Hacker News Reader

Comment by withinboredom | Hacker News Reader

This ... is not what is going on. When I worked at $bigcorp serving billions in traffic, what happened is that botnets would create accounts and leave them dormant for weeks/months/years (thousands of them), then start doing their bot thing. Account age says a lot when it comes to trust (usually) and spam detection. That's more than likely what they're seeing, not 'compromised' accounts.

All this does is tell the spammers exactly how long they are going to be allowed to have 'sleeper accounts' for, the problem won't magically go away.

View on HN

> This ... is not what is going on.

I am reasonably confident that Google are more aware of what's going on with dormant accounts on their platform than you are. I previously worked at Google in Security and while it wasn't in user protection, I know they have quite a few signals for determining compromise. It's pretty trivial to see that an account that was in legitimate use for 5 years and then dormant for 5 vs one that was created and left dormant for 10.

Yes, on Google and on other platforms, account age is a valuable reputation signal but it isn't the only one.

Exactly. If Google were to rely on activity, then the bots would simply post now and then akin to human behavior and remain active.

Yes, we saw the same thing. But when spot-checking the activity we realized it was super-low-effort legitimate activity. IOW, it could have been sweat shops or scripted bots going through some motions.

I promise you Google is running user activity learning models that go well beyond spot checking the occasional account.

Google deals with abuse creation accounts in the tens of millions.

You still have to supervise the models and ensure they're working as designed and general quality control. Though with the number of 'Google disabled my account for no reason' posts, I assume they're not doing that, especially when I read comments like this, I assume its a part of maintenance that people don't consider when it comes to AI.

I am sure Google of all companies has enough insight into account behavior to conclude this is the case for them. It's not like they can't verify it either: if the account previously had legitimate activity and is now compromised, it's not really a sleeper account.

Bots, antidetect browsers, and residential proxies exist specifically to imitate the activity and circumvent fraud prevention systems like Google's. Most accounts get caught, but many slip under the certainty threshold. This is a cat and mouse game, and sometimes mouse wins by blending into the crowd.

With LLMs it suddenly became much easier. I suspect that the timing of this decision might be not random.

Are you suggesting that they're too incompetent to tell the difference between bulk account creation and hijacking, or that they're just lying about the reasons for why this change is happening? The former idea is pretty arrogant, the latter is unmotivated.

Especially given you're talking of "thousands" of accounts, I suspect whatever problems mattered to you the most were not the same as those of Google's account system.

This could also just be a simplification for the purposes of this announcement.

They mention this being mostly about security and preventing the use of hacked accounts, and they mention these dormant accounts that were only created and then went immediately dormant. It makes sense to me that they are in fact talking about this issue, just not explaining all the detail.

That's possible, but the storage costs of unused accounts is probably significant. Given billions of users, they probably have several hundred million of them.

Previous company I worked for had to create a process to clean up unused developer accounts. The fact that they were free to sign up meant we eventually got quite an impressive amount of them.

Meh, you move that data to cold storage and if they ever come back, it just takes longer to log in. They are already physically migrating data to closer data centers for you, so it isn’t any more complex than what they’re already doing.

> This ... is not what is going on.

I wouldn't discredit it so quickly. I have seen lots of old accounts being taken over on eBay lately for scam auctions. It seems to become more and more common. So this could very well happen with Google accounts as well. It makes them more credible for whatever scammy thing they are being used for.

I can't imagine a more bruteforce approach to a known pattern, then.

If the only indicator you have for spam potential is [created an acccount] + [was inactive for some period], I can't imagine the other myriad spam vectors aren't getting hammered 24/7.

Reply on news.ycombinator.com