Hacker News Reader

Comment by shoeshoeshoey | Hacker News Reader

FB had an internal help system called "Oops". It was meant for employees to get help for friends they knew in real life. It was discontinued not long ago (EDIT: maybe not according to a child comment). There were just too many requests for help.

Facebook has a corporate structure that simply will not prioritize any effort longer than 6 months unless a senior company executive (Mark, Sheryl) supports it. Even if it affects the bottom line - and there were plenty of examples where large customers could not spend significantly more money with Facebook because of software bugs - they won't do anything about it.

View on HN

That was literally the only way I got help after someone somehow managed to registered one of my email address under a Facebook account I don't control and tried to impersonate me. I don't even know how that was possible since FB does email verification. I tried the normal help system but got nowhere so I reached out to my friends who work at FB. One of them used the internal help system it was resolved within a couple of days. A mutual friend of ours joked that I was really using my "tech privileges" and he was absolutely right. I would have had to deal with a FB account pretending to be me for a while if not for the fact that I live in Silicon Vally and have a lot of friends who work for FB. It really shouldn't have been how that matter was resolved.

Whenever someone's used my email address, I've used password recovery and taken ownership of the account.

It's amazing the number of systems which don't verify email before giving out an account.

I've taken control of:

Disney

DropBox

Redbox

...

Apparently Virgin Mobile doesn't verify email addresses nor does it let you reset your password by email. I assume they send you a text or something. So I've been getting billing notifications and other garbage for someone else's account for years.

My email address is temporal at gmail.com. "Temporal" was my teenage gamer tag. It also turns out to mean "temporary" in Spanish. Ever since the Spanish-speaking world started using gmail, people have been signing up for stuff with my e-mail address every single day. Any new service I want to register an account with, I first have to hijack the existing account holding my address and delete it or change the email address.

But it gets worse!

Someone working at AT&T Mexico apparently decided to start entering my address as a placeholder when signing up customers that didn't have one. So I started getting phone bills -- with complete call histories -- for people all over Mexico. After several unsuccessful attempts to contact AT&T, I set up a filter to delete them.

Once a Spanish telecom did even worse, and populated seemingly their entire database with my address, so I'd get hundreds of phone bills all at once on the first of the month. I think they fixed it after two billing cycles.

Once a school in Chile made me an admin of their paid Zoom organization. I was actually unable to remove myself from their org or change the account's address, meaning I basically couldn't use Zoom until they removed me. (I'm unsure whether the school fixed it or Zoom fixed it after I made an angry tweet that went viral; whoever fixed it never bothered to follow up with me.)

The list goes on and on...

Wired even wrote an article about me. https://www.wired.com/story/misplaced-emails-took-over-inbox...

If you run a web service, PLEASE VERIFY ALL EMAIL ADDRESSES.

PS. Just now as I write this, someone in Spain scheduled an appointment for car service using my address. The e-mail contained a link to cancel the service, which I clicked. Oops.

> (I'm unsure whether the school fixed it or Zoom fixed it after I made an angry tweet that went viral; whoever fixed it never bothered to follow up with me.)

If it was someone at Zoom: getting past the company's lawyers and PR people might have been too much of a barrier to bother.

The Zoom one seems like it'd be easy to get someone's attention if being an admin means you get to add meetings for individuals.....

I got a common Hispanic name a my address is (nane first letter)surname at Gmail I receive a lot of information from many people from Patagonia to Toronto, and there are systems that I CANNOT BELIEVE what they send without confirming the account.

Worst offender, by far, is Chilean companies. Total disregard of privacy practices. Almost none from Spain (GPDR effects I guess)

It can be an attack vector, to scan for placeholder addresses and register them and start receiving email with valuable information. For example something like navy-recruiting@donotreply.com.

Having a firstnamelastname address will subject you to a truly baffling level of false accounts and misaddressed email. The worst was probably the time I got emailed an excel sheet containing the names, personal details, and logins for an entire layer of middle managers for a small banking chain.

Thankfully for me, my last name is pretty damn rare. And only a thing in one area of the world. So I can go with firstnamelastname.

