It’s incredibly transparent as to what they’re doing. That Google became the most anti-consumer company out there is pretty disgraceful.
I'm not going to jump through hoops to prove a negative, but correlation does not imply causation.
My empirical observation: For many years I have constantly used Google search on FF with many machines and networks, logged in and not, in private mode and not, with all existing privacy features enabled and no extensions beyond a password manager. Napkin math conservatively estimates I've conducted 200k searches minimum using this combo. I've consistently encountered suspicious activity challenges when using overcrowded proxies, NAT'd networks and VPNs. Removing those factors has never failed to stop the challenges. Ever.
I'm confident the poster's observations are accurate. My observation does not directly contradicts their observation, but it does contradicts their conclusion. I wouldn't be surprised if other factors like JS being enabled, cookie settings, plugins that affected those things, number of other users on their network, or even the public IP range they fall under would affect it.
I've at least been "captchaed" in Firefox. While being logged in with my Gmail account from 2005.
BTW: Yes, I absolutely noticed that you said this above:
> ...and the beauty of the Internet is that there's really no way to be sure people are being genuine...
My point is, unless the claims of the others are outrageous or we have something very specific to point at, I don't think voicing these kind of thoughts do much good.
On a VPN I do not get it, so the last couple of weeks I have been making heavy use of my mullvad account.
Edit: however. I only store cookies for fastmail and hacker news and do not allow JS on many sites.
That happend to me only when using tor.
There are some sites I can't login at all unless I change the browser. SoundCloud is one of them.
Usually when they do that its because you are on the same network that a lot of abuse has come from.
A faked header might look even more suspicious to their algorithm?
You could try creating an issue in the Cloud Identity issue tracker (Cloud Identity is Google's API for letting websites have a "Login with Google" thing): https://issuetracker.google.com/issues/new?component=522910&...
But Gmail Webviews allow Google logins though :/
"mailto:[email protected]&subject=Synth Careers&body=Please attach resume!"
It should be,
"mailto:[email protected]?subject=Synth Careers&body=Please attach resume!"
that &subject instead of ?subject is causing that mailto link to not be imported properly by most mail apps, trivial thing, but thought I'd mention it.
Good luck with your app !
<looks at subject of thread nervously>
The only reason I caught this is because they send me a notice about 2FA and I thought, wait what 2FA am I using? Instead of them running a tiny check to see "Wait, is this person using a voice number" they did it anyway. Worse, they know this because if you go into the 2FA page manually it says in bold letters to not use a good voice number.
At this point I'm spooked and I'm just going to port my number into our account at work and have my work phone use this number instead of having a dual number phone with voice. Voice SMS is a mess too. 50% of services can't SMS it a code because Google blocks it. Other services won't accept it for SMS codes because its "not a real phone."
If I didn't catch this then there would have been a day where I'm locked out of my accounts with no apparent way back in.
The first part of that shouldn't be true. I've used mine to receive all kinds of SMS and it always works fine _except_ for the services that just won't accept the number. Only run across maybe one or two of those, over some years.
For SMS from real people it works fine ofc.
Why Google also seems to block incoming SMS from Microsoft Authentication and others is beyond me. Maybe MS isn't sending because it doesn't consider that number real and just fails silently on their end? Maybe Google's own lists are very aggressive. I suspect the latter because this comes up a lot. No one seems to have a good answer to any of this because there's no laws requiring transparency so they hide their rube-goldberg-esque SMS policies behind obscurity and its up to me, the customer, to somehow navigate this mess.
Yes, from regular people things are fine, but my life isn't dictated by regular people but the mega corporations capitalism creates and how I have to cater to their various technological whims. If my phone can't get messages because these big companies are always feuding in some way, then I'm locked out of essential services I need to live, have a job, do banking, etc. Its a small comfort that my friends can text me when I can't get texts from my bank, money transfers, or for work. As of right now in the USA, having a VOIP number be your primary phone number is unfeasible. I have a work cell with a "real" number that I use for at least 4 different services for SMS because of this issue.
Anyway, yeah that's lame. I'm personally abandoning ship from Google Voice myself anyway, but for other reasons.
Shortly after that, Google started pushing HTTPS. I never believed that was a coincidence.
- A standalone browser that I use only for research purposes. Currently evaluating Bonsai [1] and am interested in Synth.
- A suite of tools that makes bookmarking and organizing easier when used alongside Chrome. Currently, I pay for Raindrop [2] to manage bookmarks, most likely will pay for Slapdash [3] for indexing, and am evaluating Heyday [4].
