Hacker News Reader

Comment by 0x_rs | Hacker News Reader

Welcome to the automated account suspension age of the internet, where companies shoot first and don't care later, as the amount of false positives is not worth putting any meagerly (if there's any already) real, physical support to resolve. This can apply to smaller companies too, for other but equally pricey reasons. The amount of fraudulent activity attempts online may warrant those aggressive measures from their business perspective (that are also not limited to passive data collection, but taking active steps such as scanning targets' ports [0]). Unfortunately, if you live in certain areas or are forced to use mobile networks, with IPs constantly refreshing multiple times a day, major services can be almost unusable, and the user may not even realize the reason why. Some—for reasons I'm not knowledgeable about—do it better than others, but it may simply be about the resources put into it and the amount of risk a miss could amount to.

0. https://blog.nem.ec/2020/05/24/ebay-port-scanning/

View on HN

> Unfortunately, if you live in certain areas or are forced to use mobile networks, with IPs constantly refreshing multiple times a day, major services can be almost unusable

Here's a handy list of valid uses for IP addresses:

1. Packet routing.

I'm okay with very short lived IP bans to fight DDoS attacks. But yeah, that's about it.

How am I to remember all that? I need a mnemonic.

Just remember the handy acronym "PACKET ROUTING"!

It's right there at the start: I. P.

The should make a movie in which a person gets expelled from society because of a bug. In his long quest for his reinstatement, he needs to endure the great corrupted algorithms trying to erase him for good.

I give you "Brazil" (https://www.imdb.com/title/tt0088846/)

edit: typo corrected, thanks.

"Brazil"

one of my all-time favorites! ...aaand this is my receipt, for your receipt.

Love it. The "studio ending" makes it even more Orwellian, to the point I wonder if they did that on purpose. (Can that much competence be true?)

Wonderful movie, but good god is it long and hard to watch at times

So is life

Settle down Nietzsche its going to be okay.

Exactly, the first thing that comes to mind.

Alas, watching Gilliam's other films gets more and more difficult, even though he tries to make the same movie again and again, for almost forty years now. But ‘Brazil’ was a home run on the first attempt.

Yes, Time Bandits was just an attempt to remake Brazil. So was Imaginarium. /s

‘Time Bandits’ was before, so it's the other way around.

Besides, you might be unfamiliar with the fact that Gilliam referred to ‘Bandits’, ‘Brazil’ and ‘Munchausen’ as a trilogy about the same thing. Which trilogy evidently ended up having at least nine films in it, excepting ‘F&L’ and me having not watched ‘Quixote’ yet (the latter's theme obviously follows the rest, though).

As for a full-on remake: that's ‘Zero Theorem’. I can only guess that Gilliam lost hope in the subtler approach, and wanted to have at least something new that would get out of ‘Brazil’'s shadow. Which didn't work at all.

Perhaps Tom Stoppard is the missing ingredient.

Thought we were better than doing /s here.

In this case, it's a shorter version of "here are counter-examples to your assertion".

Brazil is pretty much that movie if you haven't seen it already.

https://en.wikipedia.org/wiki/Brazil_(1985_film)

This is why I named my son Droptable Stuxnet.exe Null

And from here we go on to https://xkcd.com/327/

Kafka explored this in great depth, albeit in analog form.

I don't think I fully appreciate the assignments to read Kafka in college until these algorithmic bans, ousting from app stores, automated support, etc came along. Before that I figured the human element could, in most cases even if it required extreme difficulty, sort things out eventually. Then came these heuristic algorithms that have practically become the platonic ideal if Kafka-esque systems.

Edit: While Amazon is very far from perfect and has dropped several notches in customer service, I will say that they are still very good compared to others. I can still get ahold of a real person that has some leeway for professional judgement when addressing a problem.

I agree with you fully - it was hard to understand Kafka (as a student) until presented with half a life of examples from society.

This is basically what I think of everything I read about in English literature class in high school.

You're asked to comment on so many things that you haven't heard of. 19th century English class anxiety, extreme poverty in London, slavery and race relations in America, midcentury dystopias (global) and unreasonable justice systems in central Europe (?). All things an ordinary Scandinavian teenager at the end of the 21st century is not going to have a whole lot of perspective on until they've lived a little bit longer.

