Tell HN: Dropbox user age verification feature can lock your account

https://news.ycombinator.com/item?id=30945199

by gitrog • 4 years ago

119 93 4 years ago

news.ycombinator.com

Dropbox released a "user age verification feature" today, which is a simple set of drop downs for you to fill in your birth date.

I made the mistake of choosing "2022" as my year of birth instead of my actual year of birth.

Obviously this is my mistake, but a warning to anyone else: I now have 48 hours to backup my files before I will be locked out of my account, and Dropbox support has been unable to confirm that they can fix the "issue" for me.

I think this is the single worst "feature" I've ever encountered in a software application. I'm honestly shocked.

alpaca128• 4 years ago

Obviously this is my mistake

No, it isn't. 2022 should not be a valid date of birth in the first place. And the account being locked because of that should probably also not happen without additional checks.

It's okay to have standards even when most UIs are bad.

globular-toast• 4 years ago

What should be the lowest valid date of birth? Is there some universal standard? I know it feels like 4 months is quite young, but where would you draw the line?

rolph• 4 years ago

it varies from place to place but perhaps the minimum age for participation in a legal contract/useragreement to be binding

causi• 4 years ago

I believe many countries have special laws about the online activities of children below the age of 13. Seems like a good cutoff.

xeromal3• 4 years ago

At least in the US, I don't believe you're supposed to use the internet unless you're 13 or older. You could start there for your dropdown.

xjay• 4 years ago

Coder sees "We need feature X". Coder implements feature X, marks it as complete; next.

So they have the coder (implementer) role covered, but not the "programmer" role ("thinker"/feature designer).

Leslie Lamport - Thinking Above the Code: ~ A lot of people like to think that they're thinking, but they don't really do much thinking. [1]

Evidently, there was no expectation that the coder/implementer was supposed to do any thinking here.

[1] https://www.youtube.com/watch?v=-4Yp3j_jk8Q&t=134s

willcipriano• 4 years ago

This got past the undoubtedly upwards of nine product managers/business analysts/directors/etc on the team as well. Blaming the low man on that totem pole in a organization thick with management like that is silly.

None of the "idea men" had the idea of "what if someone's cat walks across the keyboard when we ask them their birthday". That's the embarrassing failure here.

reset-password• 4 years ago

I've gotten into the habit of being born on January 1, 1970. Seems like a good enough date to me.

jrockway2• 4 years ago

I always like to see how old I can make myself. 1902? (The 2038 problem in reverse.) 1776? 5 B.C.?

My experience is that I can usually only go back to the 1930s.

__david__• 4 years ago

Ha, I do that as well. They're almost always menus and so I just pick the bottom-most box. Steam thinks I'm 120 years old.

lancesells• 4 years ago

Same here. I imagine someone at the company in some meeting: "We've even got a couple users who are in their 90s!"

felipellrocha• 4 years ago

I'm born on January 1st, <Scroll down far enough>

Brian_K_White5• 4 years ago

Hah, now you say it, I realize the distribution must look really funny. Wow whole lotta people born on jan 01! And stranger yet, no curve.

tpxl2• 4 years ago

This is how I got locked out of my 10 year old skype account (good riddance). The support _cannot_ do anything due to some silly child protection laws (coppa maybe?).

dragonwriter2• 4 years ago

The age verification feature is for COPPA compliance, but I’d really like to see the provision that prevents correcting errors.

tpxl2• 4 years ago

They will correct errors, after you give them a bunch of document scans or a credit card. I wasn't willing to provide that to a random foreign company for a free service, I just moved to Discord.

henning• 4 years ago

rsync + a bash script doesn't sound so bad now. (I don't give a fuck what the market or normies want)

marcosdumay• 4 years ago

There are stuff like NextCloud now, that you can run by yourself.

Rsync + a bash script is horrible to get going in a mobile device. (What is the fault of the mobile OSes, and if you can get by with a less hostile one, great for you.) Those open-core ones put some work on it.

spicybright3• 4 years ago

I use syncthing to sync my entire phone. Now I have a 64GB folder on my desktop that /is/ my phone, but all normal local files I can treat like any other file.