At my second job, there was quite a commotion in the office one week, when my boss started receiving a steady stream of random people's CVs. It turned us a moment to figure out what's going on - turns out, there was an ad for seasonal fruit-picking work, which listed [lastname].[firstname]@gmail as the contact address; my boss had a [firstname][lastname]@gmail address, and a subset of wannabe fruit pickers were reversing address components for some reason (with the dot conveniently being an ignored character in GMail).

dot being an ignored character

Don't remind me. I spent forever trying to figure out why I was still being charged for an Xbox account I'd already canceled. Turns out Microsoft had one account with the dot and one without.

> Having a firstnamelastname address will subject you to a truly baffling level of false accounts and misaddressed email

First initial and last name it even worse. John, Jonathan, Julie, Jacob, James,and more all start with "J." I've gotten rental agreements, investment reports, appearance contracts, song demos, family pictures (not my family), and more.

Hell I add my middle initial too and I still get a remarkable amount of mail from people who don't even have the same middle initial.

> Having a firstnamelastname address will subject you to a truly baffling level of false accounts and misaddressed email

You're so right.

This is a big reason I'm looking forward to Apple's iCloud+ custom domain names. Outlook.com already supports custom domain names for paying customers in a very limited way, but hopefully Apple's move will light a fire under Gmail product management to offer this, perhaps through Google One.

Google supports custom domains for Google accounts, I've been using it for years.

https://workspace.google.com/pricing.html

Google's support for custom domains is strictly for Workspace (formerly GSuite) customers. It's analogous to Microsoft 365 business plans[1].

Other providers are moving beyond this, i.e. offering custom domains to a wider set of (paying) users. Outlook.com already supports this in a limited way (domain must be with GoDaddy, kind of silly), for Microsoft 365 Family and Individual users. And Apple is apparently going to offer it to everyone as part of iCloud+ too.

Not everyone needs the full Workspace offering. In fact Google has Google One for exactly that kind of customer, and a custom domain name would fit neatly into the Google One proposition.

[1] https://www.microsoft.com/en-gb/microsoft-365/business

I seem to share a name with a beef farmer in Australia. I get regular emails about prime Aberdeen Angus sperm I can buy, and once I even got sent details of his farm financing with an Australian bank.

I received a 1500€ quote for urinals and "bio boxes" (?) in Belgium just yesterday. Two weeks ago I received a boarding pass for the next day for a Spanish island. I think the worst is that since I share the same name, I imagine I could have used the boarding pass.

Are there any legal risks or ramifications for doing this?

CFAA, for one.

The question is whether using someone else's email address is equivalent to an implicit grant of the account to someone else's control.

I doubt it. What if it's a typo? There are at least 3 people who I get emails (and bank statements) for in my first.last@gmail.com address, and from what I can tell it's because they dropped the middle initial when signing up or the person mailing them did it manually and messed it up.

And because Gmail treats that dot differently else I have some interesting cases like where I have 2 Instagram accounts under my email, one with it and one without, and it's not always clear which one the email is for until I expand the details. I have been tempted to log in and shut these down, but I'm pretty sure that is illegal. However some sites require me to log in to unsubscribe or contact support so into the spam they go.

> tempted to log in and shut these down, but I'm pretty sure that is illegal

Ehh. Intent matters a lot. I'm not saying someone couldn't go after you, but as long as you weren't actively trying to make off with their data or impersonate them I think you'd be in the clear.

Imagine you got such an email and were confused. So you went to log in but couldn't. So you reset the password in confusion. That's not illegal, it's a very reasonable response to being notified of an account that you don't remember creating. If contacting the service provider fails, closing the account would seem to be the only remaining reasonable course of action. It's not your fault the service provider doesn't verify things.

...

Amazon

A few years ago my dad got an email saying he'd bought something on Amazon, using an account none of us had created. Turned out someone used his email address to make a purchase. We reset the password and logged in. It looked like a legit purchase and seemed plausible, based on the person's name (we saw the shipping location), that it could have been a mistake.

