16 ms·

I'd extend this even further: never use a single account for more than one purpose. Create a separate account at the same company for the other purpose. Some ex

I'd extend this even further: never use a single account for more than one purpose. Create a separate account at the same company for the other purpose. Some examples: - Every product/project you manage should be on a separate account on Google, Facebook, Amazon, etc. - Nothing tied to your consumer accounts should be used for anything business related. - Your Amazon shopping account and your AWS account should definitely not be the same account. - Don't use services where you're required to mix accounts like this. Some examples: - If the issue in this thread is actually an automatic ban, account siloing very likely would have avoided the issue. ([edit] likely, it would not have been possible to silo accounts in this case, as a child comment points out) - Facebook apparently lacks the willingness to block an account from Marketplace, but they will block an account from all Facebook properties. - Paypal has banned businesses because the account was created years ago by someone who at the time the account was created was 17. The point of this isn't that it's impossible to connect the dots that you are the same person. The point is to make it difficult for an automated system to deal too much damage to you, and make it difficult for someone looking at a single account's history from accumulating too many "strikes" against that account.

genuine_smiles 6y ago
> - Every product/project you manage should be on a separate account on Google, Facebook, Amazon, etc. I wouldn’t do this with Facebook. Creating a second account is against Facebook policy, and they may ban both accounts.
- ryandrake 6y ago
  Legit question: is there any other service/company on earth that bans you for having multiple accounts? This seems like an insanely restrictive policy. One of the defining characteristics of internet communication is that you can have a “work persona” and a “home persona” and maybe another one for your hobbies, another one for your porn browsing and gambling, another one for your aunts and uncles. To deny this basic, universal concept is backwards and frankly shouldn’t be acceptable to anyone.
  - coliveira 6y ago
    Internet companies have decided to deny this right the moment they figured out that your identity is valuable. Nowadays Google and FB, among others, will punish you if you use different online identities without their knowledge.
  - dasyatidprime 6y ago
    GitHub disallows multiple free accounts in the TOS, meaning identity separation seemingly implies a continuous subscription cost forever. I'm not aware of any high-profile enforcement, but it's there.
  - matkoniecz 6y ago
    https://en.wikipedia.org/wiki/Wikipedia:Sockpuppetry https://en.wikipedia.org/wiki/Wikipedia:Sockpuppetry It is also a common policy on many forums. And while I love complaining about policies and behavior of FB, Google, Amazon etc, this one makes sense. Almost always you ban person, not account - so standard is to allow one account or to require accounts to be clearly linked (for example, a separate bot account that is clearly declared).
    - panic 6y ago
      Wikipedia's policy doesn't say you can't have multiple accounts, just that you can't misuse them.
  - numpad0 6y ago
    Microsoft reportedly has internal one identity policy, Facebook is notorious for forcing people to expose, etc.
    - PeterisP 6y ago
      It would be so ridiculous for Microsoft to have a one identity policy because Microsoft software accounts are generally provided by employers and tied to them, I have 4 MS identities (personal, two companies and university) and MS does not provide an option to use a single identity for that.
- CGamesPlay 6y ago
  You can create Page accounts directly, which are not "people", so they aren't subject to that policy. They also do not have access to the same features, however.
- rexf 6y ago
  It seems like a risk with Google too. It's common to be logged into Google/Gmail with multiple Google accounts. Even with separate Google accounts, Google can tell they are related and could potentially ban them too. A quick web search came up with Google's "associated account ban": > "Associated account ban" means not just explicit account linkages, but also implicit ones, where a wife can be banned for the misbehavior of her husband https://www.reddit.com/r/androiddev/comments/ckoej1/googles_practice_of_associated_account_ban_aka/ https://www.reddit.com/r/androiddev/comments/ckoej1/googles_...
  - deleted 6y ago
    [deleted]
  - malka 6y ago
    It is funny how Google behaves like the worst dictatorship on the planet. Guilt by association is such a bunch of crap.
