News for hackers. Stuff that matters.
Re:Updating our inactive account policies by withinboredom on Tuesday May 16, 2023 @03:38PM (#35966696)
This ... is not what is going on. When I worked at $bigcorp serving billions in traffic, what happened is that botnets would create accounts and leave them dormant for weeks/months/years (thousands of them), then start doing their bot thing. Account age says a lot when it comes to trust (usually) and spam detection. That's more than likely what they're seeing, not 'compromised' accounts.

All this does is tell the spammers exactly how long they are going to be allowed to have 'sleeper accounts' for, the problem won't magically go away.

Re:Updating our inactive account policies by vore on Tuesday May 16, 2023 @03:41PM (#35966734)
I am sure Google of all companies has enough insight into account behavior to conclude this is the case for them. It's not like they can't verify it either: if the account previously had legitimate activity and is now compromised, it's not really a sleeper account.
Re:Updating our inactive account policies by orbital-decay on Wednesday May 17, 2023 @05:50AM (#35973186)
Bots, antidetect browsers, and residential proxies exist specifically to imitate the activity and circumvent fraud prevention systems like Google's. Most accounts get caught, but many slip under the certainty threshold. This is a cat and mouse game, and sometimes mouse wins by blending into the crowd.

With LLMs it suddenly became much easier. I suspect that the timing of this decision might be not random.

Re:Updating our inactive account policies by nullityrofl on Tuesday May 16, 2023 @03:46PM (#35966808)
> This ... is not what is going on.

I am reasonably confident that Google are more aware of what's going on with dormant accounts on their platform than you are. I previously worked at Google in Security and while it wasn't in user protection, I know they have quite a few signals for determining compromise. It's pretty trivial to see that an account that was in legitimate use for 5 years and then dormant for 5 vs one that was created and left dormant for 10.

Yes, on Google and on other platforms, account age is a valuable reputation signal but it isn't the only one.

Re:Updating our inactive account policies by withinboredom on Tuesday May 16, 2023 @04:42PM (#35967477)
Yes, we saw the same thing. But when spot-checking the activity we realized it was super-low-effort legitimate activity. IOW, it could have been sweat shops or scripted bots going through some motions.
Re:Updating our inactive account policies by nullityrofl on Tuesday May 16, 2023 @06:36PM (#35968707)
I promise you Google is running user activity learning models that go well beyond spot checking the occasional account.

Google deals with abuse creation accounts in the hundreds of millions.

Re:Updating our inactive account policies by withinboredom on Wednesday May 17, 2023 @03:42AM (#35972349)
You still have to supervise the models and ensure they're working as designed and general quality control. Though with the number of 'Google disabled my account for no reason' posts, I assume they're not doing that, especially when I read comments like this, I assume its a part of maintenance that people don't consider when it comes to AI.
Re:Updating our inactive account policies by hackernewds on Tuesday May 16, 2023 @03:49PM (#35966848)
Exactly. If Google were to rely on activity, then the bots would simply post now and then akin to human behavior and remain active.
Re:Updating our inactive account policies by jsnell on Tuesday May 16, 2023 @03:47PM (#35966829)
Are you suggesting that they're too incompetent to tell the difference between bulk account creation and hijacking, or that they're just lying about the reasons for why this change is happening? The former idea is pretty arrogant, the latter is unmotivated.

Especially given you're talking of "thousands" of accounts, I suspect whatever problems mattered to you the most were not the same as those of Google's account system.

Re:Updating our inactive account policies by danpalmer on Tuesday May 16, 2023 @06:26PM (#35968606)
This could also just be a simplification for the purposes of this announcement.

They mention this being mostly about security and preventing the use of hacked accounts, and they mention these dormant accounts that were only created and then went immediately dormant. It makes sense to me that they are in fact talking about this issue, just not explaining all the detail.

Re:Updating our inactive account policies by nkozyra on Tuesday May 16, 2023 @03:51PM (#35966864)
I can't imagine a more bruteforce approach to a known pattern, then.

If the only indicator you have for spam potential is [created an acccount] + [was inactive for some period], I can't imagine the other myriad spam vectors aren't getting hammered 24/7.

Re:Updating our inactive account policies by TonyTrapp on Tuesday May 16, 2023 @04:10PM (#35967106)
> This ... is not what is going on.

I wouldn't discredit it so quickly. I have seen lots of old accounts being taken over on eBay lately for scam auctions. It seems to become more and more common. So this could very well happen with Google accounts as well. It makes them more credible for whatever scammy thing they are being used for.

Re:Updating our inactive account policies by nitwit005 on Tuesday May 16, 2023 @07:46PM (#35969359)
That's possible, but the storage costs of unused accounts is probably significant. Given billions of users, they probably have several hundred million of them.

Previous company I worked for had to create a process to clean up unused developer accounts. The fact that they were free to sign up meant we eventually got quite an impressive amount of them.

Re:Updating our inactive account policies by withinboredom on Wednesday May 17, 2023 @01:59AM (#35971741)
Meh, you move that data to cold storage and if they ever come back, it just takes longer to log in. They are already physically migrating data to closer data centers for you, so it isn’t any more complex than what they’re already doing.