7 ms·

Tell HN: Dropbox user age verification feature can lock your account

119 points by gitrog 4y ago

Dropbox released a "user age verification feature" today, which is a simple set of drop downs for you to fill in your birth date. I made the mistake of choosing "2022" as my year of birth instead of my actual year of birth. Obviously this is my mistake, but a warning to anyone else: I now have 48 hours to backup my files before I will be locked out of my account, and Dropbox support has been unable to confirm that they can fix the "issue" for me. I think this is the single worst "feature" I've ever encountered in a software application. I'm honestly shocked.

leach 4y ago
That's insane haha
alpaca128 4y ago
> Obviously this is my mistake No, it isn't. 2022 should not be a valid date of birth in the first place. And the account being locked because of that should probably also not happen without additional checks. It's okay to have standards even when most UIs are bad.
- globular-toast 4y ago
  What should be the lowest valid date of birth? Is there some universal standard? I know it feels like 4 months is quite young, but where would you draw the line?
  - deleted 4y ago
    [deleted]
  - rolph 4y ago
    it varies from place to place but perhaps the minimum age for participation in a legal contract/useragreement to be binding
  - causi 4y ago
    I believe many countries have special laws about the online activities of children below the age of 13. Seems like a good cutoff.
  - xeromal 4y ago
    At least in the US, I don't believe you're supposed to use the internet unless you're 13 or older. You could start there for your dropdown.
    - roywashere 4y ago
      My kid made a presentation for his class using Google Docs, then filled in his day of birth on his new phone when setting it up, then got locked out of his account. He was 12 at the time. Also, his class had a WhatsApp group chat in which school info was shared. This was kind of weird because it meant that all 12 year olds in the group must have cheated their dates of birth, because otherwise they could not have had a WhatsApp account
      - xeromal 4y ago
        Cheating on your DOB is a rite of passage on the internet. I did it in the 90s. I think my old hotmail account still has my mom's bday in it
        Arrath 4y ago
        Why yes I was born on the 20th of April, way back in 1969, why do you ask?
        BeFlatXIII 4y ago
        I’ve been a 41-year-old single dad ever since I was a nine year old.
        cdjk 4y ago
        One of the main results of COPPA is teaching children to lie about their age on the internet.
        astura 4y ago
        90s? COPPA didn't go into effect until Q2 2000.
- xjay 4y ago
  Coder sees "We need feature X". Coder implements feature X, marks it as complete; next. So they have the coder (implementer) role covered, but not the "programmer" role ("thinker"/feature designer). Leslie Lamport - Thinking Above the Code: ~ A lot of people like to think that they're thinking, but they don't really do much thinking. [1] Evidently, there was no expectation that the coder/implementer was supposed to do any thinking here. [1] https://www.youtube.com/watch?v=-4Yp3j_jk8Q&t=134s https://www.youtube.com/watch?v=-4Yp3j_jk8Q&t=134s
  - willcipriano 4y ago
    This got past the undoubtedly upwards of nine product managers/business analysts/directors/etc on the team as well. Blaming the low man on that totem pole in a organization thick with management like that is silly. None of the "idea men" had the idea of "what if someone's cat walks across the keyboard when we ask them their birthday". That's the embarrassing failure here.
    - cdjk 4y ago
      This could actually be a feature and not a bug from a legal perspective. If they are blocking anyone who gives any indication that they are under 13 then it might be easier to show compliance with COPPA. This has made me wonder at times if the best way to get my data delete from someplace is to talk to customer service and repeatedly say that I'm twelve.
      - hansvm 4y ago
        That's definitely how it explicitly worked at one workplace; to the extent that account restrictions could form a poset, if we had evidence that some restriction might be required (e.g., from multiple forms of age evidence, do any of them indicate this might be a minor or some other protected class), that restriction would be applied.
reset-password 4y ago
I've gotten into the habit of being born on January 1, 1970. Seems like a good enough date to me.
- jrockway 4y ago
  I always like to see how old I can make myself. 1902? (The 2038 problem in reverse.) 1776? 5 B.C.? My experience is that I can usually only go back to the 1930s.
  - __david__ 4y ago
    Ha, I do that as well. They're almost always menus and so I just pick the bottom-most box. Steam thinks I'm 120 years old.
    - em-bee 4y ago
      i wonder though if doing that doesn't risk detection since it's pretty obviously false.
      - jrockway 4y ago
        I am not sure if I care about detection. They will obviously shut down your account if you're too young, but they don't have any legal demand to shut down your account if you're too old, so they probably won't bother. Most of the places where I see these things are not services like Dropbox where I'm a customer, but for things like alcohol marketing websites. "To view our collection, you must be over 21. Type your age to verify." The law requires them to ban me for being under 21, but doesn't require them to ban me for being "too old", so they probably don't bother. (I imagine the hot topic at meetings is when they provide a year dropdown, what's the oldest year they should add. If the world's oldest person wants to visit their website, that should be allowed.)
