...Only to find that you can't transfer ownership of a Google Doc from a Gmail account to a Workspace account because "security."
So at this point we have docs scattered across all kinds of Google accounts and domains which is the least secure thing I could imagine, great job Google.
100% in support of regulating the pants off of this company as well as evaluating alternatives to them.
But in essence: Share the files, make a copy once shared, delete the shared file and only the copy exists.
Better though: Don't use Google Drive for business critical docs if you're not a very high spend Google customer able to talk with an account manager. If you're a small/hobby user or individual, keep critical docs offline as well as online. Just consider it part of your business continuity plan.
I'm not saying Google is great: what I'm saying is that once you pay even for the smallest business suite, you get to get actual people on the phone who are there to help you.
I set up a business account in one country and then moved to another country. Several years later I need to re-enter credit card info. It doesn't let me now because my billing address is now from a different country. Google's only solution? Create a new google account.
But are you sure about this problem? If you create Shared drives in a Google workspace, they take ownership of anything I move into it (after dismissing a warninge explaining what will happen), even if I take files in folders shared to me from someone else's gmail account
(The ownership model of drive was indeed terrible before they implemented the shared/team drives.)
It should also be noted that as soon as that regulation no longer applied (Brexit), high roaming charges were immediately brought back in to effect.
EU-style regulation works.
Rationale was that treating people from one EU country differently than from another was against the union. Imagine paying inter-state roaming in the US.
Companies will charge what they're allowed until either the market forces them to behave, or failing that, the government.
Right now Google is not asking information that would allow them to really verify my identity. Not sure if people would like Google to start demanding that kind of information, like personal identity code (for countries where it is available), passport numbers, home addresses etc.
Without strong identity checks, the system is prone to fraud. Black hats can either social e engineer their way around the support agents or use leaked personal data to impersonate people to gain access to their accounts.
Why can't they offer identity verification as an option? It's not exactly difficult to do technically.
How to do this exactly? Do you want Google to be proving who people are by fingerprints, irises? Google has never gotten into this business. There would be so many issues. And is collecting biometric info an absolute bulletproof way to verify identity? And doesn't have pitfalls compared to current system?
Then how about just ID documents? Who would provide the locations to verify these documents? How many hundreds of types of documents would be suitable to prove identity? And thousands of locations would be necessary to serve everyone. Would they be honest / absolutely trustworthy?
Do you know how many people out there are waiting to try impersonating people by forging documents, given the money at stake, and how many outlets (that you'd have to employ as verification agents) would be susceptible to corruption to defraud people who'd relied on these documents as proof of their identity (and keys to their online accounts)? If you register with an identity document, and that becomes your method of proof, what if someone located in another country asserts that they're you with some different form of a document that says your name on it?
It's extremely complicated.
If banks can do it I don't see why Google can't. For many people, getting locked out of a Google account where they hold all their photos, connect to people via email, have their purchased Android apps, etc. is not much better than getting locked out of a bank account (depends on how much money on the account, I guess, but in many cases this is so).
Whereas your google email is known to many. What happens if some one photoshops a ID and says it is you?
Further more how should the ID prove I am the owner for john.doe@gmail?
The fact is that Google is already in the business of authenticating identities and actually does so in circumstances where the law compels them to, but they have deemed it too expensive to do so in the context of recovering accounts, where they remain uncompelled.
As it stands, the GDPR compels Google to make a meaningful attempt to authenticate whether you are the legitimate account holder when you submit an SAR or Data Deletion Request. But, Google, under no circumstances will attempt to identify you if you fail or are deemed ineligible for their automated account recovery process, unless you are eligible for their "In cases of nepotism or media pressure" emergency account recovery procedure.
Your email is not your identity, and your particular email address is not a right. If Google has made available options to secure your email address, what exactly are you entitled to compel Google to do that does not conflict with the security decisions they've also made to protect your account from fraud?