  - pudmaidai 6y ago
    I just can’t wait for my personal Google accounts as well as several others business accounts I access regularly to suddenly be blocked all at once.
- ipaddr 6y ago
  Every older person I know does this because some games require to be unlocked at different stages by a friend.
- inopinatus 6y ago
  Facebook's demand is this brain-damaged garbage: If you want to represent your business, organisation, brand or product on Facebook, you can use your personal account to create and manage a Page. We have a diametrically conflicting policy, by which personal accounts absolutely may not be used to manage company resources, for exactly the aforementioned reasons of minimising blast radius; so, we basically gave up on Facebook. The double standard is evident: can you imagine any FAANG security team allowing a major corporate communications channel to be owned by a personal account? Answer: no; because doing something that fucking stupid would be a disciplinary offence.
  - bennyp101 6y ago
    Yep, I wanted to set up a Facebook page for my company, but as I don't want a personal Facebook account, I figured it wasn't worth it because it would end up being fake info, and they could then just shut it down.
dfabulich 6y ago
(Author here.) This is excellent advice for consumer apps/products, (it's especially important to keep enterprise accounts fully separate from your individual consumer accounts), but it wouldn't have helped DroidScript in this case. DroidScript is a non-profit organization; when they signed up for Google AdMob and Google Play Store, they provided the same tax ID (their EIN) in both cases. Creating separate Google accounts with separate email addresses would not have been sufficient; Google knows that they're paying the same company. (The ads in question were being run inside the same app that accepts Google subscription revenue. Google can and will follow that thread!) Creating a subsidiary business for every type of Google account you have would be quite expensive, and, if Google realizes what you're doing, it will make you look like you have something to hide, making you more likely to get banned, not less.
- o-__-o 6y ago
  > Creating a subsidiary business for every type of Google account you have would be quite expensive Costs roughly $1000/yr to run a properly sheltered LLC. Just saying, that’s a low barrier to overcome for any company turning modest revenue.
  - blibble 6y ago
    why so expensive? in the UK it's £13/year (under $20)
    - rexf 6y ago
      Depends what US state you choose. In CA, you pay $800 a year for your LLC. > An $800 annual tax is generally imposed on limited partnerships (LPs), LLCs, ... Source: https://www.ftb.ca.gov/forms/2020/2020-568-booklet.html https://www.ftb.ca.gov/forms/2020/2020-568-booklet.html
      - o-__-o 6y ago
        It does depend on the state. I am also including registered agents, physical (mailing address) and digital presence. Depending on the nature of the business, insurance is also included in that cost. I did not include increased accounting costs
paxys 6y ago
While I get what you are saying, this is sounding more and more like an abusive relationship. "Getting beaten by your husband? Try not being around him when he is drunk." At some point we have to face the reality that the tech ecosystem needs some serious fixing, for both consumers and developers.
- nawgz 6y ago
  Since when have we not looked at capitalist entities as abusers and exploiters? No one wants to be in this situation wrt megacorps and their stranglehold on the internet, free speech, and so many livelihoods. Putting the onus on consumers to fix this is hilarious and naive.
  - vineyardmike 6y ago
    While I agree that the onus should not be on consumers, it’s generally not bad advice to say “avoid those who abuse you”. it would be better, of course, to say “avoid those who abuse you… but I’ll be trying to protect you”
  - jerf 6y ago
    Look at it as a part of the portfolio of approaches we take to address this problem. It may not solve the problem on its own, but it's an important step to take. And arguably a necessary one; a great deal of what gives these companies so much power is that people simply can't imagine trying to do without them and don't even try. Just because people say to stop giving them so much money and attention doesn't mean that they think that's the whole solution. But if you aren't making even a token effort to stop giving them so much money and attention, you're probably more part of the problem than the solution. If you think these companies are a problem... take action. If you aren't willing to even so much as cancel a streaming subscription or take responsibility for backing up your own photos or whatever the issue is, you're sending major signals to the legislative system or whoever else it is you expect to swoop in and save you that you don't care enough for them to need to do anything either. I don't mean this to be absolutist, either. I use Google in a few places, even despite my distrust and distaste of them. But even there, I hold them at arm's length. If they completely nuked my current accounts, it would mostly be an inconvenience. Worst bit would be the ~$20 of apps I'd have to repurchase. (I'd lose more than that but mostly I could just let them go.)
