6 ms·

The real issue here is that (reportedly) the people who spammed got their GMail accounts shut down. That's outrageous. That's your real-life, not just your on

The real issue here is that (reportedly) the people who spammed got their GMail accounts shut down. That's outrageous. That's your real-life, not just your online-life. Your GMail account isn't even related at all to your YouTube identity. Remember: if you aren't _at least_ paying for your e-mail service you don't own your own mailbox. When was the last time you made a backup of your GMail account? What contingency plan do you have in-place if Google ever accidentally, unintentionally, or in this case, intentionally, shuts it down? (Disclaimer: I pay $20/mo for an Office 365 E3 account for my personal mailbox)

oneeyedpigeon 7y ago
I would also recommend never storing mission-critical stuff only in your email. Losing the contents of your inbox should be the least of your concerns if there’s a chance you might lose access to your account. There are far worse repercussions - e.g. a) how do you update everyone else's record of your email address? b) how many services have you locked yourself out of, or made doing so much more likely?
- chii 7y ago
  It makes owning your email address (including the domain name part) crucial. It's time people separated the hosting of email from the interface (the address).
  - fyp 7y ago
    I think most people just don't realize how easy this is and you can even keep using gmail. Most domain registrars have free email forwarding so you can forward *@domain.com to your gmail. This by itself is already good enough for signing up for things or resetting passwords. If you also need to send from that domain in gmail there's just a few more steps: https://support.google.com/domains/answer/9437157?hl=en https://support.google.com/domains/answer/9437157?hl=en
  - harperlee 7y ago
    Unfortunately it is no longer free to use a custom address in gmail; it used to be that just owning a domain would do the trick.
ravenstine 7y ago
No only that but, by doing so, they're effectively taking away any remaining semblance of proof that you weren't spamming.
dannyw 7y ago
We need legislation. Google is too powerful.
- DaiPlusPlus 7y ago
  Legislation to protect e-mail mailboxes as the same way we do with official postal (snail-)mail services in most countries needs to be handled very carefully, because otherwise we'll end up protecting spammers - the very opposite of the people we want to protect. I see this story as Google's equivalent of when Valve would ban people from Steam for crude comments they made on the Steam forums, which I understand meant they forfeited their entire game library - or Amazon banning people for reviews. If there is going to be any law or legislation - it should be to require service companies like Google, Valve and Amazon to treat the customer's "online personality account" (i.e. forum account, "community" account, etc) separately from their "value" account (i.e. whatever that which has _value_, be it their Steam library, their GMail mailbox, etc) - or at the very least, companies must be required to export 100% of the data in an account and providing that to the customer/user in the event they shut down an account (with reasonable constraints, such as the account having existed for at least 3 months and having been in good-standing until this specific incident, etc). And under no circumstances should anyone lose their software copyright licenses for violating a community ToS - feel free to ban them from the forums, et cetera, but being banned from the Steam forums must not mean they lose the right to play the copy of Half-Life 2 that they paid for.
  - cameronbrown 7y ago
    Nit: Valve just banned them from forums, not Steam. They already do what you're proposing.
    - DaiPlusPlus 7y ago
      Got a link? I remember reading that people were banned from their Steam accounts entirely without any refunds and they had to resort to CC chargebacks.
      - 7y ago
m-p-3 7y ago
Google should be able to disable access to a specific service, not shutting down the whole account. They want to be the identity of the online world, they need the responsibilities that comes with it.
- whateveracct 7y ago
  Since when has Google ever took on "the responsibilities that come with it"?
- whamlastxmas 7y ago
  When I was a kid I had a Yahoo site with some images hotlinked to another domain. The domain owner changed the images to porn, reported my Yahoo account, and it got my account entirely deleted. Emails and groups and chat and all. Really dumb
konschubert 7y ago
More importantly, pay for your own email DOMAIN. And keep backups of your email. Then, even if your account gets shut down, you can get up and running elsewhere quickly.
- tahdig 7y ago
  Be careful: By hosting your main email on a custom domain(not a provider) you open a new attack vector for identity theft. Someone can hijack your godaddy/namecheap/gandi account and point the MX DNS records of the domain to their own server and receive all your "Forgot your password? here is the link to reset!" emails This a very bad advice unless you actually know what are the risks.
  - doopfoopdoop 7y ago