Google seems to disagree https://developers.google.com/identity/gsi/web
The fact is that these corporations are not innocently providing simple little services that users might occasion to use for a bit of time and then freely put down; they provide services that grant them at times more power than nation states over the lives of individuals who are completely powerless to respond. Given that they wield power over a service which is not optional for most of their "clients", whether or not they meant to (they meant to), they are providing a public good. And if they are unwilling to do so in a way that aligns with the values of the citizens of ostensibly democratic nations, then the citizens of those nations should vote to either compel them to offer their services in alignment with the public good or have their property and right to conduct business in that nation seized.
And whether or not many are aware of it, this would not represent a sea-change in policy for any Western government that I know of. This would simply be the very late, but reasonable extension of more than a century of well-established legal precedent that already exists. For example, in the United States, we call corporations that are regulated in such a manner "Public Utilities", in Germany they are called "Öffentliches Versorgungsunternehmen" and in France they are called "Entreprises de Services Publics" and in Spanish they are called "Empresas de Servicios Públicos"
I have a google account made in 2004 (it is nearly 18 years old) and some time ago youtube started to ask me to verify my age by sending my ID or using a credit card.
I think it was a "bug" on their side, since a google search showed a lot of other people complaining about this -> verify your age.. on a 15+ year old youtube account.
Solutions like yubikeys and passkeys theoretically solve this problem, but open other problems: not least what if you lose the key or the device that the passkey is stored on? Then you're no longer you as far as the authenticating party (Google in this case) is concerned. What's more, whoever stole your phone is you as far as they care, because that's all they have to say who is who.
Your devices should require further authentication (password/biometrics) but is that a guarantee? Could Google or anyone else really guarantee that any client device connecting to their service is unhackable, bearing in mind that many of their users may be on cheaply made and fully out-of-support Android devices or Windows XP?
It's a really hard problem to solve.
Google at least have your past IP addresses which should allow law enforcment to identify you (at least narrow the question down to a handful of people who could all be asked if they have a claim to the account unless you only ever accessed it from public networks). Doing all that detective work is not going to be cheap but right now you don't even have the option to pay for it if your online account is worth a lot to you.
Once it will be understood, losing xx-years accounts wouldn't be a problem.
I know this is controversial idea, but the more I see cases like that, the more I am sure about it
Problem is the "society" around us (for lack of a better word) treats IT services as something reliable, see how more and more countries go digital/electronic only when it comes to payments or relationship with the government.
Until everyone can agree on a better system, your e-mail is your online identity across countless websites. This makes losing your e-mail (with no customer support to regain access) a huge vulnerability in everyone's personal life.
I would go even further and demand regulators to define standards to enable migration or self hosting.
Google provides a way to "submit corrections", but there is no accountability, and these corrections might or might not get applied. In my case, they are sometimes applied: some phones will show the right location, and some will show the wrong one. Again, no accountability.
This probably doesn't prevent SIM swapping entirely, but you will need to also steal the other SIM card you're swapping the number to.
Here is an EU article warning about it.
[0]: https://www.enisa.europa.eu/publications/countering-sim-swap...
Yes
Article 22 of the GDPR. Essentially it sates that if automated decision making occurs, you must be able to appeal to a human.
https://www.gdpr-toolkit.co.uk/individuals-rights/the-rights...
This is aside from common law, which might give some protection in that entities managing your goods (and maybe your data?), even voluntarily, have a have a duty of care to keep them safe.
A phone number used for this purpose would definitely identify a person, and so qualify as personal information.
What solution could Google offer without creating a security backdoor? Google might not ever be sure as to the identity of the account holder.
The only reliable alternative I see is requiring a government photo ID containing a permanent physical address on account creation. I wouldn’t want that, would you? And even then, some would manage to create impossible situations.
It sucks, really hard. No other way to paint it. I’m not arguing for Google here. Still, the user has responsibilities too. If you ignore an oil warning light on your car for too long, eventually the engine breaks.