But then when you have lived that little bit longer it makes sense, and Kafka is probably the one that will come closest, having travelled quite nicely into the modern world and having a corporate version that most people will run into. Next is the dystopias that we see on the news but don't recognise when living in.

I've yet to be able to reach a human at Amazon about counterfeit items sold on the platform, and my 15+ year old Amazon account was banned from leaving reviews after I left a bad review on an Amazon Basics purchase of a surge protector that didn't do what it was supposed to and fried some of my electronics.

Yes, I would have guessed that complaining something is sold on the platform wouldn't get you very far, that's way outside the range of a typical customer support rep. They have a place to report IP infringement, and I suppose counterfeits would come under that umbrella, but it's for the rights holders only to use. Not customers who might have purchased one or noticed one listed.

For standard run of the mill customer support they're still pretty great. I was shopping for new wireless earbuds last fall and tried out a few different ones. 2 of the 3 were defective and I didn't like the third-- they hurt my ears to wear them.

For the two defective ones, I'm not sure why but the normal return button wasn't available and I had to go through chat support. I explained they were defective and I wanted to return them. They told me they'd issue the refund, no need to actually mail them back, so I didn't have to go through that hassle. And these were high end ear buds, a total of $400 worth of tech.

I have on of the not-sought-after Horowitz and Hill CE (counterfeit editions) [1]. Amazon was like, "lol, that was a marketplace purchase, no refund!" even though I just clicked "buy it now, prime shipping!" from the main product page.

Amazon sucks. It should be broken up.

[1] https://artofelectronics.net/the-book/counterfeit-editions/

Do you expect customer service representatives to evaluate your legal claim?

I expect them to listen to my non-legal-code claim of "this is the wrong product".

What a weird assumption.

I expect them to at least collect the information that I received, or suspect I have, a counterfeit item, when I go for a return. They don't even bother to do that.

While we're on the subject of Kafka: I've recently listened through an audiobook of ‘The Process’, and it turned out to be a new edition. Because apparently the original order of the chapters is not known, and Max Brod took some editorial liberties—so in this new recompilation, at least some semblance of a logical ordering is attempted.

It's important, though, to not listen to the introduction for too long, because it gives away the ending.

Not when it comes to an account ban. You become a pariah to support lines.

And there’s no shortage of real people defending this behavior because “they’re a private company and they can do whatever they want.”

So, if I run a website, or a service, and there are people who abuse my service, and I can't take actions to protect myself and my other paying customers...I should be forced to allow those malicious actors an account and do what?

You can ethically take blocking actions just fine if you allow for due process. The mere existence of bans is not what's being criticized. (Though I'd say bans generally shouldn't be lifetime either.)

This hypothetical glosses over an essential missing element. The site owner is in control of gating who enters into a transactional relationship with their site or service.

Offering a false dichotomy between "be forced to allow those malicious actors an[d, sic] account" and "take actions to protect myself and my other paying customers" that have adverse impacts (many times with severe monetary damages) is externalizing the cost of poor gating control in the first place in the pursuit of pumping up subscriber numbers chasing the next funding round or quarterly call to brag upon. This is similar to financial services institutions flailing around "identity theft" to cover for gating control of their transactions implemented in pursuit of transaction liquidity over security.

Both take the externalized costs out of customer hides as both uncompensated time and monies spent to make good on unwinding transactions, and in making the aggregate customers pay for the direct costs of fixing the problematic transactions on the way, way back end. Both are a result of implementing poor security practices.

Both also will not scale to the coming era of hyper-converged global financial services. First mover advantage accrues to the one who fixes this challenge at the front end where they gate the transactions, cutting out the majority of the costs of fixing this on the back end after the transaction has been compiled and deployed into production so to speak, not coincidentally speeding up settlement, increasing liquidity, and grab the significant network effects that come with establishing such an infrastructure.

Not to mention that there's a significant difference between just some website and a trillion+ dollar company with significant monopoly power in multiple markets. Being banned from Google or Amazon is simply not equivalent to being banned from commenting on some travel blog.

Talk about missing their whole point.

