Hacker News Reader

Comment by martin_a | Hacker News Reader

> But there are plenty of Google engineers and good helpful people on Hacker news.

> (from a screenshot) I work at Google [...] so I escalated your issue [...]

> I believe the HN thread getting on the homepage tremendously helped me and somebody from Google saw it and expedited the review after all

So, once more an issue with FAANG could only be fixed because somebody knew somebody else and went out of his way to get this to the right eyes.

This could easily have gone another way and OP would have received no help whatsoever and would have waited for days or weeks to get this issue cleared and lost his business.

Maybe it's only me but I find it unbearable that you'll usually not be able to reach any real person at all for issues like these and it's pure luck what happens to you.

View on HN

I can't access my 13+ year old gmail account because Google now requires I verify I have access to a phone number I've never owned. There is no 2FA on this account, I know my password, and have access to the "Recovery Email" (which gets emailed a "Somebody knows your password" warning whenever I attempt to sign in to the account with my password).

I reached a real person at Google Domains and managed to get things escalated to "Specialist". Their response: "we can't help you, post about it on the community forums" (which I had already done 20 days prior).

This account "owns" digital goods, thousands of songs, and many domain names. Google is actively stealing these things, but they don't care and, "can't help".

Have you considered calling the number tied to the account and asking them to help?

IIRC only the last 4 digits of the phone number are shown.

They only show the last two digits of the number. And I've only ever had two phone numbers in my life, and neither of them end with those digits.

Plus it is always a bad idea to give someone a code sent to your number. 99% of the time someone is trying to hack you and a necessary step is obtaining that code.

For me that actually ended up the only way to gain access back to an old account of mine. Luckily I was able to cooperate with the new owner of the number, and he was helpful enough to give me the code that was sent, otherwise I'd have lost a Google account with several hundred euros of purchases on it, despite having the password, control of the backup email, knowing all security questions, and knowing the exact date the account was registered (the only issue was that mobile carriers here re-issue phone numbers after 6 months without any calls, and I had put the SIM into a tablet).

The obvious issue with this is that the new owner of the number doesn't actually know if it's the owner of the old account trying to sign into it - it could be anyone trying to take over an account whos owner forgot to change the number for. And how do they know you're not trying to sign into their account? The text messages don't specify which account is being attempted or anything.

That's actually the big issue — but if you can meet with the person, and do the whole process IRL, it's much less risky.

I'm in a similar situation with Apple. I can't access my 10 years old account even though I know the password and control the email attached to it because I don't remember my security questions and I don't have my recovery email anymore. I probably put rubbish data in the security questions as they weaken the security of the account.

Funnily enough that password leaked and someone managed to take over my account (I wonder how they manage to bypass the security questions, sounds like a security vulnerability on Apple) and they're using it to register (I assume) stolen devices and install software. I get email notifications every time these people do something.

I reached Apple support but they're unwilling to help, they even refuse to nuke the account as a last resort.

I actually have the same issue with my Apple account I used back in the ipod days; they are now requiring that I answer my security question during log in. But I actually don't remember the answer to the security question, as I used to always put gibberish instead of a real answer. Back in those days these questions would only be used to reset your password, and I was confident I wouldn't forget the password. I've given up on getting that account sorted.

Furthermore, the answers to security questions aren't always stable. "What was your first pet?" Well, I know how I answer this question because one dog in particular I sort of consider my first pet. But I can remember dogs we had before that one so my answer is a somewhat arbitrary one.

By answering honestly, you also run the risk of having anyone that knows basic facts about your life being able to really make your life difficult.

It isn't just people you cross paths with that could get into those accounts, it's scammers that want to social engineer you or have access to the numerous database leaks that are accessible to anyone with the Tor Browser installed.

The answers to security questions are essentially passwords themselves, and they should be treated as such.

It's none of anyone's business! I generate one password for the password and a second password to break into 4 char random chunks for the security questions which I record in "notes" of the password manager.

Meanwhile, in practice, when I had to do a brokerage transfer a couple months back virtually, the brokerage had a long list of security questions that they had apparently assembled from various credit reporting and other sources that I had to answer to make the transfer. The identity of my first pet or my city of birth is simply not a big concern of mine compared to the information widely available on me from all sorts of sources that I have no control over.

> I'm in a similar situation with Apple. I can't access my 10 years old account even though I know the password and control the email attached to it because I don't remember my security questions and I don't have my recovery email anymore

I have an iPad that I let sit on a shelf for a while. During that time, Apple deleted the Apple account it was signed into. As a result, I cannot unlock the iPad or use it at all. I even made a new Apple account using the same username and password in an attempt to unlock it. No dice. Apple support won't help.