        em-bee 4y ago
        well, they could shut it down for being an obviously fake account.
tpxl 4y ago
This is how I got locked out of my 10 year old skype account (good riddance). The support _cannot_ do anything due to some silly child protection laws (coppa maybe?).
- dragonwriter 4y ago
  The age verification feature is for COPPA compliance, but I’d really like to see the provision that prevents correcting errors.
  - tpxl 4y ago
    They will correct errors, after you give them a bunch of document scans or a credit card. I wasn't willing to provide that to a random foreign company for a free service, I just moved to Discord.
    - dragonwriter 4y ago
      Yes, I get that procedurally firms make it harder to correct information than to initially enter it. I just want to see the justification that the law in question actually requires that.
    - djrogers 4y ago
      > to a random foreign company Fair enough, but I’m not sure Microsoft could be described as a ‘random company’
    - Brian_K_White 4y ago
      So it was correctable, and so no problem. The inconvenience isn't important when it's an outlier event. Does everyone bungle their Skype account profile 3 times a day or did it happen to one person out of millions and only one time in that person's life? For outlier cases, any form of redress at all is ok. All that really matters is that there IS a procedure at all and it is doable (doesn't cost $1000 or require something impossible). Unlike say getting your google/gmail account fixed when there is no such thing as a google customer support # you can call to fix things that the automated processes got wrong. The only problem I see is the discrepency between creating and updating. If there is a valid reason to require proof of age to update an account from child to adult, then by rights exactly that same proof should be required to create the account in the first place. then the convenience matters, and there should be some more practical way to supply something which is legally accepted as good enough, and that should be the same for both creation and update. I don't think we really have that "something", especially not globally and absolutely positively not anonymously. By now, in most countries there is probably some form of standard ID that most people in the country either have or can get. But they are different for every country and definitely creates a first world discrimination filter. Thinking about that, it seems like the whole idea is misguided and imvalid, unworkable. How would one do it? Even in a 1st world country and me having both a SSN and a drivers ID and or government ID, it still leaves the problem of anonymity and multiple/temp accounts etc, and still leaves the problem that I entered the wrong number which means probably someone ele's number, which means someone else could enter mine...so there needs to be a mechanism to prove that I own the number I entered, which there is no such mechanism. Maybe if ID#'s were really key pairs and you never simply entered a number but instead signed something or proved that you could decrypt something signed, but that is a high tech fantasy world we aren't quite in yet. Kids should be protected from those who would exploit them, but requiring proof of age to use on-line services isn't a functioning way to do it.
henning 4y ago
rsync + a bash script doesn't sound so bad now. (I don't give a fuck what the market or normies want)
- marcosdumay 4y ago
  There are stuff like NextCloud now, that you can run by yourself. Rsync + a bash script is horrible to get going in a mobile device. (What is the fault of the mobile OSes, and if you can get by with a less hostile one, great for you.) Those open-core ones put some work on it.
  - deleted 4y ago
    [deleted]
  - spicybright 4y ago
    I use syncthing to sync my entire phone. Now I have a 64GB folder on my desktop that /is/ my phone, but all normal local files I can treat like any other file. Taking a picture with my phone and having it show up on my computer in 5 seconds is pretty close to magic in terms of file sharing. Completely free, andno central server to introduce "age verification" or whatever.
    - vanous 4y ago
      Syncthing user of many years and a semi recent Nextcloud convert here. Sc is very, very cool but you must sync both ways every time, so after some time, if your phone runs out of space, things get hard. The "do not erase on 'server'" setting is pretty well hidden and claimed not to be supported and can break things. Also, for "one way sync", with super easy setup, i have not found an alternative for btsync (now called resilio). SC is too clunky to set up the client and in this case, running Nextcloud server + setting up clients is crazy complex. TIL about Unison and will try it out...
varenc 4y ago
I've been seeing age checks like this more and more. Recently the FTC came down hard[0] on Kurbo (aka Weight Watchers) for not doing enough/anything to stop children under 13 (COPPA) from making accounts. Since they're not confident there's no children with accounts, now all Kurbo's data is tainted and they have to delete all user data and destroy any "algorithms" derived from that data. Historically Dropbox probably never asked for a user's age so they might worry they could run into this problem in the future. The threat of all a company's data being tainted is a huge one, so of course they're now overreacting a bit. p.s. hopefully you can get your account fixed, but if not, you could use the amazing rclone[1] tool to copy your files off. (it's rsync for cloud storage). Or you could just put them in a folder shared with another DBX account. [0] https://www.ftc.gov/news-events/news/press-releases/2022/03/ftc-takes-action-against-company-formerly-known-weight-watchers-illegally-collecting-kids-sensitive https://www.ftc.gov/news-events/news/press-releases/2022/03/... [1] https://rclone.org/ https://rclone.org/
