Locked out: How a gift card purchase destroyed an Apple account
appleinsider.com
appleinsider.com
I tried around 10 years ago, repeatedly would provide a password, get a notification, click on it, get asked to type my new password.. and get told the password was invalid.
Anyways, I moved on with my life. I was only reminded of it this year when I got referred for a job at Apple.. and guess what, I still can't make an Apple ID. So now I can't ever get a job at Apple :) Oh well, first world problems.
Big tech has repeatedly shown that they are willing to ignore life destroying account workflows so long as they only impact a minority.
But yeah, I'm not looking forward to the day I need to show a Google or Facebook account to receive government services. US Visa applications are already going in that direction.
Sometimes this has failed, because the entity uses some third-party validation service that can find no record anywhere of the existence of the new email address. So it's sometimes impossible to register a new account somewhere unless you use an email address that is "known" to the validation system.
I'm not sure what "problem" they were trying to solve by doing it this way, but they've created a new problem by doing it.
Also, sometimes I've tried to use very short email addresses such as: x@xxx.com, and they're flagged as invalid even though they're not.
I've also had valid accounts disabled without notification because the email address I used had the name of the entity within. E.g. google@xxx.com Some companies assume you're trying to impersonate them if you do this, and silently disable existing accounts. Usually the tech support staff aren't even aware of these restrictions, which makes it even more difficult to recover.
I host my own e-mail. Valid SPF, not on any spam blacklists, good reputation score on my static IP.
At the beginning of November, I lost the ability to send e-mail to Gmail - it was all rejected as, quote, "possibly spammy". Double checked SPF and DMARC... Double checked documentation... Spent time setting up DKIM on my mail server, even though I sent nowhere near enough mail to merit it. Nothing got through for two weeks.
Google Postmaster Tools were totally unhelpful, telling me _that_ I was being blocked, but not _why_ I was being blocked. There is a community support forum where I posted - it hasn't seen a response since I posted in November. There was also a support portal where I could, in theory, contact a human. I sent something in there, and am still awaiting a reply.
Now remember, Gmail isn't just for @gmail.com addresses. Gmail hosts my accountant's domain. Gmail hosts the domain for a club that I'm part of. Gmail hosts friends who also have their own domains. Gmail hosts... well, probably a solid half of the Internet's e-mail.
My only way out of this nightmare was to reach out to a contact at Google, who - having an @google.com e-mail - was also unable to receive e-mail from me, and made the case to the right folks internally that I couldn't send important messages to him. A few days later, I could magically send e-mail to Google again.
Do I have any idea what I did? No. Do I have any idea what they resolved? Also no. Can I prevent it in the future? Who knows!
In the header for the bounce messages was included a description of the problem (as they perceived it), and a link for background reading.
I never followed up on it personally (that wasn't my job anymore because reasons), but the bounces seemed descriptive-enough for someone who was paid to care about it to make it work.
Was that not the case for you?
The core of the flaw is that actual fraudsters and spammers are repeat players and ordinary people aren't. The bad guys expect to be blocked, so they test for it. They check if their messages are getting through and then notice immediately when they stop. Whereas real people expect their messages to go through, because why wouldn't they when they've done nothing wrong? And then become isolated and depressed because it seems like everyone they know is suddenly ignoring them.
The bad guys create thousands of accounts and play multi-armed bandit, so when some of them get blocked they can identify why by comparing them to the ones that didn't, or create new ones and try new things until something works, and thereby learn what not to do. Whereas real people have no idea what sort of thing is going to arouse the Dalek either before or after their primary account is exterminated.
So it's a practice that creates a large increase in the false positive rate (normal people have no way to know how to avoid it) in exchange for a small decrease in the false negative rate (bad guys figure it out quickly). In a context where false positives cost a zillion times more than false negatives because the bad guys treat accounts as a fungible commodity they acquire in bulk whereas innocent people often have their whole lives tied to one account.
And all of that is only disguising the real problem, which is that people get blocked having done nothing wrong. If you were expected to point them to the spam they sent or the fraud they attempted then you wouldn't be able to do it when they'd done no such thing, and then "we can't tell anyone because it would help the bad guys" is used to paper over the fact that you couldn't tell them regardless. When the decision was made by an opaque AI and then reviewed by no one, there isn't actually a reason, there's just a machine that turns you off.
Basically, Google are shadow-banning me till they get caught. I think this should be illegal.
At this point Big Tech is only scared of the government, so keep that in mind --- the Amish may be on your side.
I realize this sounds out there, but I'm not entirely joking. I feel there is a significant subset of all people that are not particularly happy with the direction of society at large. And the great thing about places like the US is that you're free to develop your own little sub-societies. There's no reason a group of like-minded people could not work to develop a technologically embracing society, but one that aims to focus more on decentralization, and utilizing digitization as a convenience rather than a necessity.
Think about something like a 'Google Smart City' except from an entirely different ideological foundation, such that the entire project doesn't sound like something out of Black Mirror. The reason this would be beneficial as a social project, instead of the vastly more viable independent one, is that a lot of tech is generally seen as undesirable, certainly in certain contexts (like smartphones at school), yet it spreads virally making its adoption a defacto necessity. Get rid of the virality and you could create a better life, and a better situation, for many people.
Get a bunch of hackers and DIY small farm folks etc. to move to the same place with the goal of disentangling themselves from megacorps. To begin with it increases the local concentration of people who want that and then causes local businesses and agencies to start serving their needs better because they're a higher proportion of the local population. And it puts the people so inclined in closer proximity to each other which improves coordination.
If you got enough of them you could even affect local ordinances and then e.g. pass strong right to repair laws or laws against businesses requiring you to use one of the major phone platforms. How many localities would need a law against remote attestation before companies would have to stop using it against people?
Notice, too, that my story is about the utter lack of support like in OP.
(passwords should be hashed...)
- limits on the length
- limits on the characters
- blocking paste
- weird limits on the email
This is a sign of a lack of real competence
Sounds like an egregious EEO violation then.
Is this actually a requirement to work at Apple? What is the legality of employers demanding their employees agree with unrelated-to-their-job terms and conditions? I mean, one of these conditions is that you settle all disputes with them through arbitrators of their choosing, that would be crazy if true.
We live a dystopian world where a trillion dollar company can’t fix the account. Worse than that, out of their several hundred thousand employees, not a single one is capable or willing to fix it.
Speaks volumes about our species in general and where we are headed.
When the executives go on their spiritual retreats or their boondoggle get togethers to talk about company values to the employees; it would all seem so pointless and hypocritical when they can’t fix situations like this.
I hope that's not the typical experience, but it's certainly mine.
I filed a bug report about an issue in Google Maps once; this had to have been around 2006.
A little over a decade after that, they emailed me and let me know that they'd fixed it.
That's support -- right? (Right?)
:)
From their bsky account, maybe.
same for amazon gift cards
For some reason every card I put in wasn’t accepted, and then my 10 year old Amazon account was banned. I was even using a Fire TV at the time with the same account. Had to create a new account. Very annoying.