Hacker News Reader

Comment by malikNF | Hacker News Reader

Update: Just received an email from CF.

--------------

Hello,

With regard to your inquiry, we have restored the domain names in your account to active status. Please allow for normal propagation. You will need to re-add mnf90.com to your account in order to manage it. Our apologies for any inconvenience this may have caused.

Kind Regards, Cloudflare Trust & Safety

------------

Not much info lol, but guess its fixed now?

Thanks HN for up-voting my post and helping me get the attention of CF. Time to go figure-out how not to get in to this situation again, and a way to mitigate this incase the AI gets angry again. Funniest thing about this is, I wanted my own email because I was afraid of this scenario, getting locked out of everything, what happens if big G or M decide to close my account down?

Again, thanks HN. Really appreciate you folks for helping me get the attention.

View on HN

You keep framing this as "how do I make sure I don't get into this situation again," but with the attention this is getting (#6 on HN) and just how bad the issue is (both functionally and PR-wise)... Cloudflare should really do a public post-mortem here. It sounds like it's their fault.

I also want to see a Cloudflare post-mortem here. All of my domains are with them. The worse part of OP's story is that they even prevented him from moving the domains to another registar. So if this happens to any of us we're completely locked out of our email.

Which violates their registrar agreements:

> Registered Name Holders must be able to transfer their domain name registrations between Registrars

(Note that sections 3.7-3.9 do allow registrars to deny transfers, f.e. given "evidence of fraud", but given that they reinstated the domains I doubt they have evidence of fraud.)

https://www.icann.org/resources/pages/transfer-policy-2016-0...

Why does a private corporation get to unilaterally decide something is fraud and seize someone's property? Is this what ownership is supposed to be like?

You never "own" a domain. You just rent it from a registrar, who had permission from ICANN to let you rent it. There is no "good" that you can take with you when you give a registrar money for a domain.

The only way to 'solve' this problem is to be an ICANN accredited registrar by yourself as an individual on an individual basis.

Edit:- Then the problem comes from registry. So, along with being a registrar, that individual will need to become a registry recognized by ICANN

Another way to solve it is by switching to a bloclchain based registry like IPFS or nameCoin.

>There is no "good" that you can take with you when you give a registrar money for a domain.

Ah, cant wait until you understand the nature of money itself ;)

But they ('re automated system or through mistake or whatever) thought they did have evidence of fraud right, so that's consistent?

Perhaps I wasn't clear.. I mean that they sent some vague email saying it they'd detected fraud, and took other 'we've found fraud' actions (it was a false positive yes, but beside my point) - so it would be weird if they then acted like they couldn't take registrar actions that they could only take if the reason was fraud.

The behaviour was wrong and concerning yes, but it seems internally consistent, all along the 'fraud' path.

> prevented him from moving the domains to another registar

That sounds like theft to me

Theft/fraud/etc only applies to individuals. When big companies do it it's business as usual.

You can't transfer domains more than once every 60 days...so if he transferred within the last 60 no place would let him transfer out

It’s not clear if he move the registration to Cloudflare, or just the name server.

There’s a case for not having your registrar also host your DNS records.

Sorry, if my post wasn't clear. What I meant by mitigating this issue is, I am going to start looking in to other providers and escape routes if I anger the all mighty AI again.

I too am really interested in figuring out why I(free) and my clients(paid subscriptions) will trust cloudflare. Mistakes happen, but I can't even imagine my situation if HN didn't come to my aid.

Yeah, I agree it's totally valid to want to avoid the AI ban hammer. I find myself doing it too - e.g. paying cash at stores I would normally never go to, for fear Mastercard thinks it's fraud. I was just saying that it's an egregious enough error that in your shoes I'd be a lot more upset with CF.

The irony in paying cash instead of using your card is that you're likely training their model to be more likely to flag transactions as fraudulent.

This sort of stuff is why explainable AI is IMO important. Assuming the CSR could see _why_ the original domain was flagged by the model as fraud, they could respond in a meaningful way, other than just requiring the OP to go and find someone with more authority than the machine to override the decision.

Unfortunately in these types of situations, getting a satisfying explanation of why something happened is incredibly rare - my understanding is that it's usually at best an educated guess.

How do we get them to post a follow-up or post-mortem? I get that it might be difficult to discuss a specific case involving a customer, but there’s something seriously wrong when they first refuse to share details and claim they will not be reconsidering the decision, only to later do exactly that after the case gets attention. That’s an inexcusable procedural error that should be very worrying to any of their customers.

This happens all the time. Not sure you can expect a post-mortem on this one specific case

"This" being people being locked out of their critical infrastructure through no fault of their own and with no recourse but to hope for the HN effect?

Yeah I love the future we all live in... :|

Update 2:

-----------------------------

Helo,

To clarify the issue, this account was identified in a recent fraud review, however it appears to have been a false positive. We have left a note in this account for future reference.

Kind Regards, Cloudflare Trust & Safety

That's really quite worrying. You'd have been screwed without HN, but not everyone has that recourse. How many other domains have been affected by "false positives" announced with a "we've banned you and we aren't telling you why; now fuck off" type email.

Not to mention the "don't worry, we've put a sticky note on this account so it won't happen again (to you)" instead of an "oh shit, we need to immediately stop and fix this automated process that is catching legitimate customers and banning them with no recourse."