- armchairhacker 4y ago
  Kurbo is really controversial though. It’s a health tracker specifically for kids, as young as 8, which focuses on calories and weight more than nutrition. And it tracks everyone’s data, so because of technicalities if the child is under 13 the parents have to sign them up (still tracks their data).
- hungryforcodes 4y ago
  OK but if you read the link you included WW specifically MADE an app for children and collected the data: "the agency... marketed a weight loss app for use by children as young as eight and then collected their personal information without parental permission." That is pretty wilful -- so we can be confident they have or had data targeted from children. Dropbox on the other hand -- I'm not sure how that case is similar. Are children now allowed to use cloud backup services? Why wouldn't they?
  - varenc 4y ago
    Fair point! That does seem like a key difference. But I still wouldn't be surprised if all tech industry legal/compliance teams have been spooked by this. Also under COPPA no one under 13 can make an online account for anything, regardless of what it is. So it's definitely still illegal for Dropbox/Twitter/HN to have 12 year olds with accounts (without parent consent). They might just want to be able to demonstrate to the FTC that they're confident there's no children with accounts, instead of just telling the FTC "it's well known children don't really use cloud storage services anyway so we never bothered to ask for age".
exfascist 4y ago
For those of you in need of an immediate drop-in replacement that won't tie you to an organization which will do the same thing a decade from now: Syncthing[1] is awesome. It's all FOSS, peer to peer, you're limited by your own hardware and network, and it uses PKI instead of some central auth service. The only reason I don't use it anymore is because I've switched to git for all my textfiles and rsync (lol I know) for archiving binaries, that won't work for people who use a lot of GUI tools though so I'd recommend you use Syncthing. [1] https://syncthing.net/ https://syncthing.net/
- mindslight 4y ago
  I've never used Syncthing, but I used to use Unison pretty hard. Why did you switch to rsync for binaries? Was it that you really didn't need bidirectional sync, or was it a failing of the tool to handle large binary files?
  - exfascist 4y ago
    I don't edit binaries (or if I do the edits are always saved in a new file) so I just need a full archive of them. Syncthing is overkill for this so eventually I moved away from it and now only a couple of my machines have it running.
- Antipode 4y ago
  What's wrong with using rsync for that?
  - spicybright 4y ago
    Nothing. But rsync isn't in the same space that syncthing is trying to do. It's like comparing `scp` to something like `sshfs` mounted to a shared folder, and having an algorithm to handle file conflicts. I'm a heavy syncthing user, but still do rsync to deploy changes to my personal VPS because I don't need any of that.
- falcolas 4y ago
  One feature of Dropbox I take shameless advantage of is sharing files (not pirated material, FWIW) via a link. Suggestions on a replacement for that, since Syncthing can't do that?
kissgyorgy 4y ago
I found a Dropbox alternative: https://nextcloud.com/ https://nextcloud.com/ I'm never going back. Way better in every aspect than Dropbox.
- encryptluks2 4y ago
  Nextcloud is not an alternative to Dropbox. Dropbox is a cloud storage provider, and Nextcloud is a software that runs on a cloud server. One you pay for the storage upfront and Dropbox provides some redundancy of the data. With Nextcloud, you could set it up on a single service with no redundancy and easily lose all your data, plus there is administration and maintenance costs.
  - mybhslaptop 4y ago
    You can sign up to many different Nextcloud providers https://nextcloud.com/signup/ https://nextcloud.com/signup/ NextCloud also sells a device with it preinstalled and easy to use
    - encryptluks2 4y ago
      Those providers aren't competitive in pricing with Dropbox, and even if you have a device with it preinstalled, you are limited to whatever redundancy is built into the box and configuring security/firewall rules, etc. Plus, a lot of residential broadband services limit upload speed substantially, so if you're restoring offsite it could take a very long time. Dropbox at least has some resiliency distributed across multiple servers.
      - deleted 4y ago
        [deleted]
      - Brian_K_White 4y ago
        I don't understand the objection. Every service or option has some sort of unique differences from each other, and there is always some good and bad points, including dropbox. Google drive is free and surely pretty well backed up, but requires hoping a service with no customer support process at all just never decides to kill your account, and probably they scan your drive contents just like they do your email, or will some day if not yet. Onedrive requires creating and using a Microsoft account and who knows how usable it even is from linux (can it do a synced folder on linux or just the browser interdace?). Other services like Mega or idk what maybe don't have a folder sync feature or something, but are hosted in another country and possibly better protected against invalid take downs or spying. So nextcloud costs a little more or is a little more work to set up. Yes and in trade for that there are other differences like you are the one in ultimate control of your stuff. You may not prefer that particular set of trade-offs, but fundamentally, so what? There is always a trade off of some sort including with dropbox.