chayleaf 6y ago
Sometimes when one of your accounts get banned you (the account owner) are legally required to stop using any other accounts. Bottom line - it increases survivability, but at the cost of breaking ToS. Separating corporate and personal accounts is a good idea in any case though.
ryandrake 6y ago
> I'd extend this even further: never use a single account for more than one purpose. Create a separate account at the same company for the other purpose. This should really go without saying. I’m sometimes shocked at the extent to which it has become normalized to mix up one’s personal accounts with work. I can’t count the number of times a colleague accidentally sent me an email using their personal account, or texted me from their personal phone. Some people even use their personal phone directly for work, without even doing so much as creating a work profile. Why are you doing this to yourself? You’re just asking for trouble. Don’t even get me started on how entrenched “Sign In With [Company]” schemes have gained traction. Why deliberately have such a single point of failure? To save what? An additional password?
- twright0 6y ago
  Firm agree on mixing work/personal contexts. However, in practice, using "Sign in with Google" by default dramatically increases resilience to most failure modes for almost everyone without a sophisticated threat model. > To save what? An additional password? The average person does not manage their passwords in a sophisticated way; if someone is signing up for many different services, they are probably using the same password everywhere, or some simple enumeration scheme. Then, when some random forum or web service gets compromised (as they inevitably are), their password to everything is compromised - including Google! On the opposite end of the spectrum, if Google is the only service with a password, and everything else is driven by Google-owned SSO, that person is essentially immune to compromise; whatever I think about the company, I do believe in Google's security team to keep passwords safe and block dictionary attacks more than any other service on the internet. And while we can evangelize setting up password managers and using strong random passwords everywhere, the truth of the matter is that many people simply cannot accomplish this. "Sign in with {Google, Facebook, Microsoft}" gets them 95% of the benefit at much higher reliability.
  - ximeng 6y ago
    Using Google SSO is fine unless Google arbitrarily closes your account with no recourse.
taneq 6y ago
> Don't use services where you're required to mix accounts like this. In fact don't let your business depend on these services full stop. EVER.
serial_dev 6y ago
Then you will get flagged for creating too many accounts...
cookiengineer 6y ago
Can confirm this solid advice. Even at a mega-scale social games publisher like Zynga, we had to deal with automated bans all the time. That's why at one point we used an avatar for each game that was separately managed and was basically a separate identity with a separate bank account with a holding company etc. - Invent an avatar that has their own profile, residence, birth date, gender etc. - Use separate email addresses, not on your company's domain (to avoid domain bans). - Use a separate mobile phone number, if possible. - Use a separate smartphone device. There's Android devices for less than 100 bucks now, so that shouldn't be an issue. - Make sure the geolocation of the Android device doesn't change too often. Paypal and others block you immediately because they're too stupid to realize people can actually travel and work from multiple locations; even with 2FA and SS7 enabled. - Use a password manager, use 2FA, and make sure to backup account data and every security question. (and all the other standard practice advice) - Treat your app's / game's avatar as a separate identity, which means don't have the same friends that your private accounts do. Don't link to other accounts of your ownership. Don't mention other projects of your company, otherwise they'll likely ban both accounts for click fraud.
- andi999 6y ago
  How do you make an avatar with a bank account?
  - tomcam 6y ago
    I too am trying to work that one out. My guess is that they used DBAs, each with a separate bank account.
  - mnd999 6y ago
    They said they used holding companies.
