It goes pretty much like this. If your problem needs “reasoning” that entails more than matching a direct solution, you’re getting the default answer that’s the closest match to the solution.
The only difference between live support and support docs is that live support has access to some of your data and controls over some flows (e.g. reset password)
Now the real kick - it’s like this across the board outside of tech. If you go to a hospital with a problem that is not the 95 or 99 or whatever they are “tuned” to deal with, your pretty much fucked, unless you can be resourceful or luck enough to navigate the structure until you find someone that actually knows how to.
Bureaucracies? Same.
It’s effectively the same dumb machinery with dumb human cogs that you’re always dealing with.
I think it’s simply the “limit” of average human intelligence and find it hard to believe AI will end up being dumber than this.
If your point is "it is today's norm, let's accept it and shut up", I feel the opposite. If the "norm" is like that, expressing it aloud is my way of contributing to society.
The problem arises when the bureaucracy becomes, at least for portions of the organization, the end in itself rather than a means to an end (the end being something like better service, efficiency, and accountability). That's when it starts to contribute to frustrations and bad experiences (and, if allowed to continue in this vein, enshittification).
Bureaucracy does not cause things to get worse. It's not a bad rash that the system displays when it's about to get worse or the puss discharged when it's irritated.
Bureaucracy is a response to a system that works well. It adds rules and hierarchies and red tape to maintain the system state as it is. It's organizational glue.
Bureaucracy is only a problem when trying to change a system.
The problems isnt the cogs, its the business owners setting up the incentives. Providing reasoned support is expensive from a time and effort perspective, so they dont invest in it. Service reps are specifically trained and incentivized to just fuzzy match the SOPs
And AI cant reason either, so it wont be able to provide any real reasoned support either. And the pwners dont care because they already provide shit service, people like you will just hype the AI up and then make excuses for it when its just as shit
Business incentive— if you can make an argument on why would a corporation provide shit support to its own employees you win. Also make an argument on why support is actually good at Amazon and others like them. So I don’t buy your argument on incentives either. Although there are other implications related to incentives and AI in general, but those are off topic.
You’re always going to do the bulk of support through L1, and L1 support is going to be limited in terms of training and access.
But! The intended flow is that L1 recognizes when an issue exceeds their ability and escalates it up to L2+. And that’s where your talented (and empowered!) support engineers work.
That escalation just doesn’t seem to happen any more.
My hypothesis is that it’s a consequence of L1 being outsourced, where now they’re heavily incentivized to avoid escalating and impacting their probably-contractual KPIs.
Yet another cost for adding too many parties to something that could be better if it were simpler.
But its not a cost from the perspective of the companies doj the outsourcing: the incentives are the way they are because the result is intended. Its not a cost of adding an extra party, it is part of the reason the party is added.
It’s entirely possible for a whole organization to want a good outcome, but construct an org chart where bad outcomes are guaranteed by the misaligned and incomplete incentives for sub-divisions.
E.g. the IT support org that is only measured on total spend and time to ticket closure
You changed actors mid-sentence. The workers in the organization may want good outcomes but they are near-invariably separate from the people making decisions for the organization.
The organization (including the bulk of employees and executive leadership) may want a good outcome, but sub-divisions’ (aka the org chart) may have have their self-interests set to inevitably produce a bad outcome.
>it’s well-documented that sometimes, even if you don’t have 2FA turned on and you know your password, they simply won’t let you log in without some sort of additional verification
However, this isn't quite fair on google - it's not arbitrary "sometimes", it's that accounts get locked if there's been unusual or suspicious activity that may indicate an attempt to compromise the account, such as failed login attempts or logins from a new location. The account is locked from single-factor (password only) authentication for a period of time to prevent compromise (which isn't disclosed but as I understand can vary and is usually a week or two), but will allow login with an MFA challenge.
If the account is locked and there are no MFA methods set up or other means of recovery like backup passwords, how are they meant to verify that it's you recovering the account and not an attacker?
Supposing you did manage to talk to a live google support agent, you'd still have the same problem of not being able to verify ownership of the account.
Note that there is no question who owns the account. That's what the password is for!