These sort of problems are so aggravating and seem to take a disproportionate amount of mental and emotional energy to the problem. I'm not exactly sure why, either. Perhaps it's because trying to explain the issue to anyone else (support, spouse, etc) and catch them up on where you are, what the issue is and what's been tried already takes so long and then in the end that person is powerless to help. And to make any progress forward you have to be relentlessly tenacious and still the problem will fall on deaf ears.

It's like the system is built against you to just force people to ultimately run out of steam trying to get it resolved and give up.

>I probably put rubbish data in the security questions as they weaken the security of the account.

I had a similar problem, where I had created an account so long ago there were no security questions. They later added the security question requirement, but since I had never filled them out and they refused to accept a blank answer and I was forever locked out.

> I reached Apple support but they're unwilling to help, they even refuse to nuke the account as a last resort.

I wonder, aren't they required to nuke the account under GDPR? It's probably tied to your real identity.

I was in a similar situation 3-4 years ago. The app store kept asking for answers to my security questions which I did not remember to have set up, ever. I went various rounds with their phone support trying answers on the phone (there are only so many reasonable answers for "Who was your first manager?") to no avail. Then I just enabled 2FA and the security questions requirement went away immediately. Back then, the whole thing smelled like a bug on their side to be honest.

I had one recently where I was locked out of my medidata/Rave account for not knowing the answer for "Who was your best friend in 4th grade?" I seem to recall that I had a lot of different friends in 4th grade, and it was also blurring with crossover to 3rd and 5th grade etc.

After spending hours on hold and escalating through the support, they finally unencrypted my answer and told me what it was and I had put our cat! Totally did not remember that. Since then I've started paying attention to the questions I select when I set up the passwords and trying to idiot-proof myself to something I will actually remember in 7 years, not trying to be clever in the response.

As a bonus stick you in the ribs "revenge," when I finally was able to get it reset up and log in, I was gobsmacked to see that the customer support reps had assigned me mandatory extra remedial rave training to be completed before I could access the functional areas of the software! Lol. Touche.

Not useful for your current case, but I recommend using a password manager to fill random phrases for security questions. That way they’re easy to read out over the phone to CS reps, but are more secure than literal answers, which can often be derived from publicly available info.

Is there a password manager you recommend? I've never used one. Ty!

Have a look at bitwarden [0], it's open source and has a free tier.

[0] https://bitwarden.com/

Same thing with my Skype account. I have it logged in on both my phone and my laptop. One day it decides to automatically log me out on both and when I try to log in it insists on requiring sending a code to a phone number that I no longer have access to. So just like that I lost access to my long time Skype account even though I know the password, even though there's no 2FA setup, even though I'm trying to log in on 2 devices that I've logged in previously, from the same IP address. All support requests went nowhere.

I wonder how many people lost their account like me because of these overzealous security measures.

> This account "owns" digital goods, thousands of songs, and many domain names. Google is actively stealing these things, but they don't care and, "can't help".

I long for the day that they cross the wrong person with means to take them to court over their negligence.

My very-much-not-a-lawyer understanding is that their legal obligations and liabilities are minimal on account of Gmail being offered free of charge. Anyone know if that's true?

> This account "owns" digital goods, thousands of songs, and many domain names.

It seems it's not only about a free Gmail account.

Its the terms of service users agreed to. Prices not relevant

That doesn't sound right. If you charge money, you have to deliver a product that's fit for service. You can't take people's money then refuse to deliver.

At least here in the UK, EULAs that say You have no recourse if we completely fail to deliver are generally disregarded in court, as it should be.

But this scenario is neither a refusal or complete failure (debatable). But again, the terms of service are more important than the price factor.

The big G say they can kick you off whenever/wherever.

That it's free in price is just another way to give the "customer" (really just user) less power.

Not true.

Say I offer my front yard for anyone to use for free.

You come and set up a bbq stand to have a picnic with your friends. You walk across the street to a lemonade stand, and when you return, you're confronted with a security guard who won't let you back into my yard.

You demand entry, saying your property is in my yard. You want to speak with me, but the security guard says you can't do that. What you can do is head over to the town square and ask if anyone there knows how you can regain access to your property.

Google incentivizes and encourages users to entrust and entangle important, and often financial, aspects of their lives with Google's services, and in exchange, Google gets to profit greatly by mining their data. They also charge users money for many of their services, too.

I can't access my flickr account because it's tied to a Yahoo account which won't let me access unless I know the 2nd Yahoo account email address 2fa which is blurred out and yahoo won't let me access it because it's been locked even though I know all the info.