I highly highly recommend against doing this!!!! By doing a password recovery you are on the hook for any illegitimate content that the person might have uploaded/shared and might get you in real legal trouble. Instead I recommend filing a complaint without claiming the account.

No, you aren't. Certainly someone might try to claim that it had been you. Worst case I suppose you could actually end up in court but that's true for pretty much any accusation.

I doubt it would be an issue in practice though. Far more likely is that you might inadvertently get caught up in a ban from the service due to the illicit content being linked to the account you recovered which would now be linked back to your metadata (IP address & etc) since you recovered it which would in turn link to your regular account.

Also Spotify! Recently started receiving Spotify invoices after someone signed up using my gmail address.

Not exactly the same, but some time ago some woman from Texas changed her email on Netflix to mine, seemingly without confirmation.

My email address has a very particular custom domain that can't be explained with a typo, and I don't know anyone in Texas. Very weird. Netflix support was like, whatever, why do you care?

Still puzzled about why and how that happened.

The exact same thing happened to me. No idea how.

I thought all the emails were spam, until one day I realized they seemed pretty legit. I went to FB directly, forgot password, and had to use Google translate until I could switch the interface to English. I tried to delete the account, but got locked out. It took a lot of effort to get FB to delete that account.

My FB friends never once offered oops. How sad.

Any new account can use Facebook for 24 hours before email verification becomes required. This is a huge issue for any email address not linked to a Facebook account. Facebook will happily leak the social graph of that address's shadow profile (e.g. in the "suggested friends" list), and let anyone impersonate it, for 24h.

It happened to me. Those 24h were no fun.

Wow, incredible footgun you got there, Facebook

Should be a footgun, but they've never really been penalized for things like that.

Footguns are OK as long as they're pointed at other people's feet.

Well that’ll teach you to not have a Facebook account /s

Can confirm. We were a corporate account spending large 6 digit sums every month on Facebook Business Manager and Facebook randomly stopped campaigns due to intransparent and inaccessible credit line configurations, hurting not just our bottom line but theirs as well, with nobody to turn to in general FBM support.

After lots of escalation through some personal contacts we fortunately had, they switched to a system where they're apparently now using "AI" to determine the credit line every client has dynamically, which doesn't work for us as our campaigns are very big and very short (products that are only relevant for a couple of weeks, but benign, nonpolitical content if you want to ask).

Still nobody can tell us how big the AI thinks our credit limit will be at any given point in time. Finding out who is responsible for anything is a hot mess, and by now we're spending seven digits per month.

But to me, the cream of the crop is how many times we had to escalate to FB to literally beg them to be able to spend our money with them. It's ridiculous.

Sounds like Google and Facebook does not care about their users anymore.

Honestly, I don't think they've cared about users for a long-long time. And I think their lack of user support will be their downfall. It may take a while but someone will figure out a way to get tractions on their markets and when they do, Google and Facebook are screwed.

Amazon, on the other hand have amazing customer support so much so that even if you think the company is terrible on a moral level you probably still suggest it to friends.

care to share some of that business manager support? :)

It used to be you could get some level of technical support if you were an advertiser, but that is no longer the case. Perhaps if you are spending tens of millions on Facebook Ads per year, but otherwise the only support you get is a revolving door of advertising support specialists that try to convince you to use whatever advertising product is best for Facebook at the moment.

I have seen company Facebook pages automatically deleted by an algorithm with no warning and vague reasoning that there are other similar pages. There is almost zero support to help and what support is there is unable to do anything.

I need not tell this forum, but if you have a company, do not rely on Facebook as your business page. Take the time to setup a proper website and use Facebook for promotion if you must.

If you are a user of the Facebook platform I wouldn’t ever put my money into the platform in any way.

I used oops to help someone I knew several months back. It still exists and worked amazingly well.

Can you elaborate what this system does? Escalates customer support tickets for employees?

Yeah, from my time working at FB, it's basically a customer support queue that actually gets reviewed. Sometimes, there can be some additional discussion between the person looking at the ticket and the employee who reported it, so that clarifications can be made when needed. From what I saw, it's mostly used for account recovery, but sometimes used for bug reporting. FWIW, Yahoo had a similar escalation path while I was there (that seems to still exist).