    Is there a good way to protect against this aside from good password hygiene at your domain registrar? I use namecheap if that is relevant--maybe there's a better/more secure registrar to move to. But I guess, equivalently, someone can just equivalently hijack your email account directly if you use a service like Gmail or Yahoo.
    - aabbcc1241 7y ago
      It may helps if the sender send you password-reset email in encrypted format
    - tahdig 7y ago
      I think namecheap does not have a bad reputation, godaddy is known to be bad though(both security and customer support). The thing is, of course people can hack your gmail or yahoo mail somehow, but when you host your own domain, you have the same attack vectors + dns hijacking and this last addition is easier to exploit with social engineering. Google atleast is virtually immune to DNS hijacking.
    - yjftsjthsd-h 7y ago
      Just the usual advice, I would think: Strong, unique password, and enable 2FA.
ryandrake 7y ago
Or self-host. Linode VPS: $5/mo and for that I can host E-mail, a light duty web server, and other various odds and ends. I don't have to worry about some random algorithmic account suspension removing access to my E-mail (and all of my online accounts, since they use my E-mail address for verification). And I don't have to worry about some random algorithmic process determining what E-mails I receive and which ones get silently dropped into a black hole. So far no problems with misconfiguration or other providers dropping my mail--while it probably happens, I think the risk of that is overblown if you configure SPF, DKIM, and so on correctly.
- ravenstine 7y ago
  We're there any good resources you used for learning how to configure SPF and DKIM?
  - ryandrake 7y ago
    Linode's documentation tends to be pretty good: https://www.linode.com/docs/email/postfix/configure-spf-and-dkim-in-postfix-on-debian-8/ https://www.linode.com/docs/email/postfix/configure-spf-and-... That guide assumes you're using postfix as your MTA. For exim, their documentation can be found here: https://www.exim.org/exim-html-current/doc/html/spec_html/ch-dkim_and_spf.html https://www.exim.org/exim-html-current/doc/html/spec_html/ch... Distributions often have their own documentation, for Debian: https://debian-administration.org/article/718/DKIM-signing_outgoing_mail_with_exim4 https://debian-administration.org/article/718/DKIM-signing_o... and https://debian-administration.org/article/719/Avoiding_mail-spoofing_with_SPF https://debian-administration.org/article/719/Avoiding_mail-... Keep in mind this is all to increase deliverability of your outgoing mail. You may also optionally want to check SPF and DKIM on incoming mail to cut down on spam: https://debian-administration.org/article/721/Validating_SPF_and_DKIM_at_SMTP-time_with_exim https://debian-administration.org/article/721/Validating_SPF...
stevenicr 7y ago
I remember a story (maybe from here?) a couple years back where someone had their gmail account blocked - and they lost google services - and they needed access to docs and other things to work with his team.. and after trying for days to get it brought back, he was essentially laid off from work as he could not participate in any of the tools that were being used by the rest of the company. I had a time a while back when my youtube account got blocked - and then I found that googleplus had put a block on the account and it auto-blocked the youtube videos - and they said all the videos were find for youtube and no problem there - but they would not go over the heads of the googleplus team, so we were screwed. we should have posted on many more sites your advice about "you don't own your own mailbox. When was the last time you made a backup of your GMail account? What contingency plan do you have in-place if Google ever accidentally, unintentionally, or in this case, intentionally, shuts it down?" like how this site has recently added info about big G's censorship: https://news.ycombinator.com/item?id=21490272 https://news.ycombinator.com/item?id=21490272 most people don't know about these issues - they just assume gmail will be there, and google's search shows truth.
badrabbit 7y ago
Yeah.. True that. I lost access to paid email account due to problem coming up with funds for paying this year's fee. Was not a fun 2-3 weeks. I am with you but I think protocols and apps that are designed to allow users to own and host content on primarily their own device would be great. For mail, what if email was always delivered to device for free and you pay a service provider to mirror it so that while your account is active,they provide backup,spam filtering and content search on their servers?
fencepost 7y ago
Worth noting: I'm not sure about Microsoft's procedures for shutting down an account the way Google did here, but they document what happens if you stop paying for it: https://docs.microsoft.com/en-us/office365/admin/subscriptions-and-billing/what-if-my-subscription-expires?view=o365-worldwide https://docs.microsoft.com/en-us/office365/admin/subscriptio... Basically it goes through Expired, Disabled, Deprovisioned. During Expired users have access, Disabled only Admins have access, Deprovisioned is gone. Those are usually 30/90 days but it varies by how you purchased. Not sure about Personal/Home, but I suspect it's similar.