The comparison falls flat though when you consider that you can pay money and get the car fixed and still have the car in the end.
The complaint is not "fix my self-inflicted problems for free for me", it is that there is no way to get anything fixed even if one is willing to pay and acknowledge it's one's own fault.
If this has happened (and I can think of a few other ways for this to all go wrong that involve less carelessness on the part of the account holder) it’s quite substantially more serious than having to pay to fix a car.
There are very real consequences to not having access to an e-mail account that reach far beyond the hassle of creating a new one. They reach far beyond even losing your current emails.
Google (and others) slick account creation funnels belie the seriousness of what you’re doing and the devastating consequences if anything goes wrong.
Regulation is needed urgently, but will only happen when enough famous-but-not-famous-enough-to-get-special-treatment people complain.
Given this requirement, free accounts will probably not be possible. If a person uses a free email account for critical transactions, what can one say? There’s a bigger issue here regarding our increasingly digital lives that needs more comprehensive change than regulation of some areas.
Paper mail delivery is guaranteed in most of the industrialized world, more or less. Email is increasingly used as an alternative but is entirely the recipients’ responsibility. Receiving paper mail costs nothing, that’s probably why so many people choose a free provider like Google.
Also, how would you solve the issue of identity verification in case a user loses means of access?
All of this falls apart if the goods/service is free... And one can't really argue Google is a monopoly with regards to email services (search and ads are quite separate).
So I doubt EU could do anything about it unless one uses paid services.
That was very true, but I think this is changing. Recent dealings with Facebook and the privacy regulations give some hope there.
> And one can't really argue Google is a monopoly with regards to email services
EU regulations do not care about monopolies. The main issue is abuse of dominant position, which Google definitely has. The mobile carriers is an appropriate comparison, I think. None of them has anything like a dominant position across the continent, but their collective behaviour was suboptimal and costly for the customers, which was a strong enough motivation for the EC to intervene. I can see a blanket regulation about the processes that need to be put in place to close or recover accounts. In the same way that these companies are required to have dedicated people for GDPR requests.
Also note that EU regulations are much less concerned about random customers than American laws. The EU framework is all about competition and how to preserve it, under the arguable belief that quantitatively increasing competition will benefit the final customers.
If you take deliverability to the average email account into account then they are not far from one.
For example GDPR, right to be forgotten, cookie warnings etc show the EU is more than happy to pass regulations that impact ad-supported services.
The current regulations may be ineffective or poorly enforced - but it shows they're able and willing to pass laws.
Just because a service is free does not mean consumer protection and data protection laws (including GDPR) no longer apply.
Why would you think otherwise?
Closing that loop hole was valuable.
If roaming charges were high because there wasn't enough competition in the market then that's what the EU should have tackled. Otherwise high prices will just move on to other items on our phone bills and the whole thing becomes a game of whack-a-mole that the best connected special interest groups will always win.
Governments should regulate to make sure that markets actually work and that everybody has basic rights such as getting access to their own data after proving who they are.
Really, the people that don't are rare.
The Instagram/TikTok feeds of 20-25 y/o are full of these lists of European cities you can visit in a weekend with a low budget.
See also: Erasmus.
The people who benefit most are those who cross a border to go to work, those with family in a different country, and normal people taking advantage of the unsustainably low prices of intra-EU flights. Not really rich people.
I think your post is in poor taste.
Regulation has gone swimmingly, especially when you consider that roaming charges were completely arbitrary. It costs a carrier functionally nothing to forward traffic to another carrier, eçept for whatever price that carrier has set arbitrarly. Regulation has given me a 25 Gb data cap when travelling, greatly increasing the quality of my vacations, allowing me access to information, safety tips and travel-oriented services as a tourist.
Sure, carriers have lost some income over this (not all, only on european travel) but they are massively profitable, and should be treated as a public utility already.
Once you are the dominant provider of something that is nearing life-essential utility status, you should provide support and escalation routes, and you should be accountable.