kingcharles 4y ago
I just finished using rclone to pull down my whole Dropbox last night. I'm closing my account today. Their app was a piece of crap that never worked for me anyway. I'm going to look at rsync.net simply because their people hang out on here.
- encryptluks2 4y ago
  Note depending on the amount of storage, rsync.net is substantially more expensive. For $100 a year you can get 2TB of storage with Google Drive, which works flawlessly with rclone. Additionally, for roughly $80 you can get 15+months of Office 365 Family which provides 1TB of storage each for up to 6 users which also works with rclone and restic. For the same storage with rsync.net you could be looking at $500.00/month, and I believe that is with single-location storage.
  - kingcharles 4y ago
    Yowch. I didn't realize the price difference was so substantial. I have GDrive and OneDrive accounts too. OneDrive's Windows integration works great. I'm just trying to get away from Google and Microsoft tie-downs because I don't trust their ability to give me support if I got locked out of my account for some reason.
    - rsync 4y ago
      A reminder that there is a "HN Readers" discount - just email info@rsync.net and ask about it.
      - encryptluks2 4y ago
        How about have some transparent competitive pricing on your website?
deleted 4y ago
[deleted]
ageitgey 4y ago
Not only is this a potential way to mess up your own account, but these systems are often exploited by malicious attackers to cause people headaches or impact their finances. For example, an attacker will call up PayPal and give their name as the real name of a famous online personality. They will tell the support rep "Hey sorry, I signed up for this account but I'm only 12. Can you turn off my account?". The rep will assume it is a low risk/legit request and lock the account without doing any other checks. This has happened to lots of online streamers, like Ninja.
- vmception 4y ago
  use compromised credentials just to force the company to do the dirty work! chaotic something
citizenpaul 4y ago
Interesting that not but a week or two ago there was a post on HN stating that dropbox had the best programmers in the industry.
- vmception 4y ago
  lol the interviewing.io guy that drank their own koolaid! I think most people that commented in that thread were able to spot the cyanide dissolving into the drink
ushakov 4y ago
i've had the same issue with PayPal i created an account when i was 16 or something, but never used it before 18 after age verification they suspended my account, but allowed to move funds to a new account with other e-mail address
throwmeariver1 4y ago
If you made an account at any digital service before you turned 13 make a new one. I got a google account banned because I needed to update my date of birth and at the time I would not have been allowed to sign up.
thefifthsetpin 4y ago
I did the same thing the other day setting up an iphone. I went back to fix my birthdate, but it prevented me for a while, telling me that my real birthdate was "invalid" or some such, and that I should try again later. Eventually, enough time passed that my birthdate became valid and I was able to proceed. It was annoying, but honestly it was probably less annoying than coding that onboarding screen must have been.
- kingcharles 4y ago
  1. Accidentally enter invalid birth date 2. Refresh page for the next 15 years until birth date is valid
taylorhughes 4y ago
Note that this is due to legal requirements around discovering a user's age in a "neutral" way, in order to block under-13 users (or varying other ages depending on global jurisdiction). This is called a "neutral age screen". The screen cannot indicate that there will be a lockout, or underage users would just say they were older to get around it. It sucks, but most apps of a certain size and liability profile have to implement it this way.
- gitrog 4y ago
  Does the law also state that you can't fix the date afterwards, or that once entered verification is required? It's a paid account, they've already got my credit card details. And how does it make sense that I was born 2 weeks ago? I don't know, I felt really stupid when I entered the wrong year but since then I've grown increasingly frustrated by how poorly this feature has been implemented.
  - savanaly 4y ago
    Wouldn't it kind of defeat the purpose if you could simply change the age after?
Sasha_zik85 4y ago
billwear 4y ago
stop paying the lawyers, and this will stop happening.
forgotpwd16 4y ago
There was a Twitter hoax going around which had users put a birthday making them <13yo effectively locking them out of their account. It was that widespread that the company made a tweet warning about it.
pjbeam 4y ago
Hi OP, if you want drop an email to my HN handle at protonmail dot com. I can't promise magic but can speak with a person at work tomorrow to try to get this resolved for you.
- gitrog 4y ago
  Hi, thanks for the offer, I caved and provided Dropbox support with a copy of my passport and that seemed to be enough to resolve the issue (I hope, I really really hope). If you work at Dropbox I think it could still be useful to raise some of the concerns mentioned here with whoever is the product owner of this feature.