oneeyedpigeon 7y ago

I would also recommend never storing mission-critical stuff only in your email. Losing the contents of your inbox should be the least of your concerns if there’s a chance you might lose access to your account. There are far worse repercussions - e.g. a) how do you update everyone else's record of your email address? b) how many services have you locked yourself out of, or made doing so much more likely?

chii 7y ago
It makes owning your email address (including the domain name part) crucial. It's time people separated the hosting of email from the interface (the address).
- fyp 7y ago
  I think most people just don't realize how easy this is and you can even keep using gmail. Most domain registrars have free email forwarding so you can forward *@domain.com to your gmail. This by itself is already good enough for signing up for things or resetting passwords. If you also need to send from that domain in gmail there's just a few more steps: https://support.google.com/domains/answer/9437157?hl=en https://support.google.com/domains/answer/9437157?hl=en
- harperlee 7y ago
  Unfortunately it is no longer free to use a custom address in gmail; it used to be that just owning a domain would do the trick.

ravenstine 7y ago

No only that but, by doing so, they're effectively taking away any remaining semblance of proof that you weren't spamming.

dannyw 7y ago

We need legislation. Google is too powerful.

DaiPlusPlus 7y ago
Legislation to protect e-mail mailboxes as the same way we do with official postal (snail-)mail services in most countries needs to be handled very carefully, because otherwise we'll end up protecting spammers - the very opposite of the people we want to protect. I see this story as Google's equivalent of when Valve would ban people from Steam for crude comments they made on the Steam forums, which I understand meant they forfeited their entire game library - or Amazon banning people for reviews. If there is going to be any law or legislation - it should be to require service companies like Google, Valve and Amazon to treat the customer's "online personality account" (i.e. forum account, "community" account, etc) separately from their "value" account (i.e. whatever that which has _value_, be it their Steam library, their GMail mailbox, etc) - or at the very least, companies must be required to export 100% of the data in an account and providing that to the customer/user in the event they shut down an account (with reasonable constraints, such as the account having existed for at least 3 months and having been in good-standing until this specific incident, etc). And under no circumstances should anyone lose their software copyright licenses for violating a community ToS - feel free to ban them from the forums, et cetera, but being banned from the Steam forums must not mean they lose the right to play the copy of Half-Life 2 that they paid for.
- cameronbrown 7y ago
  Nit: Valve just banned them from forums, not Steam. They already do what you're proposing.
  - DaiPlusPlus 7y ago
    Got a link? I remember reading that people were banned from their Steam accounts entirely without any refunds and they had to resort to CC chargebacks.
    - 7y ago

m-p-3 7y ago

Google should be able to disable access to a specific service, not shutting down the whole account. They want to be the identity of the online world, they need the responsibilities that comes with it.

whateveracct 7y ago
Since when has Google ever took on "the responsibilities that come with it"?
whamlastxmas 7y ago
When I was a kid I had a Yahoo site with some images hotlinked to another domain. The domain owner changed the images to porn, reported my Yahoo account, and it got my account entirely deleted. Emails and groups and chat and all. Really dumb

konschubert 7y ago

More importantly, pay for your own email DOMAIN. And keep backups of your email. Then, even if your account gets shut down, you can get up and running elsewhere quickly.

tahdig 7y ago
Be careful: By hosting your main email on a custom domain(not a provider) you open a new attack vector for identity theft. Someone can hijack your godaddy/namecheap/gandi account and point the MX DNS records of the domain to their own server and receive all your "Forgot your password? here is the link to reset!" emails This a very bad advice unless you actually know what are the risks.
- doopfoopdoop 7y ago
  Is there a good way to protect against this aside from good password hygiene at your domain registrar? I use namecheap if that is relevant--maybe there's a better/more secure registrar to move to. But I guess, equivalently, someone can just equivalently hijack your email account directly if you use a service like Gmail or Yahoo.
  - aabbcc1241 7y ago
    It may helps if the sender send you password-reset email in encrypted format
  - tahdig 7y ago
    I think namecheap does not have a bad reputation, godaddy is known to be bad though(both security and customer support). The thing is, of course people can hack your gmail or yahoo mail somehow, but when you host your own domain, you have the same attack vectors + dns hijacking and this last addition is easier to exploit with social engineering. Google atleast is virtually immune to DNS hijacking.
  - yjftsjthsd-h 7y ago
    Just the usual advice, I would think: Strong, unique password, and enable 2FA.