  - DocTomoe 6y ago
    Many fintech banks do give you the option to open up separate accounts with individual bank account numbers quickly and hassle-free, e.g. bunq.
  - 6y ago
KorematsuFred 6y ago
This in general is sound advice however most large cos will have the ability to detect cluster of ids that are owned by same person. - Beware of impersonation. It is a felony offense. When you create accounts give the same first name and last name. There are many forms where you have to answer questions like "Have you ever used any other alias?". While 99% of times it is fine, there are rare cases where you might get into trouble. I know some people who did.
- dangero 6y ago
  Can you elaborate on how people got busted for an alias?
nickphx 6y ago
I would exercise caution doing that. If the accounts are created from the same infrastructure (IP, computer, mobile device), they are easily associated and can be swept up in a ban.
anoncow 6y ago
We need competition, an alternate app store or a rule that says that companies involved in making operating systems cannot get into the business of maintaining/curating/controlling app stores. Else these app publishers end up being beholden to the whims of the companies controlling the app stores.
EvangelicalPig 6y ago
> - Your Amazon shopping account and your AWS account should definitely not be the same account. If you need another reason. I've heard allegations that the recovery process for Amazon shopping accounts and for dedicated AWS accounts are different, with the former being easier to socially engineer. Probably some risk management department figuring that in the case of the former any "fraud" can be resolved with any chargebacks/refunds
privacyking 6y ago
Even if you use separate accounts, Google can and has banned all associated accounts (including personal accounts) in the past.
- dgs_sgd 6y ago
  What do you mean by associated accounts? How does Google know they are linked?
  - avereveard 6y ago
    Same device access, same email domain, same tax registration number, going off other answers in the thread
    - kwdc 6y ago
      Its just about same anything. Simple guilt-by-association is a real thing for google at least. You have an employee who's deemed by google as a bad app developer? That can impact the business that employs them even if its an unrelated app.
      - pudmaidai 6y ago
        If I remember correctly GitHub also locked an entire organization’s repos because someone accessed GitHub from a red-flagged country probably 2 years ago. I can’t wait for regulation to arrive and stop this kind of behavior.
        sundarurfriend 6y ago
        That's a very different thing, because they were worried about breach of US law. Not saying that makes it fair or non-destructive to the business, but it's not in the same league as Google being over-aggressive in protecting their ad money. (And if there were regulations around this, Github would probably still have done the same thing, because "national security" regulations punch through "consumer protection" regulations every time.)
dheera 6y ago
> account siloing very likely would have avoided the issue Not necessarily, if your personal@gmail.com and business@corp.com Gmail accounts almost always access Google from the same Comcast IP address, from the same Wi-Fi BSSID, and awake/active at similar hours, Google could easily tell these two accounts are likely the same person. AFAIK AdSense also tries to detect forms of click fraud where you ask people in your network to help you click ads, and I can only imagine they can do that because know who you have e-mailed before, whose phone contacts you have, and who you have had calendar events or Hangouts with before. Banning apps with no recourse or appeal process, however, should really be illegal. They could easily bankrupt certain small businesses and livelihoods from their rash algorithmic decisions.
purplecats 6y ago
Agreed. But this causes so much energy expenditure in setting up and maintaining these separate profiles for each project. We need more tools in this space, along the vein of password managers.
BeyondLimits99 6y ago
Couldn't agree more. My Amazon retail account got flagged for fraud (cause I had an old CC attached to the account). My AWS account got disabled as well
mschuster91 6y ago
> Create a separate account at the same company for the other purpose. To make it even worse: you should even keep separate devices for the profiles. God knows who uses device-unique identifiers to join "sock puppet" accounts together, it is pretty much suspected that Twitter does.
ashkankiani 6y ago
Until those services decide to force you to have a phone number registered, which means that you can't have more than one of those services, unless you're willing to sign up for a new cell contract because they don't accept prepaid cell numbers anymore or VOIP numbers. (yes, this is based on personal experience)
pretext 6y ago
I'd called it 'account sandboxing'.