119 points by gitrog 4y ago

leach 4y ago

That's insane haha

alpaca128 4y ago

> Obviously this is my mistake No, it isn't. 2022 should not be a valid date of birth in the first place. And the account being locked because of that should probably also not happen without additional checks. It's okay to have standards even when most UIs are bad.

globular-toast 4y ago
What should be the lowest valid date of birth? Is there some universal standard? I know it feels like 4 months is quite young, but where would you draw the line?
- deleted 4y ago
  [deleted]
- rolph 4y ago
  it varies from place to place but perhaps the minimum age for participation in a legal contract/useragreement to be binding
- causi 4y ago
  I believe many countries have special laws about the online activities of children below the age of 13. Seems like a good cutoff.
- xeromal 4y ago
  At least in the US, I don't believe you're supposed to use the internet unless you're 13 or older. You could start there for your dropdown.
  - roywashere 4y ago
    My kid made a presentation for his class using Google Docs, then filled in his day of birth on his new phone when setting it up, then got locked out of his account. He was 12 at the time. Also, his class had a WhatsApp group chat in which school info was shared. This was kind of weird because it meant that all 12 year olds in the group must have cheated their dates of birth, because otherwise they could not have had a WhatsApp account
    - xeromal 4y ago
      Cheating on your DOB is a rite of passage on the internet. I did it in the 90s. I think my old hotmail account still has my mom's bday in it
      - Arrath 4y ago
        Why yes I was born on the 20th of April, way back in 1969, why do you ask?
        BeFlatXIII 4y ago
        I’ve been a 41-year-old single dad ever since I was a nine year old.
      - cdjk 4y ago
        One of the main results of COPPA is teaching children to lie about their age on the internet.
      - astura 4y ago
        90s? COPPA didn't go into effect until Q2 2000.
xjay 4y ago
Coder sees "We need feature X". Coder implements feature X, marks it as complete; next. So they have the coder (implementer) role covered, but not the "programmer" role ("thinker"/feature designer). Leslie Lamport - Thinking Above the Code: ~ A lot of people like to think that they're thinking, but they don't really do much thinking. [1] Evidently, there was no expectation that the coder/implementer was supposed to do any thinking here. [1] https://www.youtube.com/watch?v=-4Yp3j_jk8Q&t=134s https://www.youtube.com/watch?v=-4Yp3j_jk8Q&t=134s
- willcipriano 4y ago
  This got past the undoubtedly upwards of nine product managers/business analysts/directors/etc on the team as well. Blaming the low man on that totem pole in a organization thick with management like that is silly. None of the "idea men" had the idea of "what if someone's cat walks across the keyboard when we ask them their birthday". That's the embarrassing failure here.
  - cdjk 4y ago
    This could actually be a feature and not a bug from a legal perspective. If they are blocking anyone who gives any indication that they are under 13 then it might be easier to show compliance with COPPA. This has made me wonder at times if the best way to get my data delete from someplace is to talk to customer service and repeatedly say that I'm twelve.
    - hansvm 4y ago
      That's definitely how it explicitly worked at one workplace; to the extent that account restrictions could form a poset, if we had evidence that some restriction might be required (e.g., from multiple forms of age evidence, do any of them indicate this might be a minor or some other protected class), that restriction would be applied.

reset-password 4y ago

I've gotten into the habit of being born on January 1, 1970. Seems like a good enough date to me.

jrockway 4y ago
I always like to see how old I can make myself. 1902? (The 2038 problem in reverse.) 1776? 5 B.C.? My experience is that I can usually only go back to the 1930s.
- __david__ 4y ago
  Ha, I do that as well. They're almost always menus and so I just pick the bottom-most box. Steam thinks I'm 120 years old.
  - em-bee 4y ago
    i wonder though if doing that doesn't risk detection since it's pretty obviously false.
    - jrockway 4y ago
      I am not sure if I care about detection. They will obviously shut down your account if you're too young, but they don't have any legal demand to shut down your account if you're too old, so they probably won't bother. Most of the places where I see these things are not services like Dropbox where I'm a customer, but for things like alcohol marketing websites. "To view our collection, you must be over 21. Type your age to verify." The law requires them to ban me for being under 21, but doesn't require them to ban me for being "too old", so they probably don't bother. (I imagine the hot topic at meetings is when they provide a year dropdown, what's the oldest year they should add. If the world's oldest person wants to visit their website, that should be allowed.)
      - em-bee 4y ago
        well, they could shut it down for being an obviously fake account.