Flickr is no longer associated with Yahoo. It's owned by Smugmug. Even if you can log into Yahoo that probably won't give you access to Flickr any longer. (Smugmug also cut back significantly on what Yahoo provided for free accounts.)

Same thing happened to a Bitbucket account of mine. I know the email and password, but the primary email is under a domain I lost access to. At some point, Bitbucket decided I needed to verify my email in order to sign in. Support was utterly unhelpful.

The worst part is that we are just conditioning people to accept this as normal. Just like EULA and cookie banners.

It's always the same story. Some guy gets on Twitter or HN who happens to get noticed, then FAANG releases a statement saying they made a "mistake". Mistakes in the aggregate that affect millions of people aren't "mistakes." That's deliberate malfeasance at scale.

Funny they never ask you that design question in interviews. "Design a system which will harm at most 5% of your users while scaling up to billions of people." Maybe if more people understood the sobering dark side of scale, they would stop gleefully promoting runaway scale-at-any-cost engineering.

Just kidding. Profit is God.

I'm also reminded of the dystopian movie Brazil. You're always at danger of getting eaten by the bureaucratic machine today, with only the most absurd recourse available. Just read the passive indifference of the email that Google sent this guy. "Google has received and processed...", "Google systems indicate...". This is one shit dystopia are are living.

Upvote for Brazil! Great movie, Gilliam is a genius, so good. https://m.imdb.com/title/tt0088846/

This is really feudalism replayed.

If you know important people at the emperor's court, you have a chance to get yor problem solved.

It's not "feudalism", it's human social relations and power dynamics.

Democratic societies try to limit this problem by establishing some semireliable channels to remedy injustice, though.

I don't think anyone considers this to be in the realm of injustice.

Anyone? That is a strong word.

At least I would consider losing an important asset based on a whim of an algorithm without a possibility of appeal to humans quite a gross injustice, though within the limits of the law as it stands today.

I do consider it injustice, in the everyday sense of the word (not legal).

It's definitely in the realm of injustice; how could it not be?

It's not "power dynamics", it's freedom to innovate

What if his post had not been seen or he didn't know HN. Google etc are the gatekeepers they decides what allowed and what isn't.

Unregulated power dynamics are basically feudalism. (Well, feudalism put in some regulations...)

Not really just feudalism. But how most parts of the world work

A secret set of rules, a single party that is the judge, jury and executioner, an opaque resolution process that involves backchannels rather than merit, and no oversight ? Is that really something to accept as inevitable ?

Yes, networking is inevitable. Transparency and accountability are hedges against this, but incentives aren't there short of some sort of massive public pressure.

Massive public pressure means.... sounds like legislation to me.

Yes. It’s literally called “The Iron Law of Oligarchy.”

It’s really not, least of all because feudalism didn’t have emperors.

What? Even if we ignore China or Japan, the existence of the Holy Roman Empire overlapped that of feudalism in Europe.

The Holy Roman Empire was pretty much prototypical for feudalism and definitely had emperors

Dark ages Europe wasn't the only example of feudalism in history.

Definitely seems like a class system, you’re either above the algorithm or below it.

This gentleman had a similar issue where his site was taken down without explanation at youtube. I intervened certain that we just needed to light some fires and get a human to look at it. He never got back into his account and to my knowledge never got a reply that was not a canned response. https://www.linkedin.com/posts/mohammedadam24_cybersecurity-...

This is the norm with FAANG and it really annoys me. How many of these cases never saw the light of day because of that?

Even with HN it's a complete lottery what contents reaches the front page, so getting issues like these resolved is a matter of extreme luck for a common person.

Probably naive idea: Would it be possible to set up an insurance fund for this? As in, the money would be used to sue FAANG for damages in cases when businesses are lost due to them being flagged/blacklisted by FAANG incorrectly.

If enough companies contribute to this, it might put some pressure on FAANG to take things seriously.

Another idea is to stop supporting FAANG.

Apple or Google won't see a cent from me.

Do you not own a smartphone?

You're not the only one who finds it unbearable. Google acts like they own the internet. They cause massive damage to people and businesses when they unilaterally block them. They compound that damage by refusing to resolve the issue unless people somehow manage to reach some insider.

>Google acts like they own the internet

They kind of do

That quote is from an 8-year-old comment: https://news.ycombinator.com/item?id=5972927.

You're right, didn't look closely enough to see the timestamp. Saw it in the screenshot in the post and thought it was a recent comment.

I did too at first.

Isn't that how life works?

Reply on news.ycombinator.com