- bryanrasmussen 6y ago
  I wonder if there is a business model for this.
Tepix 6y ago
This is what makes the forced Facebook login for the newer Oculus VR devices so problematic. You can't create a second Facebook account just for VR. If you get banned on Facebook, you lose access to your paid Oculus store apps on your VR glasses. Of course, granting Facebook access to the extremely private tracking data that you can gather during use of VR is another terrible idea.
johnx123-up 6y ago
IMHO, it is not true with GitHub. Once I had to access a couple of my clients' GitHub account and all of them got banned. It was a stressful process to remove the flag.
AgentME 6y ago
> - Your Amazon shopping account and your AWS account should definitely not be the same account. My Amazon account has been locked for a few days now because I tried to buy a friend a gift card, and I can't even access my AWS account at all. Thankfully all I have on there currently is some old backups in S3, but I previously used AWS for some projects and this could've been a fucking disaster. I tried to buy an Amazon gift card the other day for a friend's birthday, and a few minutes afterwards, the transaction was reverted and my account "was locked for unusual activity". I got an email saying they thought an unauthorized party accessed my account, and it included instructions to reset my password. I did so and then tried to buy the gift card again. A few minutes later, my account was locked again, and this time it told me to wait two hours and then call customer support. I did so, explained everything, got my account unlocked, and the customer service rep assured me the gift card purchase would work this time and volunteered to stay on the line for a few minutes while I reordered the gift card to make sure it worked correctly. It seemed to go through, and then an hour later it got reverted and my account got locked a third time. I waited two hours, called customer service again, and they told me that they'll mark the purchase as legitimate and that I should try logging in again after 24 hours. It's been a few days and my account is still locked. I need to call again. Seriously what the fuck.
- deleted 6y ago
  [deleted]
- epicalex 6y ago
  I've just had a similar experience with ebay. About 75% of the times I log on to ebay, (no exaggeration, I only purchase something a few times a year and this happens almost every time), my account gets locked for suspected unauthorised access and I'm forced to reset my password. I have a static IP, and only ever use the same two devices. I have a strong unique password. I spent 15 minutes on the phone with their account security team who could tell me nothing about what triggered the lock, nor did they have any advice on what I could do to prevent this from recurring. Something in their automated system is giving a false positive, and neither I nor seemingly anyone on the account security team has any way to address it.
  - 6y ago
unionpivo 6y ago
I would add that buy your domain separately. All cloud/hosting providers offer domains sometimes for free. You don't want that. Because if you get locked out of an account you get locked out of your domain. Sure you can sometimes get at least domain back, but that usually involves layers and can take weeks or months. If you can (its often not practical, but when it is) hosts your DNS elsewhere as well. And most importantly, have at least one backup somewhere else (if you host on AWS have backup on something that isn't using AWS as a backend)
thih9 6y ago
> Create a separate account at the same company for the other purpose. I'd love to create separate accounts for other purposes, but doing this has become such a big pain that I only did it a couple of times so far. Most services now require mobile number during account registration. It seems necessary to provide a unique number, but how to get one? Numbers from "burner" apps often cannot get the text with confirmation code. Also, the registration process itself is difficult; sometimes multiple genuine attempts at account registration get your IP blocked, at least temporarily. If anyone has any tips, I'd be happy to hear them.
eloisant 6y ago
This is the right thing to do, however Google has ways to detect multiple accounts from the same individuals. Cookies, credit card numbers, IP addresses, etc. It's really hard to separate them enough so they can't link them. And sometimes they will ban all your accounts if they find something they dislike on one of them.
- wwn_se 6y ago
  Yep, separate devices is the way to go. It can be a hassle but to setup but its worth it in the long run.
londons_explore 6y ago
For Google specifically, do not use one email address as a recovery address for another - both will be banned together. Also, do not share recovery phone numbers.
ezoe 6y ago
Well, if you took such strategy, obviously you nee more precautions. - Never share the same IP address among accounts. - But keep IP address range consistent for one service because anomaly means automatic ban. - Never share the same physical computer among accounts. Or you can be like never bother to relies on a single platform.