tpxl 4y ago

This is how I got locked out of my 10 year old skype account (good riddance). The support _cannot_ do anything due to some silly child protection laws (coppa maybe?).

dragonwriter 4y ago
The age verification feature is for COPPA compliance, but I’d really like to see the provision that prevents correcting errors.
- tpxl 4y ago
  They will correct errors, after you give them a bunch of document scans or a credit card. I wasn't willing to provide that to a random foreign company for a free service, I just moved to Discord.
  - dragonwriter 4y ago
    Yes, I get that procedurally firms make it harder to correct information than to initially enter it. I just want to see the justification that the law in question actually requires that.
  - djrogers 4y ago
    > to a random foreign company Fair enough, but I’m not sure Microsoft could be described as a ‘random company’
  - Brian_K_White 4y ago
    So it was correctable, and so no problem. The inconvenience isn't important when it's an outlier event. Does everyone bungle their Skype account profile 3 times a day or did it happen to one person out of millions and only one time in that person's life? For outlier cases, any form of redress at all is ok. All that really matters is that there IS a procedure at all and it is doable (doesn't cost $1000 or require something impossible). Unlike say getting your google/gmail account fixed when there is no such thing as a google customer support # you can call to fix things that the automated processes got wrong. The only problem I see is the discrepency between creating and updating. If there is a valid reason to require proof of age to update an account from child to adult, then by rights exactly that same proof should be required to create the account in the first place. then the convenience matters, and there should be some more practical way to supply something which is legally accepted as good enough, and that should be the same for both creation and update. I don't think we really have that "something", especially not globally and absolutely positively not anonymously. By now, in most countries there is probably some form of standard ID that most people in the country either have or can get. But they are different for every country and definitely creates a first world discrimination filter. Thinking about that, it seems like the whole idea is misguided and imvalid, unworkable. How would one do it? Even in a 1st world country and me having both a SSN and a drivers ID and or government ID, it still leaves the problem of anonymity and multiple/temp accounts etc, and still leaves the problem that I entered the wrong number which means probably someone ele's number, which means someone else could enter mine...so there needs to be a mechanism to prove that I own the number I entered, which there is no such mechanism. Maybe if ID#'s were really key pairs and you never simply entered a number but instead signed something or proved that you could decrypt something signed, but that is a high tech fantasy world we aren't quite in yet. Kids should be protected from those who would exploit them, but requiring proof of age to use on-line services isn't a functioning way to do it.

henning 4y ago

rsync + a bash script doesn't sound so bad now. (I don't give a fuck what the market or normies want)

marcosdumay 4y ago
There are stuff like NextCloud now, that you can run by yourself. Rsync + a bash script is horrible to get going in a mobile device. (What is the fault of the mobile OSes, and if you can get by with a less hostile one, great for you.) Those open-core ones put some work on it.
- deleted 4y ago
  [deleted]
- spicybright 4y ago
  I use syncthing to sync my entire phone. Now I have a 64GB folder on my desktop that /is/ my phone, but all normal local files I can treat like any other file. Taking a picture with my phone and having it show up on my computer in 5 seconds is pretty close to magic in terms of file sharing. Completely free, andno central server to introduce "age verification" or whatever.
  - vanous 4y ago
    Syncthing user of many years and a semi recent Nextcloud convert here. Sc is very, very cool but you must sync both ways every time, so after some time, if your phone runs out of space, things get hard. The "do not erase on 'server'" setting is pretty well hidden and claimed not to be supported and can break things. Also, for "one way sync", with super easy setup, i have not found an alternative for btsync (now called resilio). SC is too clunky to set up the client and in this case, running Nextcloud server + setting up clients is crazy complex. TIL about Unison and will try it out...

varenc 4y ago

I've been seeing age checks like this more and more. Recently the FTC came down hard[0] on Kurbo (aka Weight Watchers) for not doing enough/anything to stop children under 13 (COPPA) from making accounts. Since they're not confident there's no children with accounts, now all Kurbo's data is tainted and they have to delete all user data and destroy any "algorithms" derived from that data. Historically Dropbox probably never asked for a user's age so they might worry they could run into this problem in the future. The threat of all a company's data being tainted is a huge one, so of course they're now overreacting a bit. p.s. hopefully you can get your account fixed, but if not, you could use the amazing rclone[1] tool to copy your files off. (it's rsync for cloud storage). Or you could just put them in a folder shared with another DBX account. [0] https://www.ftc.gov/news-events/news/press-releases/2022/03/ftc-takes-action-against-company-formerly-known-weight-watchers-illegally-collecting-kids-sensitive https://www.ftc.gov/news-events/news/press-releases/2022/03/... [1] https://rclone.org/ https://rclone.org/