Taking a picture with my phone and having it show up on my computer in 5 seconds is pretty close to magic in terms of file sharing.

Completely free, andno central server to introduce "age verification" or whatever.

varenc2• 4 years ago

I've been seeing age checks like this more and more.

Recently the FTC came down hard[0] on Kurbo (aka Weight Watchers) for not doing enough/anything to stop children under 13 (COPPA) from making accounts. Since they're not confident there's no children with accounts, now all Kurbo's data is tainted and they have to delete all user data and destroy any "algorithms" derived from that data.

Historically Dropbox probably never asked for a user's age so they might worry they could run into this problem in the future. The threat of all a company's data being tainted is a huge one, so of course they're now overreacting a bit.

p.s. hopefully you can get your account fixed, but if not, you could use the amazing rclone[1] tool to copy your files off. (it's rsync for cloud storage). Or you could just put them in a folder shared with another DBX account.

[0] https://www.ftc.gov/news-events/news/press-releases/2022/03/...

[1] https://rclone.org/

armchairhacker• 4 years ago

Kurbo is really controversial though. It’s a health tracker specifically for kids, as young as 8, which focuses on calories and weight more than nutrition. And it tracks everyone’s data, so because of technicalities if the child is under 13 the parents have to sign them up (still tracks their data).

hungryforcodes2• 4 years ago

OK but if you read the link you included WW specifically MADE an app for children and collected the data:

"the agency... marketed a weight loss app for use by children as young as eight and then collected their personal information without parental permission."

That is pretty wilful -- so we can be confident they have or had data targeted from children. Dropbox on the other hand -- I'm not sure how that case is similar. Are children now allowed to use cloud backup services? Why wouldn't they?

varenc2• 4 years ago

Fair point! That does seem like a key difference. But I still wouldn't be surprised if all tech industry legal/compliance teams have been spooked by this. Also under COPPA no one under 13 can make an online account for anything, regardless of what it is. So it's definitely still illegal for Dropbox/Twitter/HN to have 12 year olds with accounts (without parent consent).

They might just want to be able to demonstrate to the FTC that they're confident there's no children with accounts, instead of just telling the FTC "it's well known children don't really use cloud storage services anyway so we never bothered to ask for age".

tyrfing• 4 years ago

If you read the link at the link, they specifically call out maintaining accounts of kids who revised their birthdate below the limit, and for encouraging kids to lie by stating they had to be at least 13.

Are children now allowed to use cloud backup services? Why wouldn't they?

It's basically a service for storing personal information, so probably not without parental consent.

ryandrake• 4 years ago

IANAL, but my understanding is that nothing in COPPA prevents children under 13 from making accounts or using Internet services. If this were true, Roblox would not exist. COPPA only limits collection of children's personal information. A company that says COPPA prevents them from allowing children to use their services really just doesn't want to go through the effort of not collecting that personal information. So, instead they throw up their hands and just blanket forbid children under 13 from signing up, to avoid having to comply with the law. But, this is their own policy, not anything mandated by COPPA.

exfascist4• 4 years ago

For those of you in need of an immediate drop-in replacement that won't tie you to an organization which will do the same thing a decade from now: Syncthing[1] is awesome. It's all FOSS, peer to peer, you're limited by your own hardware and network, and it uses PKI instead of some central auth service. The only reason I don't use it anymore is because I've switched to git for all my textfiles and rsync (lol I know) for archiving binaries, that won't work for people who use a lot of GUI tools though so I'd recommend you use Syncthing.

[1] https://syncthing.net/

mindslight2• 4 years ago

I've never used Syncthing, but I used to use Unison pretty hard. Why did you switch to rsync for binaries? Was it that you really didn't need bidirectional sync, or was it a failing of the tool to handle large binary files?

exfascist4• 4 years ago

I don't edit binaries (or if I do the edits are always saved in a new file) so I just need a full archive of them. Syncthing is overkill for this so eventually I moved away from it and now only a couple of my machines have it running.

