Hacker News Reader

Comment by meowface | Hacker News Reader

Agreed. Google is usually very good with security fixes, so it's surprising that they're basically filing this as a non-issue.

They're right that it isn't exactly a flaw in their systems, but they still have a relatively simple way of mitigating attacks against the telcos' security.

View on HN

Like that one time when Google discovered and fixed the Heartbleed bug before anyone else did:

http://www.smh.com.au/it-pro/security-it/heartbleed-disclosu...

We did not file this as a non-issue. We clearly replied we filed a bug internally and are investigating defense options... Also see https://news.ycombinator.com/item?id=7761372

I disagree, it is a flaw in their system, because they make the assumption that an aspect of the telephone system is secure when it's not.

The user makes that assumption. Google offers and promotes Authenticator for users who want a secure connection.

I submit that a negligible proportion of users is aware that voicemail may be used as a factor, so they're not actively making that assumption. I would say it's Google's responsibility to protect users from the many insecure voicemail systems of telcos, since extra security is the whole point of enabling 2FA.

Google is gradually becoming the kind of company they used to say they were not.

Becoming? They're support always have been terrible; it always felt like a «we have one genius engineer per two millions of the likes of you, do you really think we're gonna bother?» mentality.

This is not customer-facing "read this script" support, though. This is "serious bug/security flaw" respond-to-this-so-your-customers-don't-get-screwed triage. They definitely used to respond to this type of thing a lot better.

The have been that company for a long, long time.

I've always thought that the "Don't be Evil" mantra/motto/whatever is akin to people in denial telling themselves that they are "good people".

If you need a rule to tell you not to be evil, you're definitely not good people.

I don't agree with that. It's a statement that sets the company's policy. While obvious that people should not be "evil", a company motto setting it explicitly to be good is a welcome thing. Of course, Google is no longer that company, and they removed that policy statement after it became a mocking tool for critics.

Google is and always has been downright hostile to anything that comes from outside Google.

Reply on news.ycombinator.com