armchairhacker 4y ago
Kurbo is really controversial though. It’s a health tracker specifically for kids, as young as 8, which focuses on calories and weight more than nutrition. And it tracks everyone’s data, so because of technicalities if the child is under 13 the parents have to sign them up (still tracks their data).
hungryforcodes 4y ago
OK but if you read the link you included WW specifically MADE an app for children and collected the data: "the agency... marketed a weight loss app for use by children as young as eight and then collected their personal information without parental permission." That is pretty wilful -- so we can be confident they have or had data targeted from children. Dropbox on the other hand -- I'm not sure how that case is similar. Are children now allowed to use cloud backup services? Why wouldn't they?
- varenc 4y ago
  Fair point! That does seem like a key difference. But I still wouldn't be surprised if all tech industry legal/compliance teams have been spooked by this. Also under COPPA no one under 13 can make an online account for anything, regardless of what it is. So it's definitely still illegal for Dropbox/Twitter/HN to have 12 year olds with accounts (without parent consent). They might just want to be able to demonstrate to the FTC that they're confident there's no children with accounts, instead of just telling the FTC "it's well known children don't really use cloud storage services anyway so we never bothered to ask for age".

exfascist 4y ago

For those of you in need of an immediate drop-in replacement that won't tie you to an organization which will do the same thing a decade from now: Syncthing[1] is awesome. It's all FOSS, peer to peer, you're limited by your own hardware and network, and it uses PKI instead of some central auth service. The only reason I don't use it anymore is because I've switched to git for all my textfiles and rsync (lol I know) for archiving binaries, that won't work for people who use a lot of GUI tools though so I'd recommend you use Syncthing. [1] https://syncthing.net/ https://syncthing.net/

mindslight 4y ago
I've never used Syncthing, but I used to use Unison pretty hard. Why did you switch to rsync for binaries? Was it that you really didn't need bidirectional sync, or was it a failing of the tool to handle large binary files?
- exfascist 4y ago
  I don't edit binaries (or if I do the edits are always saved in a new file) so I just need a full archive of them. Syncthing is overkill for this so eventually I moved away from it and now only a couple of my machines have it running.
Antipode 4y ago
What's wrong with using rsync for that?
- spicybright 4y ago
  Nothing. But rsync isn't in the same space that syncthing is trying to do. It's like comparing `scp` to something like `sshfs` mounted to a shared folder, and having an algorithm to handle file conflicts. I'm a heavy syncthing user, but still do rsync to deploy changes to my personal VPS because I don't need any of that.
falcolas 4y ago
One feature of Dropbox I take shameless advantage of is sharing files (not pirated material, FWIW) via a link. Suggestions on a replacement for that, since Syncthing can't do that?

kissgyorgy 4y ago

I found a Dropbox alternative: https://nextcloud.com/ https://nextcloud.com/ I'm never going back. Way better in every aspect than Dropbox.

encryptluks2 4y ago
Nextcloud is not an alternative to Dropbox. Dropbox is a cloud storage provider, and Nextcloud is a software that runs on a cloud server. One you pay for the storage upfront and Dropbox provides some redundancy of the data. With Nextcloud, you could set it up on a single service with no redundancy and easily lose all your data, plus there is administration and maintenance costs.
- mybhslaptop 4y ago
  You can sign up to many different Nextcloud providers https://nextcloud.com/signup/ https://nextcloud.com/signup/ NextCloud also sells a device with it preinstalled and easy to use
  - encryptluks2 4y ago
    Those providers aren't competitive in pricing with Dropbox, and even if you have a device with it preinstalled, you are limited to whatever redundancy is built into the box and configuring security/firewall rules, etc. Plus, a lot of residential broadband services limit upload speed substantially, so if you're restoring offsite it could take a very long time. Dropbox at least has some resiliency distributed across multiple servers.
    - deleted 4y ago
      [deleted]
    - Brian_K_White 4y ago
      I don't understand the objection. Every service or option has some sort of unique differences from each other, and there is always some good and bad points, including dropbox. Google drive is free and surely pretty well backed up, but requires hoping a service with no customer support process at all just never decides to kill your account, and probably they scan your drive contents just like they do your email, or will some day if not yet. Onedrive requires creating and using a Microsoft account and who knows how usable it even is from linux (can it do a synced folder on linux or just the browser interdace?). Other services like Mega or idk what maybe don't have a folder sync feature or something, but are hosted in another country and possibly better protected against invalid take downs or spying. So nextcloud costs a little more or is a little more work to set up. Yes and in trade for that there are other differences like you are the one in ultimate control of your stuff. You may not prefer that particular set of trade-offs, but fundamentally, so what? There is always a trade off of some sort including with dropbox.