Antipode• 4 years ago

What's wrong with using rsync for that?

spicybright3• 4 years ago

Nothing. But rsync isn't in the same space that syncthing is trying to do.

It's like comparing `scp` to something like `sshfs` mounted to a shared folder, and having an algorithm to handle file conflicts.

I'm a heavy syncthing user, but still do rsync to deploy changes to my personal VPS because I don't need any of that.

falcolas• 4 years ago

One feature of Dropbox I take shameless advantage of is sharing files (not pirated material, FWIW) via a link. Suggestions on a replacement for that, since Syncthing can't do that?

exfascist4• 4 years ago

ipfs + the cloudflare gateway is great for that, I use it for sharing files here. You don't even have to install anything and can use EG: https://anarkrypto.github.io/upload-files-to-ipfs-from-brows...

pragmatic• 4 years ago

This.

I found old save games still shared via Dropbox or Google docs that work 7-8 years later.

The combinations I see in other comments are not going to survive that long.

kissgyorgy• 4 years ago

I found a Dropbox alternative: https://nextcloud.com/

I'm never going back. Way better in every aspect than Dropbox.

encryptluks26• 4 years ago

Nextcloud is not an alternative to Dropbox. Dropbox is a cloud storage provider, and Nextcloud is a software that runs on a cloud server. One you pay for the storage upfront and Dropbox provides some redundancy of the data. With Nextcloud, you could set it up on a single service with no redundancy and easily lose all your data, plus there is administration and maintenance costs.

mybhslaptop• 4 years ago

You can sign up to many different Nextcloud providers https://nextcloud.com/signup/

NextCloud also sells a device with it preinstalled and easy to use

spicybright3• 4 years ago

to add, even if you pay for someone else to host it, you still have to manage it to some degree, unlike dropbox/syncthing.

Brian_K_White5• 4 years ago

None of this and other differences disqualifies it as an alternative.

If it's possible to save and access files from any browser, from any location, set up an automatically syncing folder, and selectively share access with others, then you have an alternative to dropbox, and all the other cloud personal storage services. All of which nextcloud can do.

The differences just mean you don't prefer that particular alternative the same way as if you didn't like the color scheme, or more realistically say the need to make a microsoft account for onedrive, or the way google probably scans the contents of google drive etc.

They are all still alternatives with various pros & cons.

Setting up your own nextcloud on a publicly accessible service is no different.

The cons like effort and cost are noted.

The pro is there is no one else in control of your stuff and it's impossible to lose your account due to some age verification, or any other reason like "communiy standards" or billing dispute. The worst that can happen is your hosting provider can drop you, but that is a commodity and there are infinite other hosting providers and methods. Keep your own mirror so you don't care even if the hosting provider deletes everything.

If any alternative to dropbox has to be identical in every detail to qualify, then it has exactly the same problems as well. An alternative actually has to be different in some way or else it's not an alternative but just more of the same, and there is no point in that.

kingcharles4• 4 years ago

Spent several minutes trying to find the price. It's hidden under the "Support" menu for no reason that makes sense.

Looks like it starts at €3600 per year for the basic plan, but you can't buy it, you have to "get an offer" which is newspeak for have a salesperson call you for several hours to upsell you.

Definitely not a replacement for my $14/month Dropbox account.

kyleee• 4 years ago

that's enterprise support obviously, but yes it's more legwork to host nextcloud than using dropbox

vanous2• 4 years ago

Fully agree! I self host and my family uses it. For them, there's no difference, except that when at home (99% of time), "our cloud" (Nextcloud) is much faster.

kingcharles4• 4 years ago

I just finished using rclone to pull down my whole Dropbox last night. I'm closing my account today. Their app was a piece of crap that never worked for me anyway.

