Link harvest: When Apple locked me out of my account for two months

[osewalrus]

Interesting story of how a long-time Apple customer got locked out of just about everything because a respectable website sold him a gift card that turned out to have been stolen by insiders at Apple and then resold to unsuspecting websites as legitimate cards. Only by working an internal connection did he get his account reactivated.
https://qz.com/1683460/what-happens-to-your-itunes-account-when-apple-says-youve-committed-fraud/?ref=hvper.com 

Comments

[dsrtao]

So... over in tech security land we've been seeing these stories for a long time. Ebooks that disappear when the DRM server dies; single-player games that won't work without an active net connection; music and movies that are never recorded to media you control, so you're renting the experience rather than buying an item. Amazon/Google/Apple/Facebook ecosystems where your digital identity -- usually an email address, a phone number and a password -- is key to your rights to participate in society.

We have solutions.

One solution is that the market has to price streamed and DRM-encumbered media substantially lower than their permanent-media equivalents. A service that claims to sell you a season of Lost needs to be priced closer to one month of Netflix ($10?) than to the 8-disc box set. The book publishers keep telling us that they can't do that, because editing and art and layout costs as much for epub as it does for hardcover, but the music industry told us that it costs a lot to make music, and we all found out that it was going to profit the producers and labels, not the artists. There's a lot to hate about Amazon's publishing systems, but the 70% cover royalty isn't one of them.

Another solution is to accept the cost of setting up multiple identities. Email addresses are easy to establish; phone numbers are more expensive but fewer of them are needed. When a company offers you a new service, don't allow them to link it to your existing account: create a new one. dsr-gmail handles gmail, but dsr-hangouts handles Hangouts. You log in to these things once a month or so, and all the rest of the time the machines remember your sessions. It's not as big a pain as you would think.

The biggest solution, of course, is strict liability. It's becoming unconscionable for a company to offer you a contract that says "we do not guarantee this service is fit for any purpose, it might not be available, everything is best effort and our liability is strictly limited to pro-rata service fees for the time you might have been inconvenienced; we reserve the right to cancel at any time for any reason". It is not reasonable to allow a company to operate on such terms.