[3eb7988a1663]

This Kafka nightmare is somewhat funny when it does not impact your life, but with increasing centralization, I worry for the future. What happens when an AppleID/Google account in good standing is required to open a bank account? Go grocery shopping? Hold your drivers license? Apply for a job anywhere?

Big tech has repeatedly shown that they are willing to ignore life destroying account workflows so long as they only impact a minority.

[don-code]

Sadly, you don't even need to engage directly with these companies to be affected. Case in point: e-mail.

I host my own e-mail. Valid SPF, not on any spam blacklists, good reputation score on my static IP.

At the beginning of November, I lost the ability to send e-mail to Gmail - it was all rejected as, quote, "possibly spammy". Double checked SPF and DMARC... Double checked documentation... Spent time setting up DKIM on my mail server, even though I sent nowhere near enough mail to merit it. Nothing got through for two weeks.

Google Postmaster Tools were totally unhelpful, telling me _that_ I was being blocked, but not _why_ I was being blocked. There is a community support forum where I posted - it hasn't seen a response since I posted in November. There was also a support portal where I could, in theory, contact a human. I sent something in there, and am still awaiting a reply.

Now remember, Gmail isn't just for @gmail.com addresses. Gmail hosts my accountant's domain. Gmail hosts the domain for a club that I'm part of. Gmail hosts friends who also have their own domains. Gmail hosts... well, probably a solid half of the Internet's e-mail.

My only way out of this nightmare was to reach out to a contact at Google, who - having an @google.com e-mail - was also unable to receive e-mail from me, and made the case to the right folks internally that I couldn't send important messages to him. A few days later, I could magically send e-mail to Google again.

Do I have any idea what I did? No. Do I have any idea what they resolved? Also no. Can I prevent it in the future? Who knows!

[AnthonyMouse]

I'm increasingly of the opinion that the modern practice of not telling people why they've been blocked -- or even that they've been blocked -- was devised by sadists to satisfy their proclivity.

The core of the flaw is that actual fraudsters and spammers are repeat players and ordinary people aren't. The bad guys expect to be blocked, so they test for it. They check if their messages are getting through and then notice immediately when they stop. Whereas real people expect their messages to go through, because why wouldn't they when they've done nothing wrong? And then become isolated and depressed because it seems like everyone they know is suddenly ignoring them.

The bad guys create thousands of accounts and play multi-armed bandit, so when some of them get blocked they can identify why by comparing them to the ones that didn't, or create new ones and try new things until something works, and thereby learn what not to do. Whereas real people have no idea what sort of thing is going to arouse the Dalek either before or after their primary account is exterminated.

So it's a practice that creates a large increase in the false positive rate (normal people have no way to know how to avoid it) in exchange for a small decrease in the false negative rate (bad guys figure it out quickly). In a context where false positives cost a zillion times more than false negatives because the bad guys treat accounts as a fungible commodity they acquire in bulk whereas innocent people often have their whole lives tied to one account.

And all of that is only disguising the real problem, which is that people get blocked having done nothing wrong. If you were expected to point them to the spam they sent or the fraud they attempted then you wouldn't be able to do it when they'd done no such thing, and then "we can't tell anyone because it would help the bad guys" is used to paper over the fact that you couldn't tell them regardless. When the decision was made by an opaque AI and then reviewed by no one, there isn't actually a reason, there's just a machine that turns you off.

[ssl-3]

Towards the end of using self-hosted email at $dayjob, a couple of years ago now, Google started bouncing [some of] our email.

In the header for the bounce messages was included a description of the problem (as they perceived it), and a link for background reading.

I never followed up on it personally (that wasn't my job anymore because reasons), but the bounces seemed descriptive-enough for someone who was paid to care about it to make it work.

Was that not the case for you?

[sgerenser]

That relies on the email actually bouncing. I think it’s more common for it to just silently be filed as spam.

[auxbuss]

I also host my own email. In my case, Google always routes the first email I send to a new Gmail address as spam. After the recipient marks the email as good, future emails are received as expected. The only way around this is to advise the recipient via Gmail that I've set an email to them via a different route, so that they can check their spam and mark the email as good. This has been going on for at least two years.

Basically, Google are shadow-banning me till they get caught. I think this should be illegal.

[anonymousiam]

This sort of thing is already becoming a reality. Not necessarily with Apple/Google IDs, but with email addresses. As the owner of a few dozen Internet domain names, I use some of them with catchalls so I can create new and unique email addresses for various entities I correspond with.

Sometimes this has failed, because the entity uses some third-party validation service that can find no record anywhere of the existence of the new email address. So it's sometimes impossible to register a new account somewhere unless you use an email address that is "known" to the validation system.

I'm not sure what "problem" they were trying to solve by doing it this way, but they've created a new problem by doing it.

Also, sometimes I've tried to use very short email addresses such as: [e-mail], and they're flagged as invalid even though they're not.

I've also had valid accounts disabled without notification because the email address I used had the name of the entity within. E.g. [e-mail] Some companies assume you're trying to impersonate them if you do this, and silently disable existing accounts. Usually the tech support staff aren't even aware of these restrictions, which makes it even more difficult to recover.

[josefritzishere]

I have had thsi exact same problem. It's even blocked me from applying to jobs.

[somenameforme]

Amish 2.0?

I realize this sounds out there, but I'm not entirely joking. I feel there is a significant subset of all people that are not particularly happy with the direction of society at large. And the great thing about places like the US is that you're free to develop your own little sub-societies. There's no reason a group of like-minded people could not work to develop a technologically embracing society, but one that aims to focus more on decentralization, and utilizing digitization as a convenience rather than a necessity.

Think about something like a 'Google Smart City' except from an entirely different ideological foundation, such that the entire project doesn't sound like something out of Black Mirror. The reason this would be beneficial as a social project, instead of the vastly more viable independent one, is that a lot of tech is generally seen as undesirable, certainly in certain contexts (like smartphones at school), yet it spreads virally making its adoption a defacto necessity. Get rid of the virality and you could create a better life, and a better situation, for many people.

[AnthonyMouse]

That actually seems like an interesting project.

Get a bunch of hackers and DIY small farm folks etc. to move to the same place with the goal of disentangling themselves from megacorps. To begin with it increases the local concentration of people who want that and then causes local businesses and agencies to start serving their needs better because they're a higher proportion of the local population. And it puts the people so inclined in closer proximity to each other which improves coordination.

If you got enough of them you could even affect local ordinances and then e.g. pass strong right to repair laws or laws against businesses requiring you to use one of the major phone platforms. How many localities would need a law against remote attestation before companies would have to stop using it against people?

[akkartik]

The best answer I have is: for those of us who start life with some level of privilege, it's important to make good decisions and manage your risk exposure. Life is geopolitics.

But yeah, I'm not looking forward to the day I need to show a Google or Facebook account to receive government services. US Visa applications are already going in that direction.

[userbinator]

What happens when an AppleID/Google account in good standing is required

At this point Big Tech is only scared of the government, so keep that in mind --- the Amish may be on your side.