This is a way to help friends and family get their accounts fixed, and also to help make sure employees don't look at their friend and family's accounts with internal tools.

I'm sure detractors would find plenty to criticise about a system to prioritise friends and family, but it's smart from a QA perspective. They get a corpus of issues that are falling through the cracks, coming from real people without an agenda.

While that’s useful, I suspect the real reason it exists is to discourage fix-it-yourself options, where an engineer may access sensitive user info to help a friend.

Or just keep employees on track. Imagine a company the size of FB having a barrage of Slack messages over family and friends with suspended accounts, trying to find who manages which DB.

Better than just not having an agenda, they're going to personally vet the requests like their paycheck depends on it.

My cynical take is that its really just there so there's less incentive for people at Facebook to push for actually functional general customer support, because Facebook would rather just ignore issues than spend money to make the user experience better.

Yes, every ticket on Oops that's found to be actionable should result in a postmortem about why the regular security & customer support channels failed.

A few of those and you'd get a mostly functioning system.

A few of those + lots of money / support headcount. Which is why it hasn't happened.

The hardest part (authenticating the request) is also done.

I'm glad people are helped. Something is better than nothing.

I also think that, a service that is focused on helping those with personal connections to Facebook employees dampens the most potent source of visible friction for the maintainers of a system that clearly has the potential to be arbitrary and oppressive.

I think we would all be better off in a world where each oops case was solved by changing the overall system - even if we also recognize that change on that scale is difficult for then the most well intentioned.

It makes me incredibly angry that I have a long-standing issue that I can basically get no support or fix for whilst you are cheering a cordoned-off system on as ‘working amazingly well’.

> Facebook has a corporate structure that simply will not prioritize any effort longer than 6 months unless a senior company executive

To be fair, many companies have some degree of this. They don't want to commit significant resources to something the people in charge don't understand.

A lot of it seems to also be around review cycles. My company has quarterly goal reviewing.

One of the nice thing about my time in government was that there were no review cycles, just a project to be done. Granted, there were many other problems and we cut corners to meet artificial (and in the end irrelevant) deadlines imposed from above, but the central project never got derailed.

The 6 month priorities are due to PSC, Facebook's performance review cycle. Work that took more than a half effectively doesn't count for bonuses or promotions and could possibly get you fired, so it's disincentivized.

Are you saying projects are highly encouraged to be completed within just 6 months?

Yes.

FB policy says they want to reward results and not effort. But it makes it hard to reward people for making progress on things that can't be done in 6 months.

It also makes for shitty service quality around the end of June and December, as people rush to push things to prod. (I've heard this may have changed, but it's hard to notice good service quality).

(Former FB employee)

It might be an interesting experiment to have each employee start their cycles (review cycle, or quarterly numbers for sales etc) on a random offset.

(This is what one should do with cron jobs so they don't hammer the server at exactly the same time.)

Compare https://en.wikipedia.org/wiki/Thundering_herd_problem

One wonders if this is why the train wreck of a web redesign was pushed out despite being... awful, and buggy as all hell.

As of 2022, PSC is shifting to every 12 months not 6 in an effort to better support longer-term projects and thinking. Promotions will still be assessed every 6 months.

Oh, I think that will be a great change for them. It especially makes sense with the new focus on metaverse.

I would be quite curious what would be possible at some companies if things could be considered beyond 3-6 months or if you could even keep the same team for that period.

I’m intrigued at all the stuff that falls off the wagon just because it isn’t a three month initiative or would need to cross a quarter to be done.

This is disturbingly similar to how criminal enterprises operate, without regard for operational expenses, alienating customers. It is like nobody care much about losing easy money.

I haven’t worked for a company that didn’t leave easy money on the table or waste money because of disorganization, except for the government which just wouldn’t spend any money except employee time.

I kind if like the idea of an SDE running an oops as a service side hustle.

Do you know if Twitter has something similar? It would be very helpful.

YouTube would be nice as well.

Reply on news.ycombinator.com