This is basically a digital version of Kafka's The Trial, and is just as aburdist because it kind of really happens

Not exactly what you describe, but I saw this in theaters and thought it did a great job of showing the horrors that these humanless systems can create.

https://www.youtube.com/watch?v=fnbDNv3uAl0

https://youtu.be/EvyiWg3qCPw

There is an element of this idea in The Net (1995)[0]. A computer programmer finds her life has been turned upside down by a hacker after she accidentally uncovers a conspiracy.

[0] https://www.imdb.com/title/tt0113957/

Not quite what you describe, but in this short film Utopia, similar themes are explored - exclusion from society due to non-compliance with the "digital lifestyle."

https://www.youtube.com/watch?v=vJYaXy5mmA8

Stuff like this is an example of the failure of the market, because it's market wide and it's not like a service that actually puts labor into handling cases will find an advantage in the market and thus there is no incentive for it. This is a place where regulation actually makes sense.

My company avoids Google Cloud and uses their competitors for exactly this reason - it's a business risk to depend on Google for anything.

On the consumer side it would be hard to market the advantage though because everyone thinks it won't won't happen to them (and as long as they are average enough, it probably won't), and the cost of being banned from eBay is not that big if you're just a casual user.

Thanks for posting this article. My mind is completely blown. I just have one question for those reading this.

>> so it’s possible that eBay has been scanning customers’ computers for almost seven years without too many people noticing.

Can't one check the archive.org for signup.ebay.com & verify this? Saying ebay has been port-scanning for 7 years and proving so, would be a much stronger point. Surprised the OP did not check.

I wonder if you can, under GDPR, request that all your data is deleted and then create a new account. Not allowing you to create a new account could be argued as a violation of GDPR as it would mean that they kept personally identifiable data about you.

This is what I was going to say. As an American, I have no recourse in these situations. Europeans are fortunate to have governing bodies with at least some teeth. Not sure how that applies to UK citizens post-Brexit, though.

They have the UK-GDPR now.

https://www.cookiebot.com/en/uk-gdpr/

> As an American

A bit over 10% (and probably somewhat higher than 10% on HN) of Americans do have something like GDPR. California Consumer Privacy Act. I'm not including Colorado, Virginia, or Utah because I'm not sure how equivalent their laws are.

> This is what I was going to say. As an American, I have no recourse in these situations. Europeans are fortunate to have governing bodies with at least some teeth. Not sure how that applies to UK citizens post-Brexit, though.

GDPR applies to all individuals in the EU, not just citizens.

If I were trying to be sneaky, could you create a series of hashes of the name/email/address/bank type of info to stored on GDPR deletion request that could then be checked against any new account creation? Since the only data stored after deletion would be a hash with no PII remaining, is this a viable workaround?

If you can use hash to identify someone then its pii by definition

I do not agree. The identity can be extended with some GUID and then hashed. The GUID and hash can be kept, but the identity discarded. Then the original identity is lost, but if encountered again, it will be known that it was previously seen.

It's not clear to me how from a privacy perspective that's different from the hash of an id.

It's different because a hash of the ID can be used by anyone who knows the hashing algorithm. If the ID is combined with a UUID/GUID and the UUID/GUID is kept secret/isolated by the entity doing verification, then nobody else can make use of the hash, even those within the entity organization who do not have access to the UUID/GUID. The UUID/GUID itself is not PII so it can probably be retained without violating the GDPR. The same goes for the hash. And since there is no way to reconstruct the original ID given the UUID/GUID and hash, there should be no GDPR violation.

In a large entity such as Google, you almost need to outsource ID verification to ensure it's not abused by other (advertising/marketing) parts of Google. Of course all of this requires good faith on the part of the implementing entity, which is certainly not guaranteed.

>but if encountered again, it will be known that it was previously seen

But when you see it again you have personally identified the individual have you not? Doesn’t that by definition mean it is identifiable if you are able to determine the identity later?

This is something that advertisers/supermarket points schemes etc used to do when they didn’t have consent to share personal data, hash it and align it with what they already had so effectively they shared the subsets of interest anyway. I remember at university when some guys from yahoo sponsored a hack event, they literally gave a guest lecture boasting about doing this with Sainsbury’s to squeeze through a legal loophole back in 2013.

That's the fun of thought experiments, the rabbit hole just keeps going.

If your original delete request was followed so that everything they knew about you was deleted, they would not be able to relink everything that GUID linked to. It should be gone now. However, if that hashed value lives in a BANNED_ACCOUNTS table, then all they have to do is create the hash, check the table, disallow new account. You can even do it in good faith by not storing any of the new info rather than storing it and forcing a new delete request.