I'm going to look at rsync.net simply because their people hang out on here.

encryptluks26• 4 years ago

Note depending on the amount of storage, rsync.net is substantially more expensive. For $100 a year you can get 2TB of storage with Google Drive, which works flawlessly with rclone. Additionally, for roughly $80 you can get 15+months of Office 365 Family which provides 1TB of storage each for up to 6 users which also works with rclone and restic.

For the same storage with rsync.net you could be looking at $500.00/month, and I believe that is with single-location storage.

kingcharles4• 4 years ago

Yowch. I didn't realize the price difference was so substantial. I have GDrive and OneDrive accounts too. OneDrive's Windows integration works great. I'm just trying to get away from Google and Microsoft tie-downs because I don't trust their ability to give me support if I got locked out of my account for some reason.

ageitgey• 4 years ago

Not only is this a potential way to mess up your own account, but these systems are often exploited by malicious attackers to cause people headaches or impact their finances.

For example, an attacker will call up PayPal and give their name as the real name of a famous online personality. They will tell the support rep "Hey sorry, I signed up for this account but I'm only 12. Can you turn off my account?". The rep will assume it is a low risk/legit request and lock the account without doing any other checks. This has happened to lots of online streamers, like Ninja.

vmception2• 4 years ago

use compromised credentials just to force the company to do the dirty work!

chaotic something

citizenpaul• 4 years ago

Interesting that not but a week or two ago there was a post on HN stating that dropbox had the best programmers in the industry.

vmception2• 4 years ago

lol the interviewing.io guy that drank their own koolaid!

I think most people that commented in that thread were able to spot the cyanide dissolving into the drink

ushakov• 4 years ago

i've had the same issue with PayPal

i created an account when i was 16 or something, but never used it before 18

after age verification they suspended my account, but allowed to move funds to a new account with other e-mail address

throwmeariver1• 4 years ago

If you made an account at any digital service before you turned 13 make a new one. I got a google account banned because I needed to update my date of birth and at the time I would not have been allowed to sign up.

thefifthsetpin• 4 years ago

I did the same thing the other day setting up an iphone. I went back to fix my birthdate, but it prevented me for a while, telling me that my real birthdate was "invalid" or some such, and that I should try again later.

Eventually, enough time passed that my birthdate became valid and I was able to proceed. It was annoying, but honestly it was probably less annoying than coding that onboarding screen must have been.

kingcharles4• 4 years ago

1. Accidentally enter invalid birth date

2. Refresh page for the next 15 years until birth date is valid

leach• 4 years ago

That's insane haha

taylorhughes• 4 years ago

Note that this is due to legal requirements around discovering a user's age in a "neutral" way, in order to block under-13 users (or varying other ages depending on global jurisdiction). This is called a "neutral age screen". The screen cannot indicate that there will be a lockout, or underage users would just say they were older to get around it. It sucks, but most apps of a certain size and liability profile have to implement it this way.

gitrog2• 4 years ago

Does the law also state that you can't fix the date afterwards, or that once entered verification is required? It's a paid account, they've already got my credit card details. And how does it make sense that I was born 2 weeks ago?

I don't know, I felt really stupid when I entered the wrong year but since then I've grown increasingly frustrated by how poorly this feature has been implemented.

savanaly• 4 years ago

Wouldn't it kind of defeat the purpose if you could simply change the age after?

billwear• 4 years ago

stop paying the lawyers, and this will stop happening.

forgotpwd16• 4 years ago

There was a Twitter hoax going around which had users put a birthday making them <13yo effectively locking them out of their account. It was that widespread that the company made a tweet warning about it.

pjbeam• 4 years ago

Hi OP, if you want drop an email to my HN handle at protonmail dot com. I can't promise magic but can speak with a person at work tomorrow to try to get this resolved for you.

gitrog2• 4 years ago

Hi, thanks for the offer, I caved and provided Dropbox support with a copy of my passport and that seemed to be enough to resolve the issue (I hope, I really really hope).

If you work at Dropbox I think it could still be useful to raise some of the concerns mentioned here with whoever is the product owner of this feature.

Tell HN: Dropbox user age verification feature can lock your account

Related Stories