This should probably be the case - I am not a big fan of passkeys [1] but hopefully this will help make non-SMS, phishing resistant MFA available to the masses.
Still, Google are in a difficult position where on the one hand they have people angry about being locked out, and yet if they didn't they would have people angry about their accounts being compromised.
> If that means my account gets compromised, that's my problem.
It is also the problem of everyone on your contacts list, the operators of other services which use Google OAuth for login, anyone who might recieve spam from your compromised account, and so on.
Reducing harm by temporarily restricting the account when heuristics indicate it may be compromised is not unreasonable IMO.
>Note that there is no question who owns the account. That's what the password is for!
This is unfortunately not as true as we would like it to be.
Have a look at the list of compromised services on Have I Been Pwned [2] - not all of these include passwords, and many that do would be hashed (and hopefully salted) rather than plaintext, but it still happens often enough to be of great concern.
[1] WebAuthN / Passkey technology is fine in the general sense, and I am quite happy to use it with a hardware security key (such a Yubikey or Titan) or emulated in a password manager.
However I think the recent push towards having it tied to a TPM on a device such as a phone is a bit short-sighted, simply because these devices are prone to being lost or damaged. If you set up passkey MFA on the phone and don't enrol a backup method, then lose your phone, you have also lost the account. Probably these services should require 2+ MFA methods configured.
I'd be surprised if that was true. They don't just consult me about MFA, they downright pester me about it.
Besides if you wait long enough Google unlock the account anyway (if it's due to suspicious logins). I know, because it happened to me. I don't know how long it took, all I know is when I happen to check a few months after I thought I had lost access to the account, I could login again.
Finally, it's not like they have a choice. They have to protect the reputation of their domains and servers. It may seem unfair that you cop it if there are security issues, but you got the account for free and you refused to use the numerous MFA options the provide. If someone nerfarious takes over an accout to distribute spam or malware there is a mess that costs time and money to clean up.
There is a real point to be made about how Google / Microsoft and friends message accounts. But it's hard to sympathise with complaints about free ones. Paid for ones, where they promised a certain level of service and then withdraw service without warning and without the ability to recover your data (as I think happened to to the ICC) is a different matter.
It really drove home that trusting my identity and online presence to these entities that do not care or even know how to be responsible about it is a very bad idea.
Always take the "manual" OTP option, take a backup copy of the code you copy and pasted. I use my password manager
Then, always export the contents of you entire password manager database, encrypt it with the same password you use for you password manager with the pdkf2 rounds set to an absurdly high number and place it in a public place on the internet. Lots of places will host it for free.
Presumably the excuse is that it happens because you don't use 2fa and your ip changed, but I heard 2fa might not save you either.
A single support incident that reaches a paid worker on their side costs them more than the profit you’ve brought them for the year. It probably costs them more than the profit you’ll bring them for your entire life.
With less scale-y businesses, it’s worth it for them to put some effort into fixing problems, as an investment in your future business. Here, the only reason would be to avoid reputational damage. And who’s going to stop using Google or Microsoft because some guy had trouble getting support?
There’s a story (no doubt apocryphal) about Bill Gates telling people working on Windows that a customer calling their support line cost as much as the profit they made selling that copy of Windows. The point was to make it so Windows users didn’t need to call support by making Windows work better. The modern equivalent of this would be to make sure that users can’t reach expensive support in the first place.
What would be the opposite?
With enough blindfolds all bugs are unimportant?
There is no excuse for being lazy.
While you are consuming product and paying, you are basically identical to everyone else doing that (except for your varying personal info). That can be scaled in straightforward ways.
If you have some problem that requires attention to your account, that doesn't scale well. Even if it could, it's not worth it to them; it's off the happy, revenue-generating path.
With Google, it’s well-documented that sometimes, even if you don’t have 2FA turned on and you know your password, they simply won’t let you log in without some sort of additional verification… which may not be possible. This hit me once while overseas, I think I managed to get in by tunnelling through my VPS in Australia. And if you can’t do this, you’re stuck, because Google simply doesn’t have support.
With Amazon, I was finally able to find one way of contacting them that didn’t require signing in, and when I finally got to a human, the problem was immediately fixed.