Not really, as GDPR is not only about screwing up big companies. Certain kind of data must be saved by companies (like financial transactions). You can request the deletion, but they are still allowed to save some of the data.

Is this a way around Reddit bans?

Generally, no.

GDPR specifically carves out keeping data for "legitimate business needs" including fraud prevention and so on. Whatever data Ebay (thinks it) has about this person that they are using to enforce the ban would be data that they would argue falls under this clause.

This is circular. If there was no reason to ban him then keeping the data for fraud prevention purposes obviously doesn’t hold any water.

keeping information for the purposes of enforcing rules and bans is explicitly allowed in GDPR and you are not forced to delete it. (similarly, you can't ask a company to delete all the stuff you've bought and sold them from their accounts)

However many companies are sufficiently scared of the GDPR and potentially keeping data they shouldn't accidentally that they will just delete everything about you. You can totally use that to get the 'new customer discount' again at Uber for example...

Contrary to popular understanding, the GDPR does not allow you to force a company to delete all data about you.

In effect, it lets you revoke your consent for the company to store and process your data. But it also provides for cases where your data can be processed without your consent. It's not an unlimited carte blanche, but fraud prevention is explicitly given as an example of a legitimate purpose.

This is correct.

Businesses are allowed to retain information necessary to operate. Which would include things like names, email addresses, IP addresses, etc of people who are banned (to prevent them from returning).

If GDPR required a company to delete everything, it would be impractical. (E.g. imagine you request a company delete your info, and then you immediately sue them for something that happened while using their product/service… the company wouldn’t be able to defend themselves unless they retained a record/logs of your usage.

You can submit a deletion request, but in most cases much of your data won’t actually be deleted.

> Which would include things like names, email addresses, IP addresses, etc of people who are banned (to prevent them from returning).

I'm not sure about that. The company might reason it needs this data to operate, but you should be able to contest that with a data protection authority.

The data that you can not request to delete is for example money transaction data, which the company has to retain for 10 years or so due to other laws.

Curious - has anyone here submitted a complaint to a data authority? I wonder what that process is like.

I have. It was about a company that kept spamming me with SMSes. I had to file an archaic form for a government agency. It took a while, I received a few emails about progress and asking for additional details.

The spam stopped.

Thank you for the hint. Will do that.

I was banned the same way as the OP, few months ago. They(humans)collected my Id, bank details, personal address, original invoice of the items I was selling, some calls, to finally ban my 15+ year user.

Keeping that data to maintain a ban seems self-evidently in the space of "needed for the health and operation of the service."

At the very least, I'm sure eBay lawyers would be happy to argue the point.

Also, under the GDPR, you may have the right for any solely-automated decision making about you to then involve a human:

https://ico.org.uk/for-organisations/guide-to-data-protectio...

Mind you, there's nothing to stop eBay from having someone now look at your data and go 'nope'.

...or claiming "yup I looked"

Under GDPR, a company may retain personal data if it has a legitimate interest in doing so. To what extent this applies here, I do not know.

You might have a chance to successfully challenge the termination by legal means, if you actually did not violate Ebay's terms and conditions.

"For fraud prevention purposes" is a legitimate interest, so the probably won't work.

Keeping PII for fraud detection is not barred by GDPR.

In this context the more relevant aspect of GDPR, which I think receives too little attention and more so enforcement, is article 22 (Automated individual decision-making, including profiling)

Love that idea.

They probably check an external list upon account creation. If the ban had to do with KYC (Know-your-customer) and the user is on or unintentionally confused with a banned entity, then it doesn’t matter.

that's wrong, they are allowed to keep some data

No, fraud prevention is one of the widely accepted reasons for data storage under GDPR.

Similar thing happened to me with Offerup - which is MILITANT about not using VPN's.

They banned me and no recourse/way to appeal.

I even sent them a physical letter without much luck.

Pitty, I loved the app, but stopped using it due to their unnecessary/strict no-VPN rule.

This is why niche products and small businesses can succeed

The value of an auction site relates to the number of users it has, so it's difficult for a competitor to appear and dislodge it.

Reply on news.ycombinator.com