Very worrying. One of the reasons I'd choose a non-huge company like Cloudflare would be I'm less likely to encounter one of these "our automation banned you, we won't tell you why, fuck off" episodes. Looks like more and more companies are cargo-culting this horrible practice.

Waiting for my utility company to turn off my heat: "Your house is fraud. We won't tell you how we know. Fuck off and freeze."

Cloudflare is by no means a "non-huge company" - don't they route/cdn like 1/4 of the entire internet?

going with cloudflare is a choice towards centralization.

I read it as

> non-(huge company like Cloudflare)

not

> (non-huge company) like Cloudflare

> one of these "our automation banned you, we won't tell you why, fuck off" episodes

More like "We can't tell you because it's AI and the (AI) won't tell us why it made that decision".

I agree 100%. And yes, without HN I will be really screwed.

I am really curious about this. How screwed is this? Can you move your domain out, if you want to?

Cloudflare marked my domain as PENDING DELETE. So from what I have read in the past few mins my only option was to buy the domain the moment it gets released through another registrar and hope no one else snatches it. So yeh, VERY screwed.

WOW. This sounds extremely bad.

I started using a personal domain just for email to avoid Google AI kind of screwups, I didn’t know a domain name can have this kind of screwups. I am using a traditional domain hosting company now, definitely not going to use this kind of new tech company to handle the most critical thing.

"fraud review". That's intentionally vague, especially considering how often they simply ignore complaints about clear and unambiguous phishing sites they host.

》it appears to have been a false positive

That's a scary answer. Guess I'll put only mirror/backup domains behind CF in the future.

'behind CF' isn't the problem, if I understand you correctly, it's that in OP's case CF was the registrar.

When I reported fraudulent activity (attacks on enterprise accounts) from CF IPs they told me to f*ck off, their customers know what they're doing. Wondering what it takes to ban someone on CF.

Denying abuse and aggressively policing for it are both ways of achieving the same thing, that is, minimising liability

> The suspension is permanent and we will not be making changes on our end.

"J/K LOL"

If you live in the EU the article 15 of the GDPR grants you the right to ask about the details. Often companies reply that they don't need to answer because of ¨security¨ but this is not true. You can in detail ask about ALL personal data that was used as an input for this decision, information about the ¨automated decision-making¨ (algorithm), and all personal data that resulted out of this process. https://gdpr.eu/article-15-right-of-access/

If any of this data is false you have the right to rectification. https://gdpr.eu/article-16-right-to-rectification/

> You can in detail ask about ALL personal data that was used as an input for this decision, information about the ¨automated decision-making¨ (algorithm), and all personal data that resulted out of this process. https://gdpr.eu/article-15-right-of-access/

That is only true in specific cases of processing, as detailed by article 22: "a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her".

In the case of a domain name used for email I think you could legitimately argue that the decision "significantly affected" you, but it's kind of undefined so far what the bar is for this criterion.

In this case cloudflare has produced a legal effect with putting the domain into pending delete because this is an ownership transfer back to the registrar (of a property they don't even own, so stupid...).

For me deleting my domain would be far worse than deleting my telephone number and significantly affect me. But yes, this is a case by case decision.

I just wanted to say something like: You have rights. Don't be afraid to use them. These companies are not above the law.

> a decision based solely on automated processing,

"this account was identified in a recent fraud review, however it appears to have been a false positive"

> which produces legal effects

Deprivation of property.

I suspect the workaround on the side of the companies doing this is to include human review (or appeals) to ensure the decision is no longer based "solely on automated processing".

Even if not intended, a reviewer that sees mostly true positives is very likely to become a blind rubber stamp.

Good point. But even if they (any of those corps running algorithms but no customer support worth the name) comply (which I won't take for granted), you will get some code or keyword that fraudulent activity was detected. Very unlikely that they have technical details of the root cause in their customer DB.

I don't think so. I have not worked on many fraud detection systems but in all cases there was a very detailed record in the logs of what happened and how the decision came to be. In addition, if there was a human review additional data is often generated. You can't just flip a bit in the customer record, or can you? (Edit: And if no information is in the logs I would argue that all information is in the input data and fraud detecting algorithm and thus the algorithm itself gets part of the data. Whatever happened, if the action can not be "replicated" / understood with the data you got after the article 15 request the data is not complete.)

Since the domain and account belongs to you as a person, this is all personal information under GDPR.

I've done this with Instagram in the past, and funnily.. after a few emails back and forth.. they just reinstated my account..? and told me to download my data the normal way.

Well, I'd hope affected users could submit (reasonably anomymized versions) of what they got to HN in the future, so we can stop speculating.

While thinking about it I found an interesting fact: If they don't produce the data that lead to the account ban because they they "don't have it", they don't actually have proof of fraud anymore. If they don't have proof of fraud you can invoke GDPR article 16 "Right to rectification" and "unfraud" your account. Theoretically they can't argue against it because they don't have any data to argue with...

If they don't unfraud you AND don't produce the data they are not in compliance of either article 15 or article 16 and have delivered the proof noncompliance themselves.

Did you know that you're using umlauts instead of double-quotes? It looks a bit strange.

Reply on news.ycombinator.com