News for hackers. Stuff that matters.
Re:Don't use third party auth to sign in by crazygringo on Saturday November 14, 2020 @09:42AM (#25092538)
> I'm honestly not sure where we went so wrong as a society so as to reach this point... Why?

The answer is actually very simple: spam.

AFAIK pretty much all disabled Google accounts come from Google believing they are part of a spam-sending (or malware-spreading) network.

The ability to sign up for free Google accounts means this is a prime target for spammers to use and abuse -- signing up for free Gmail/Drive accounts, as well as using stolen credit cars to sign up for paid ones.

As to why the legal system doesn't want to be involved, it's because incorrectly disabled Google accounts are actually incredibly rare -- they make the news and cause uproar when they occur, but precisely because it's so unusual -- it's incredibly rare to personally know someone it happened to. So there isn't any kind of democratic movement against it because in the grand scheme of things it isn't common. It's like worrying about being struck by lightning.

That's why.

Re:Don't use third party auth to sign in by onion2k on Saturday November 14, 2020 @10:24AM (#25092795)
it's incredibly rare to personally know someone it happened to

I don't know anyone who has a degree in History but that doesn't mean historians are especially unusual. All it means is that my network is quite small.

The same is true here. The fact few people know someone who has been affected by this problem doesn't mean the problem is unusual. It just means there are hundreds of millions of people who use Google and you know a few thousand at most.

Re:Don't use third party auth to sign in by awillen on Saturday November 14, 2020 @10:55AM (#25093041)
According to the Bureau of Labor Statistics, the number of historian jobs in 2019 was 3500 - that's in the entire US.

So... incredibly rare, really.

Re:Don't use third party auth to sign in by nitrogen on Saturday November 14, 2020 @11:40AM (#25093374)
They did say "degree in history" rather than "job as historian" though.
Re:Don't use third party auth to sign in by onion2k on Saturday November 14, 2020 @11:50AM (#25093465)
Exactly. The number of people in the US workforce who have a history degree is a little over a million (https://datausa.io/profile/cip/history).
Re:Don't use third party auth to sign in by lotsofpulp on Saturday November 14, 2020 @01:08PM (#25094170)
Undergraduate degrees are easy to get. Having a psychology degree doesn’t mean you’re a psychologists, a history degree doesn’t mean you’re a historian, and a math degree doesn’t mean you’re a mathematician.

The extremely large majority of people go on to work regular jobs that have nothing to do with their degree and lose much of the information they learned, if it was even substantial at all.

Re:Don't use third party auth to sign in by kubanczyk on Saturday November 14, 2020 @11:35AM (#25093333)
All the unemployed historians now feel oppressed, thanks.
Re:Don't use third party auth to sign in by michaelt on Saturday November 14, 2020 @10:00AM (#25092657)
> incorrectly disabled Google accounts are actually incredibly rare -- they make the news and cause uproar when they occur, but precisely because it's so unusual

Or they rarely make the news because they're so common, and the few that get publicised are because the victim raises a big stink on social media.

I've certainly created Twitter and Microsoft accounts and had them wrongly disabled within days, despite not doing anything at all with them, let alone anything abusive. Perhaps because I decline to use my cell phone number for 2FA?

Re:Don't use third party auth to sign in by crazygringo on Saturday November 14, 2020 @02:16PM (#25094784)
> had them wrongly disabled within days, despite not doing anything at all with them

That's because that's also a common tactic used by spammers -- to register and then do nothing for days/months, on the hopes that an "older" account will be less suspicious.

Nobody's complaining about that though because it's not a problem. No data is lost. Also, I've had it happen to myself (with Twitter) and it was incredibly easy to re-instate.

To clarify, I was referring to legitimate, in-use (with data to lose) accounts being incorrectly disabled.

Re:Don't use third party auth to sign in by syshum on Saturday November 14, 2020 @09:58AM (#25092644)
I think it more common than you believe, and certainly more common than the ones that make the news.

The ones that make the news are people that are either well known, or have and active way to promote their problems through social media or news site

I.e they are reporters, know a reporter, dev of a popular app, etc etc etc

They are Jane/John Doe that has less than 50 twitter followers and a normal every day uninteresting person, for which there is no recourse at all not even social media

Re:Don't use third party auth to sign in by bsdz on Saturday November 14, 2020 @10:47AM (#25092969)
Would be good if Google just published the stats on their transparency report:

https://transparencyreport.google.com/

Re:Don't use third party auth to sign in by FpUser on Saturday November 14, 2020 @09:49AM (#25092579)
>"It's like worrying about being struck by lightning."

If lightning strikes there is not much to be done. Google however can and must have reasonable process to restore the status.

Re:Don't use third party auth to sign in by Aeolun on Saturday November 14, 2020 @10:41AM (#25092935)
Yeah, the fact that it’s like being hit by lightning is exactly the issue.
Re:Don't use third party auth to sign in by JoeAltmaier on Saturday November 14, 2020 @09:49AM (#25092580)
Hm. Lawyers love lawsuits about folks struck by lightning? So I'm not sure that's the reason this issue is not a lawyer's forte.

I'd suggest its because its hard to prove or prosecute. Because its technical and obscure. A single case, Google just has to say "Oh sorry; its turned back on". There's no money in them capitulating. And a class-action suit enters into the details of the issue, which are impenetrable to a judge?

Re:Don't use third party auth to sign in by derefr on Saturday November 14, 2020 @11:37AM (#25093360)
You’d think there’d be a very simple solution to this—one that I believe Google already used for a long time, but just never generalized.

That approach: “proof of human work.” Google owns ReCAPTCHA, and every time you do a ReCAPTCHA for Google, you’re doing a little one-time proof-of-humanity for them. But it’s also a proof-of-work; and proofs-of-work that cannot be automated are aggregatable.

In other words, the fact that someone with Google account X solved a ReCAPTCHA, doesn’t just tell you something about who that account is lately. It should add to a sort of “human-proof credit score” for the account, where Google’s systems are more willing to put faith in the user because of all the times they’ve proven themselves human already.

And, for some scenarios, Google does use the aggregate proof ReCAPTCHA represents this way. This is why you’ll never see the Google Search “stop searching so fast” message when accessing Search through Chrome synced to a well-used Google account; why you’ll get a ReCAPTCHA portal from them instead if you’re not logged in (you’re being asked to build the credit score of your IP/session); and why you’ll be denied upfront if you perform botlike behavior through Tor (where there’s nothing that can be correlated to give you a persistent credit score.)

Now, such a “highly-proven” Google account could still be heuristically detected elsewhere in Google’s systems as being responsible for botlike behavior (e.g. spamming); but, when such a highly-proven account is flagged, it should go in for manual review. Because — as you say — this is incredibly rare! So this process doesn’t need to scale through automation, the way regular Google processes do. It can be high-touch.

But right now, it’s not. (Or they’re just not even using the high-proof-of-humanity metadata on the account during this determination.) Either way, that’s kind of silly.

Re:Don't use third party auth to sign in by kaetemi on Saturday November 14, 2020 @12:56PM (#25094062)
Even when logged into Google, search still often enough thinks I'm a bot...
Re:Don't use third party auth to sign in by mistermann on Saturday November 14, 2020 @11:14AM (#25093180)
Is this speculation, or the comprehensive, objective explanation?