For an end-user like me, I would much rather pay for an extension+SaaS for Chrome or Firefox, rather than deal with workarounds for browser incompatibility.
[1] https://bonsaibrowser.com/ [2] https://raindrop.io/ [3] https://slapdash.com/ [4] https://heyday.xyz/
https://github.com/karlicoss/promnesia#readme
And if you're interested we have a small discord server "awesome knowledge management" come join us!
Although you say "organization"... this isn't centered around a particular tool or anything.
I made it in response to a post about Promnesia on "Who wants to collaborate" https://news.ycombinator.com/item?id=29764928
Browsing from this Google-blocked VPN has been an eye-opening experience. Google tech is pervasive and makes the web hostile for everyone practicing online hygiene.
When Google first blocked my proxy, suddenly search in Gmail and Drive stopped working. This was my paid Google business account. I tried to contact Google Support but found I couldn't log in. I carefully wrote down a Google Support PIN several years ago. When I tried to call Google Support, the PIN didn't work. Apparently, Google Support PINs expire after an hour. So I learned that Google provides zero support for login problems, even for paid accounts. That's a massive risk. I switched my business accounts to Zoho. It took about 4 hours to sign up and move over my domain + email + docs + spreadsheets + drive. I've been using Zoho for about 3 weeks now and it's fine. Zoho Email search is good. They let people create support tickets without logging in. And humans respond to the tickets within hours.
Can confirm.
To generalize and understand why, big corps have to deal with an insane amount of (often automated) abuse, so they build profiles using data collection to assess your risk level. Being in the wrong cohort (say unusual browser, small country, rare language, use a vpn etc) can affect your score. Basically it's these massive bayesian filters that output how suspicious some activity is. Whether you're signing in to Gmail, returning a product, buying something with a credit card or booking an Uber, some form of score is computed and then used to allow/deny/delay/verify. Obviously this is well established in the insurance and finance industries, but make no mistake, it happens everywhere.
This approach is understandable from a business perspective, but imo deeply troubling for an open society. You don't have to squint much in order to see the similarities to social credit systems, EVEN if there is no grand totalitarian state-coordinated behind it.
As usual, the first step is transparency so we can actually discuss these issues based on accurate data, but that's very difficult today. Usually fraud and abuse prevention is among the most secretive departments, they never share anything.
In my book you’re never supposed to fully block a session because of the score, there needs to be a (potentially burdensome) way to prove the score wrong. Blocking a browser should be out of question.
If these numeric scores are affecting search results, recommendations, when sharing stuff, etc etc, there's no question that it will affect societal discourse. These hidden "algorithms" (as in the popular term) and fraud prevention systems are so far from being understood that it may be too late to reverse it when we realize what's happened.
It seemed somewhat legitimate for a small free to use site mods to try to not get their whole life sunk by dealing with trolls, but if the same behavior is applied to giant entities who have much more incentives to do it at scale, it becomes a different issue altogether. Hidden restrictions on search results or other functionalities would be distopian and something I hope doesn’t get accepted as standard.
Not sure being corporate centric makes this problem any worse? If you had other kinds of organisation, you'd still have to deal with abuse and fraud? Any people doing weird, unusual stuff, look inherently more suspicious. That's a fact of life in meatspace, too.
There might be some utopian, ideal way to organise activity so that non-mainstream stuff ain't suspicious.
But I would count that as a great feature of that ideal way; not as a deficiency in the corporate way. Just because this deficiency of the corporate way seems to be a common deficiency of most means of organisation that have been tried.
(Keep in mind, this isn't all or nothing. Softening the tendency might be enough of a relief, without having to eliminate it completely.)
Thanks!
> Not sure being corporate centric makes this problem any worse? If you had other kinds of organisation, you'd still have to deal with abuse and fraud?
I think it's definitely not unique to big corps, but an emergent property of a distributed and homogenous system of self interested agents, probably. It feels very game theoretical, at least. What's clear is these systems are becoming ubiquitous rapidly.
Anyway, if my Google account gets locked today, for whatever reason, I am very seriously screwed. Google's human appeal process is best-effort at best, I know people personally who have been locked out for life. Now, I have the luxury to blame myself because I should have bought a domain and so on, but society at large doesn't have that foresight/insight.
Not sure the homogenity is necessary?
To an extent, the market delivers what people are demanding.
For most people, Google's package of cheap or even free services with minimal hassle in the common case, but almost no recourse in bad cases, is compelling.
And for many it's a step up from having everything locally: I'd bet that more people lose their local data than get locked out of Google?
Oh, nice catch, I actually meant to write heterogeneous.
