct at all. I'm marrying my partner next month, she'll still be my partner. The 'wife' bit will be for formal conversations. Much as my son is actually my son despite him being from another father, i'd rather not dick around with clarifications when it's no concern of anybody else what our legal status is when compared to our actual relationship.

I'm European; I think the word has a little different meaning here than it does in the USA. It has nothing to do with political correctness. It's common (in most European languages including both Slavic and Latin ones) to call your girlfriend a "partner" here. The word means that you're in it together ("business partner" is also used, BTW), whatever it is; when your girlfriend becomes a wife, she still is your partner (or at least you hope she is). Sometimes the word is used to empathize that he/she isn't just "some random" boy/girl friend and that it's a long term serious relationship.

It's got very little to do with political correctness at all, "partner" is a word that can be used as a fitting translation for married individuals in many european countries.

I don't understand what that has to do with political correctness.

Declaring you deceased, even to a corporation, sounds like a serious crime.

In this wild world of get killed by a swatting, having someone assassinate your FB profile is small potatoes.

Another reason to not trust FB.

Being dead in India is very "popular"

Reply on news.ycombinator.com