Hacker News Reader

Comment by highwaylights | Hacker News Reader

It’s an absolutely catastrophic experience, that they clearly don’t take seriously.

Regulation solves this. I hate to say that, as so much of tech regulation is a ham-fisted disaster that misunderstands the problem and creates even bigger ones, but this is really a very serious problem that can ruin lives, and regulators really should step in here.

I’ve known a couple of people who have been through this experience, and one in particular who not only couldn’t get back in to their account - but had no way of knowing if someone else was able to get in to the account later. They’ll never know. It will never be possible to know. The kicker is that they could never have their data deleted due to the same problem. And no amount of help or time spent with chat support ever changed anything.

View on HN

Can you describe how regulation solves this problem, how exactly are you proposing for this regulation to work?

I’m not GP, but I expect that regulation could help by requiring customer service. Similar to banking.

And there could be an agency similar to CFPB where citizens could appeal who would then make formal investigations.

So regulation would force the workflow described in the article to not have a grim outcome for elderly users of gmail.

We already have that structure. It's called "court". And if you think it's not working well, I would agree with you. But neither will the other bureaucracy you are proposing, because neither really care about any of low income people who can't even pay for the phone service.

But let's put aside the efficacy of said institution, and presume it's working very well. They got call from some Joe. He claims that certain email address belongs to him, but can't prove it. Forgot password, no access to phone. What this customer service of yours going to do? Let's imagine they can order Google to give the guy access to account. Is that a right thing to do? What if that email belongs to a journalist or a whistleblower and you just gave access to it to a Russian intelligence? Remember, benefits are one thing, but it's not the only thing for which email is used.

And if it really comes down to this, why is Google under obligation to provide emails for government use? Government can provide email access to everyone who needs it. If they require email in order to access benefits, well go ahead and set up necessary infrastructure. Why Google had to do it? Google provides service on as-is basis. If that service level is unacceptable for government use, well newsflash: it's not the only provider.

It's not the only provider, except when it is.

If you have an Android phone, your e-mail is on Gmail. It doesn't need to be, but it is, because you didn't know that when you were funnelled into the e-mail when you set up the account and oops now that you're locked out ten years later it's too late to make a choice.

Since opening all these offices costs money, this means that the accounts can't be free anymore.

I suppose they could be subsidized by the state for low income people.

That's why I proposed linking to existing services: Google doesn't want to open an office in Podunk, but they could very plausibly setup a way to allow agencies like DMVs, libraries, maybe the VA or post office, notaries, etc. to use some kind of “I attest that person X showed me photo ID matching the information on account Y” web app. This could be really useful paired with things like senior centers whose residents are far more likely to need help.

Not necessarily. The margin is really high on Google services even though they are free.

I don’t know Google well enough to know what they would need to do to offer non-shitty service. Maybe they show more ads.

I also think they could automate good service if they wanted to, but it’s not a priority and they aren’t required. I used financial services before and after CFPB and I don’t remember price increases on my bank accounts. So perhaps something similar would apply here.

Could it not be similar to FOSS companies where the software (service) is free but customers pay for support?

I write software at a fintech, and the CFPB regulations are super important for protecting the customer. They also give important guidance on how the customer needs to be taken care of, which is important for a company that wants to do the right thing but doesn't have expertise in customer service.

I really don’t understand how regulation makes it better? you can simply write down codes if you want a way of recovering a gmail account. Most users don’t do this because they’re not educated and they don’t understand opsec. If a government agency had the power to recover any account, it would be abused by corrupt government officials.

Remember scale when thinking of potential solutions here! it’s not just the US that would be affected by this as well. The reality is that google does a better job at identity any than US government institution (ssn, drivers license). How many people have their identity stolen versus having their 2fa protected gmail account stolen?

As far as support, how would it be better if support gave you access to an email account if you complained enough? please consider the abuse side before you suggest a solution.

You’ve misunderstood the problem.

Backup codes wouldn’t help here, and the person I was referring to had their 2FA to hand.

Forgetting a password is unrecoverable on gmail - they even had recovery options on the account (secondary email and phone), but the recovery form never asked for that information so it could never be used (it insisted on the previous password). As no member of staff has access to prompt the system to offer a different one of the specified recovery options, the account is permanently frozen to this user (but not potentially to an attacker in the future, assuming that other information could be obtained somehow).

Helping the elderly is hard, but Google’s system is horrifically dangerous to people in ways even Google aren’t aware of.

This was an elderly gentleman, not well versed in computers, but all the savviness in the world couldn’t have helped him. He was forced to just walk away and hope for the best. Holiday snaps, photos of grandkids, personal files - all permanently retained by Google but locked out of his reach forever.

Reply on news.ycombinator.com