> I'd bet that more people lose their local data than get locked out of Google?
Probably. There's definitely some low hanging fruit/middle ground though. We desperately need to have ownership of the address itself, so we can transfer to different providers. Either with your own domain, or a domain provided by a truly neutral party, similar to phone numbers.
Unfortunately google doesn't have the support infrastructure like a bank to do recoveries.
It's not so much a social credit score to fear rather than privacy. Any site using cloudflare or Google knows where you're going and what your doing and if they don't then, access denied.
They know so much more than your innocent mind will want to admit.
Speaking from someone in the US--in both insurance and finance I can get a person on the phone to resolve my issue.
Specific to finance, there are a number of consumer laws that protect me.
If I'm denied credit based on my credit history, I'm allowed to know why. If my credit score is not accurate, I'm allowed the ability to fix it.
Lousy customer support is not a tech industry issue--Stripe, Amazon, Apple, to name three all have great support.
True, but they have actual customers. As a user of Gmail, I can hardly be considered a customer.
Google ads has customers though. Their support probably isn't great either, but does it need to be? Where else are you gonna go?
I've not dealt with Google Ad support, but I can say from experience Facebook Ad's customer support is terrible.
Similar to Google, I'd speculate that the majority of customers pay such small amounts, that it's more cost effective for Google and Facebook to not support them, than it is to support them.
I would also speculate, that if you were instead, say Pepsi-Co, you would have white-glove service from both tech giants.
That's probably how they reason about it but I think it's a cultural thing too (pure tech Co's have a bias towards automation for everything, and a reluctance to staff operations at all). Amazon for instance has many low value customers, yet has much better support across the board.
> I would also speculate, that if you were instead, say Pepsi-Co, you would have white-glove service from both tech giants.
Oh absolutely, that's no secret. I know account managers that had a single big customer at one of these companies. It's part of the sales org basically.
> Basically it's these massive bayesian filters that output how suspicious some activity is.
It almost feels like the digital equivalent of racism, xenophobia, homophobia, and other prejudices; people are suspicious of anything that stands out as being somehow "different." Now computers are suspicious and prejudiced because your digital appearance looks out of norm.
> This approach is understandable from a business perspective, but imo deeply troubling for an open society.
Agreed.
Total coincidence that it's also "you're not being a good little data source", I'm sure.
I use a privacy-oriented browser on my cell phone to load amazon's website to get that stupid whole foods QR code for the checkout, because I'm not installing their fucking app so it can collect more data on me.
Guess what? Every single time, I'm presented with a "we've emailed you a link" error, and that link is difficult to open in my preferred browser because iOS doesn't offer it as a choice for opening links...
100% coincidental, of course :)
> that link is difficult to open in my preferred browser because iOS doesn't offer it as a choice for opening links...
Hmm, wasn't that fixed? Perhaps it's the email app that won't let you? I seem to be able to open many links in Firefox on iOS these days, but in some cases Safari is indeed the only option.
First thing I do when creating a new Gmail account, using a "supported" browser, is to save the required parameters of the cookie in a text file then convert the file to a simple shell script, powered by netcat and TLS proxy. This only takes me takes seconds. Then I close the supported browser without logging out. The word "sketchy" seems applicable because unlike, e.g., a bank website, companies like Google and Facebook will let users stay "logged in" for some ridiculously long period like one year. Yikes.
Two ways to disable the script are 1. log out of that session (://mail.google.com/mail/logout?ec=ABCDEF, ://accounts.google.com/Logout?service=mail&continue=https://mail.google.com/mail/, ://mail.google.com/accounts/ClearOSID) or 2. change the password.
This tiny script can be transferred to any computer and used to check and send mail from the command line. No browser, Javascript or password required.
Netcat, the browser of the future! :)
People are having their lives ruined when their account gets breached which Google prioritizes over avoiding accidentally blocking a few odd users.
So there's some evidence that this sort of nonsense can be other than malice.
OK but that also describes pretty much all the Web browsers the vast majority of Web users actually intend to use, right?
One of the most discussed projects on HN in the past year or so has been GPT-3 which is (was?) pretty hard to get access to.
If you're not on a whitelisted browser by Google, you can't log in (effectively, use) any of their properties.
This feels very anti-competitive to me. Notably all the whitelisted browsers are either theirs (Chrome) or sell them their search traffic. I'm building a browser for research [2] and have to frequently find workarounds. I'm not quite sure who I'd contact to get on said whitelist either...
[1] https://imgur.com/a/DASVkhl (here is the issue in the Vim browser and Min browser)
[2] https://synth.app