4 ms·

This isn't your average "Oh no, I became a victim too" post. I want to collect your ideas how we can fix this problem/issue once and for all

greenyoda 6y ago
Google seems to have no desire or incentive to fix this problem. However, people can reliably prevent the problem from happening to themselves by not using Gmail. (If you want a recommendation for an e-mail provider, I can recommend Fastmail - I've been using them for years and they've been very reliable. They also have customer support. Their service is not free, however.)
sneak 6y ago
One of the biggest problems, I’ve found, is that if you enable mandatory hardware 2FA (U2F) on your Google account, the so-called Advanced Protection Program, you can no longer get app passwords to log in with IMAP, essential for mirroring your email somewhere else automatically. It’s really frustrating.
- meirelles 6y ago
  You actually can. It's possible to create app specific passwords. Well, a while ago at least.
  - ephimetheus 6y ago
    That initially got deprecated for paid accounts. But I think they’ve since delayed the deprecation indefinitely, probably because they got strong push back.
  - sneak 6y ago
    Not if you have mandatory hardware 2fa (advanced protection program) on, no. You're probably thinking of just 2fa enabled, which still permits TOTP (and app passwords). Once you enable APP, it is U2F only, and app passwords are no longer possible.
- viraptor 6y ago
  Sure you can. Read this https://support.google.com/mail/answer/185833?hl=en https://support.google.com/mail/answer/185833?hl=en
  - ephimetheus 6y ago
    This was going to be disallowed for paid accounts. The change is on ice for now as far as I know.
dschuler 6y ago
Pay for hosted email. You can always get human support if you pay for e.g. MS Exchange. Use a custom domain, so you can switch providers if needed. There’s no substitute for having control.
rasz 6y ago
Sue. There are bound to be country with consumer protection laws guaranteeing actual consumer support.
kace91 6y ago
I think the fix (from a legal perspective) is very simple. Ban me from your services if you want, but banned accounts should be able to download their information, for a reasonable timeframe. In the case you were using Google products as a business (YouTube, Google apps), allow the banned user to show a text communicating to their users the service they moved to or where they can be contacted. It's a bare minimum, but it would get us real far.
- nextaccountic 6y ago
  Also, a provision that enables the person to switch emails from all accounts that depend on it. This requires giving the user limited access to email (basically viewing confirmation emails from other services) until they migrate everything out. This needs to be law.
  - kace91 6y ago
    Good point, I had missed the impact of email as an authentication tool. I think the industry should move towards a decoupling of that from email (or worse, social networks). I think there's been some movement towards using phone numbers instead, but that presents its own kind of issues.
- derwiki 6y ago
  Does CCPA or GDPR allow for this?
  - kace91 6y ago
    I'm not sure, to be honest. I think GDPR would grant you access to the personal data the service holds of you, but AFAIK they have no obligation to keep the data, so they could have previously removed it (?). There must be a provision for that I guess, since otherwise companies could potentially react to GDPR requests of access by nuking all the information they hold about that user and then replying they've got nothing, which would be a major hole. But I honestly don't know.
- yencabulator 6y ago

greenyoda 6y ago

Google seems to have no desire or incentive to fix this problem. However, people can reliably prevent the problem from happening to themselves by not using Gmail. (If you want a recommendation for an e-mail provider, I can recommend Fastmail - I've been using them for years and they've been very reliable. They also have customer support. Their service is not free, however.)

sneak 6y ago

One of the biggest problems, I’ve found, is that if you enable mandatory hardware 2FA (U2F) on your Google account, the so-called Advanced Protection Program, you can no longer get app passwords to log in with IMAP, essential for mirroring your email somewhere else automatically. It’s really frustrating.

meirelles 6y ago
You actually can. It's possible to create app specific passwords. Well, a while ago at least.
- ephimetheus 6y ago
  That initially got deprecated for paid accounts. But I think they’ve since delayed the deprecation indefinitely, probably because they got strong push back.
- sneak 6y ago
  Not if you have mandatory hardware 2fa (advanced protection program) on, no. You're probably thinking of just 2fa enabled, which still permits TOTP (and app passwords). Once you enable APP, it is U2F only, and app passwords are no longer possible.
viraptor 6y ago
Sure you can. Read this https://support.google.com/mail/answer/185833?hl=en https://support.google.com/mail/answer/185833?hl=en
- ephimetheus 6y ago
  This was going to be disallowed for paid accounts. The change is on ice for now as far as I know.

dschuler 6y ago

Pay for hosted email. You can always get human support if you pay for e.g. MS Exchange. Use a custom domain, so you can switch providers if needed. There’s no substitute for having control.

rasz 6y ago

Sue. There are bound to be country with consumer protection laws guaranteeing actual consumer support.

kace91 6y ago

I think the fix (from a legal perspective) is very simple. Ban me from your services if you want, but banned accounts should be able to download their information, for a reasonable timeframe. In the case you were using Google products as a business (YouTube, Google apps), allow the banned user to show a text communicating to their users the service they moved to or where they can be contacted. It's a bare minimum, but it would get us real far.

nextaccountic 6y ago
Also, a provision that enables the person to switch emails from all accounts that depend on it. This requires giving the user limited access to email (basically viewing confirmation emails from other services) until they migrate everything out. This needs to be law.
- kace91 6y ago
  Good point, I had missed the impact of email as an authentication tool. I think the industry should move towards a decoupling of that from email (or worse, social networks). I think there's been some movement towards using phone numbers instead, but that presents its own kind of issues.
derwiki 6y ago
Does CCPA or GDPR allow for this?
- kace91 6y ago
  I'm not sure, to be honest. I think GDPR would grant you access to the personal data the service holds of you, but AFAIK they have no obligation to keep the data, so they could have previously removed it (?). There must be a provision for that I guess, since otherwise companies could potentially react to GDPR requests of access by nuking all the information they hold about that user and then replying they've got nothing, which would be a major hole. But I honestly don't know.
yencabulator 6y ago