ryandrake 7y ago

Or self-host. Linode VPS: $5/mo and for that I can host E-mail, a light duty web server, and other various odds and ends. I don't have to worry about some random algorithmic account suspension removing access to my E-mail (and all of my online accounts, since they use my E-mail address for verification). And I don't have to worry about some random algorithmic process determining what E-mails I receive and which ones get silently dropped into a black hole. So far no problems with misconfiguration or other providers dropping my mail--while it probably happens, I think the risk of that is overblown if you configure SPF, DKIM, and so on correctly.

ravenstine 7y ago
We're there any good resources you used for learning how to configure SPF and DKIM?
- ryandrake 7y ago
  Linode's documentation tends to be pretty good: https://www.linode.com/docs/email/postfix/configure-spf-and-dkim-in-postfix-on-debian-8/ https://www.linode.com/docs/email/postfix/configure-spf-and-... That guide assumes you're using postfix as your MTA. For exim, their documentation can be found here: https://www.exim.org/exim-html-current/doc/html/spec_html/ch-dkim_and_spf.html https://www.exim.org/exim-html-current/doc/html/spec_html/ch... Distributions often have their own documentation, for Debian: https://debian-administration.org/article/718/DKIM-signing_outgoing_mail_with_exim4 https://debian-administration.org/article/718/DKIM-signing_o... and https://debian-administration.org/article/719/Avoiding_mail-spoofing_with_SPF https://debian-administration.org/article/719/Avoiding_mail-... Keep in mind this is all to increase deliverability of your outgoing mail. You may also optionally want to check SPF and DKIM on incoming mail to cut down on spam: https://debian-administration.org/article/721/Validating_SPF_and_DKIM_at_SMTP-time_with_exim https://debian-administration.org/article/721/Validating_SPF...

stevenicr 7y ago

I remember a story (maybe from here?) a couple years back where someone had their gmail account blocked - and they lost google services - and they needed access to docs and other things to work with his team.. and after trying for days to get it brought back, he was essentially laid off from work as he could not participate in any of the tools that were being used by the rest of the company. I had a time a while back when my youtube account got blocked - and then I found that googleplus had put a block on the account and it auto-blocked the youtube videos - and they said all the videos were find for youtube and no problem there - but they would not go over the heads of the googleplus team, so we were screwed. we should have posted on many more sites your advice about "you don't own your own mailbox. When was the last time you made a backup of your GMail account? What contingency plan do you have in-place if Google ever accidentally, unintentionally, or in this case, intentionally, shuts it down?" like how this site has recently added info about big G's censorship: https://news.ycombinator.com/item?id=21490272 https://news.ycombinator.com/item?id=21490272 most people don't know about these issues - they just assume gmail will be there, and google's search shows truth.

badrabbit 7y ago

Yeah.. True that. I lost access to paid email account due to problem coming up with funds for paying this year's fee. Was not a fun 2-3 weeks. I am with you but I think protocols and apps that are designed to allow users to own and host content on primarily their own device would be great. For mail, what if email was always delivered to device for free and you pay a service provider to mirror it so that while your account is active,they provide backup,spam filtering and content search on their servers?

fencepost 7y ago

Worth noting: I'm not sure about Microsoft's procedures for shutting down an account the way Google did here, but they document what happens if you stop paying for it: https://docs.microsoft.com/en-us/office365/admin/subscriptions-and-billing/what-if-my-subscription-expires?view=o365-worldwide https://docs.microsoft.com/en-us/office365/admin/subscriptio... Basically it goes through Expired, Disabled, Deprovisioned. During Expired users have access, Disabled only Admins have access, Deprovisioned is gone. Those are usually 30/90 days but it varies by how you purchased. Not sure about Personal/Home, but I suspect it's similar.