Hacker News Reader

Comment by tptacek | Hacker News Reader

This isn't really a story about missing access to human tech support at Google so much as it is a story about Account Recovery, The Hardest Problem In Authentication. Anything Google did to make it take just a day or two to recover a totally locked account would be abused ceaselessly to take over people's accounts.

There are no good answers here. A lot of things that work as one-offs or rarities will stop working if everyone does them. If there's a FCC form you can file that short-circuits Google's current process, and it becomes popular, that form is going to stop working. Restoring your access to a locked account is simply less important than ensuring strangers can't "restore" access to your account.

Obviously, one good change Google could make here would be to refuse to accept Google Voice numbers as an authentication factor.

View on HN

I completely disagree.

There have been complaints after complaints about people being locked out of accounts, and there are no easy ways to recover - often no way at all.

To say that the paid support you're paying for can't help you access the service you're paying for, that's a bit rich.

> Restoring your access to a locked account is simply less important than ensuring strangers can't "restore" access to your account.

That's a false dichotomy. If you can pay, say, $200, and get 30 minutes with a tech who has access to your email and can go through a manual, interactive process to verify you are who you say you are - for example, if you can prove you hold the credit card that's been used to pay for Google One for the past couple of years - well, these "strangers" are going to have to work REALLY hard to "restore" their access to your account. Probably well more than $200 and more than it costs to install a keylogger and sniff your password anyway.

It doesn't so much matter if you like the current state of affairs; it is what it is. If paid Google support could easily reset accounts (or, really, reset accounts at all), the accounts of paid support subscribers would regularly get taken over. Try to design an account recovery program for a service with, say, more than 10,000 clients to see why.

Think through what you'd hope Google would be able to do here. How do they authorize the request to unlock the account? Now imagine a well-funded adversary that knows exactly how Google's processes work (probably because they continuously pay for accounts and have them reset, to track what Google's doing). What's the reliable signal Google can use here, one the majority of their users actually have access to, that they can quickly execute on?

There are companies that have relatively quick Account Recovery processes through customer support. But those companies either aren't worth defrauding, or are regularly but quietly defrauded.

At least for accounts that have services that have a billing address, they could send a postcard with a special code to unlock the account. In the case of the OP, that would have solved the problem.

Historically, that's how things like PINs were often reset. Of course, the more frictions and tie-ins to physical things you throw in, the more people will have legitimate sob stories about how they don't have that phone number any longer or they just moved and so forth. There's always going to be tradeoffs.

To what address would Google send such a postcard? What do you do about the problem of estranged spouses and the like triggering recovery to break into their partners or ex-partners account? It's a mess. All the options are.

Remember, this is the most valuable account most people possess.

> What do you do about the problem of estranged spouses and the like triggering recovery to break into their partners or ex-partners account? It's a mess. All the options are.

Nothing? Google sends postcards to verify business addresses already. If it's good enough for the bank to send me a card and PIN via post it should be good enough for Google. We have laws in place to deal with estranged spouses breaking into accounts.

What happens when you don't already have a verified address? None of this is easy.

Everything you say is true but I think the weights on your arguments are off.

A well funded adversary WILL take over your Google account. They'll do it by installing a keylogger and stealing your cookies, they'll do it because they know what signals the account recovery process is looking for - much better than you do, they'll do it because hacking you is far easier than hacking Google. (Two-factor authentication done properly, with printed backup codes in a safe location, can prevent hijacking most of the time.)

Second, Google accounts constantly do get hijacked every day. This draconian status quo might have been justified if it would prevent all hijackings, but it doesn't.

Third, my Google account is not my most important account. My bank account and portfolio which hold my life savings are arguably more important. But somehow I'm not worried at all about losing access to them.

Again, no system is perfect and it's mathematically impossible to identify the correct person for every account. But I still believe you can get the same false positive and false negative ratios without getting blog post after blog post from people who are completely stuck.

I'm not going to debate any of this stuff, because it's not the point I came here to make. My point is that the problem this person is having is with Account Recovery, The Hardest Problem in Authentication, not with poor customer support. You're welcome to argue that Google should take Account Recovery, The Hardest Problem in Authentication less seriously. All signs point to them taking it more and more seriously, but that doesn't mean you can't campaign.

What signs are you seeing?

My point is different. Recovery is the hardest problem in authentication, but when you're as big and as significant as Google is, you owe it to your users, paying or not, to get it right, however hard it is.

If you've got a straightforward solution, implement it and make several billion dollars. I'm not being glib.

Nah, I'm talking about edge cases Beyond the 99% of cases which I assume they get right, recovery is a cost center.

There's a single potential client (maybe two if you add Facebook) who seems to be showing no interest in getting it right. Not the best business proposition.

Couldn't be wronger. This is a huge problem for everyone.

In the sense of the general account recovery problem, yes. I'm pretty sure it's mathematically provable to be impossible.

But the account recovery problem facing Netflix or Github is different from the one facing smaller companies which is different from the one facing Google. I honestly doubt there is a one-size-fits-all solution, I definitely don't have it, but I'd be happy to be surprised.

If I needed to, I could physically walk to my bank and they would unlock my bank account on the spot. That also seems like an excellent protection against people getting their account hacked from overseas. No Indian call center is going to show up in person inside the US to recover your account, so those people that do show up have a high likelihood of being the correct person. Google could also require people to show their ID card and sign a copy of it so that if an account is maliciously reset this way, the original account owner can subpoena them to get the ID card copy that the scammer used.

It's not rocket science. All banks can do it. It's just a tiny bit more expensive than saying "fuck you" to 0.1% of your customers.

The reason banks can do it is they have large retail presences and train staff on these procedures. The cost for Google to do that would not be small.

I agree. But Google's revenue is also not small. I'm optimistic they can afford to.

AWS has a decent (corporate) solution to this. They simply outsource account recovery and user attestation to the state and the finance industry. You stake money on a financial medallion (a contractual instrument that's a guarantee of sorts). Presumably you will get sued and armed men will come after you if you commit fraud. It doesn't scale well outside of the big cities but it could be a viable option for Google.

Requiring physical presence in some manner makes identity verification, if not failsafe, a lot harder and riskier to spoof. I observe that my broker was allowing transfers over the phone early in the pandemic. But when I did a similar transaction earlier this year, they were back to needing me to go into an office.

Most civilized countries have strong authentication methods which are behind easy and cheap APIs for Google and others to use if they really care about restoring access.

As far as I know, US does not. I am pretty sure you think Europe, where ID cards/residence permits are smart cards with PKI built in.

I'm sure there are ways to authenticate yourself digitally in a strong fashion in the USA as well, with online banks maybe?

In any case, lacking that, one could just walk into a Google office with a passport there. There are official ways to do authentication if these corporations really cared.

Reply on news.ycombinator.com