4 ms·
Any thoughts on how Google could prevent this? Seems important they provide a way to reclaim domains.
by btucker 15y ago
Any thoughts on how Google could prevent this? Seems important they provide a way to reclaim domains.
- vladd 15y agoWhen a domain is being reclaimed by someone signed into a different Google Account than the previous admins, check if the domain's whois creation date has changed, and if so, make it mandatory to wipe out the data previously associated with the domain before continuing. In addition, password resets via email requested at domains having the whois creation date after the account creation date should probably be disabled.
- DenisM 15y agoRequire a phone number and send SMS for accessing domains which have previously expired.
- vladd 15y agoThat won't work for existing customers since requiring a phone number must be done when initially signing up. In addition, expired domains purchased by someone else won't be usable with Google Apps.
- Sidnicious 15y agoI think that the trust model for Google Apps account recovery is wrong. The domain name is a separate asset from the Apps account and the data in it. The owner of the domain name should be able to create a brand-new Google Apps account for it. Recovering access to an account should be done through another channel (secondary email address, SMS, postal mail).
- vladd 15y agoThis isn't practical since any Apps admin account has by definition access to modify/reset all regular accounts belonging to that company/domain, so if you don't use things like wipeouts upon whois creation date modifications, the potential to expose a lot of private data from the former owner still exists.
- Sidnicious 15y agoMaybe “account” is the wrong word. I think that the domain’s owner should be able to create an entirely new “instance” of Google Apps (with separate users and separate data), whereupon the old instance would be detached from domain. An admin of the old apps instance should be able to get into it to access data, delete it, or attach it to a different domain name.
- zmmmmm 15y agoGoogle has been pretty strong on encouraging users to enter a "backup" email address. At least, on 4 different gmail accounts it pestered me mercilessly until I gave it one. Seems like if you are trying to reclaim a domain then requiring the user to verify access to their "backup" email address could be a simple step that would help a lot.
- OneWhoFrogs 15y agoGoogle could ask for the password of the old account. If the user gets it correct within x tries, restore the data. If not, start anew.