kingcharles 4y ago

I just finished using rclone to pull down my whole Dropbox last night. I'm closing my account today. Their app was a piece of crap that never worked for me anyway. I'm going to look at rsync.net simply because their people hang out on here.

encryptluks2 4y ago
Note depending on the amount of storage, rsync.net is substantially more expensive. For $100 a year you can get 2TB of storage with Google Drive, which works flawlessly with rclone. Additionally, for roughly $80 you can get 15+months of Office 365 Family which provides 1TB of storage each for up to 6 users which also works with rclone and restic. For the same storage with rsync.net you could be looking at $500.00/month, and I believe that is with single-location storage.
- kingcharles 4y ago
  Yowch. I didn't realize the price difference was so substantial. I have GDrive and OneDrive accounts too. OneDrive's Windows integration works great. I'm just trying to get away from Google and Microsoft tie-downs because I don't trust their ability to give me support if I got locked out of my account for some reason.
  - rsync 4y ago
    A reminder that there is a "HN Readers" discount - just email info@rsync.net and ask about it.
    - encryptluks2 4y ago
      How about have some transparent competitive pricing on your website?

deleted 4y ago

[deleted]

ageitgey 4y ago

Not only is this a potential way to mess up your own account, but these systems are often exploited by malicious attackers to cause people headaches or impact their finances. For example, an attacker will call up PayPal and give their name as the real name of a famous online personality. They will tell the support rep "Hey sorry, I signed up for this account but I'm only 12. Can you turn off my account?". The rep will assume it is a low risk/legit request and lock the account without doing any other checks. This has happened to lots of online streamers, like Ninja.

vmception 4y ago
use compromised credentials just to force the company to do the dirty work! chaotic something

citizenpaul 4y ago

Interesting that not but a week or two ago there was a post on HN stating that dropbox had the best programmers in the industry.

vmception 4y ago
lol the interviewing.io guy that drank their own koolaid! I think most people that commented in that thread were able to spot the cyanide dissolving into the drink

ushakov 4y ago

i've had the same issue with PayPal i created an account when i was 16 or something, but never used it before 18 after age verification they suspended my account, but allowed to move funds to a new account with other e-mail address

throwmeariver1 4y ago

If you made an account at any digital service before you turned 13 make a new one. I got a google account banned because I needed to update my date of birth and at the time I would not have been allowed to sign up.

thefifthsetpin 4y ago

I did the same thing the other day setting up an iphone. I went back to fix my birthdate, but it prevented me for a while, telling me that my real birthdate was "invalid" or some such, and that I should try again later. Eventually, enough time passed that my birthdate became valid and I was able to proceed. It was annoying, but honestly it was probably less annoying than coding that onboarding screen must have been.

kingcharles 4y ago
1. Accidentally enter invalid birth date 2. Refresh page for the next 15 years until birth date is valid

taylorhughes 4y ago

Note that this is due to legal requirements around discovering a user's age in a "neutral" way, in order to block under-13 users (or varying other ages depending on global jurisdiction). This is called a "neutral age screen". The screen cannot indicate that there will be a lockout, or underage users would just say they were older to get around it. It sucks, but most apps of a certain size and liability profile have to implement it this way.

gitrog 4y ago
Does the law also state that you can't fix the date afterwards, or that once entered verification is required? It's a paid account, they've already got my credit card details. And how does it make sense that I was born 2 weeks ago? I don't know, I felt really stupid when I entered the wrong year but since then I've grown increasingly frustrated by how poorly this feature has been implemented.
- savanaly 4y ago
  Wouldn't it kind of defeat the purpose if you could simply change the age after?

Sasha_zik85 4y ago

billwear 4y ago

stop paying the lawyers, and this will stop happening.

forgotpwd16 4y ago

There was a Twitter hoax going around which had users put a birthday making them <13yo effectively locking them out of their account. It was that widespread that the company made a tweet warning about it.

pjbeam 4y ago

Hi OP, if you want drop an email to my HN handle at protonmail dot com. I can't promise magic but can speak with a person at work tomorrow to try to get this resolved for you.

gitrog 4y ago
Hi, thanks for the offer, I caved and provided Dropbox support with a copy of my passport and that seemed to be enough to resolve the issue (I hope, I really really hope). If you work at Dropbox I think it could still be useful to raise some of the concerns mentioned here with whoever is the product owner of this feature.