- thiht 6y ago
  Hopefully they wouldn't ban other accounts linked to the same IPs? I mean, what about families sharing a single IP? A single computer? Sometimes a single phone number? What about companies VPNs? What about hotspots and public WiFi?
simiones 6y ago
That is quite a bit of effort to protect from accidental temporary bans. It's definitely important (and easy) not to mix personal and business accounts, even for for single-person companies. But keeping different accounts for different parts of the same company without committing fraud is not that easy. If the ban is permanent and results from a change in policy, this won't help significantly anyway: if Google actually wants to ban your business, they will find all related accounts, and ban them.
kypro 6y ago
While this is good and practical advice, it does irritates me that there isn't more of a push for regulation to protect people against automated actions like this. I know in the EU we have protections under GDPR which allow us to request an explanation for an automated action, but I don't believe we have anyway to request human review. Part of the problem it seems is that even if these actions are unfair and unjustified it still makes financial sense for these companies to be trigger happy with automated account bans rather than implementing a more nuanced and intelligent approach which would likely require some human intervention or investment in more intelligence automated systems. If we had some way to request human review or dispute automated actions it would become far more expensive to take unjustified automated actions as people would just complain and request a human reviews the case. Personally I think we've become far too comfortable with tech companies making it almost impossible to contact them. Requiring a human review process for automated actions and requiring companies have some way for customers to contact a human would create jobs and give us some legal right to adequate consumer service. It's weird to me that we have rights when it comes to how our data is used (at least in the EU), but no right to basic consumer service when our business is destroyed overnight because Google takes some automated action.
- irl_ 6y ago
  GDPR is for people. It doesn't help you if you're a business.
  - lmkg 6y ago
    There is broad precedent that some GDPR protections also apply to businesses that consist of a single person.
- lmkg 6y ago
  > I know in the EU we have protections under GDPR which allow us to request an explanation for an automated action, but I don't believe we have anyway to request human review. There is, with limitations. The relevant part of GDPR is Article 22, "Automated individual decision-making, including profiling" (Full text: https://gdpr-info.eu/art-22-gdpr/ https://gdpr-info.eu/art-22-gdpr/) This is probably the most restricted of the rights granted under GDPR. You have the right to manual review of algorithmic decisions, only when those decisions result in "legal effects concerning him or her or similarly significantly affects him or her." Whether it applies to Google depends on how you interpret "similarly significantly affects," and that's something likely to vary from country to country and well beyond my experience with GDPR. If this were the US, I would expect that to include housing and employment. There's a much stronger argument that this right applies to a Google account if it represents a significant fraction of your business income.
bitL 6y ago
Amazon groups accounts they think they belong to the same person and when one is banned, they band them all. Just ask 3rd party marketplace sellers. I doubt G/FB aren't doing the same.
corobo 6y ago
> Create a separate account at the same company for the other purpose fyi this is against Google Ads's terms last time I looked into it. You can do it if you've got the secondary account registered as it's own legal entity but one Ad account per entity
1MachineElf 6y ago
Using multiple accounts like this can also assist with implementing separation of duties.
nickthemagicman 6y ago
Isn't that textbook ban evasion? The company is for sure tracking your IP's and if they see two account with the same IP chances are they could ban both accounts. I would use a VPN with your other account to be careful, or just in general. And then they could also be fingerprinting your browser. I don't know of any safe way to have multiple accounts, other than separate computers and one of the computers is on a VPN.
toss1 6y ago
Yup This is also why I NEVER use "Log In with Google" on any other service or site. I also just realized that even using the gmail address as the contact/backup is a bad idea, as if the acct gets reset and I no longer have access to that email, it's unrecoverable (exit's stage left making task to change all acct contacts off of Google..). Also, seems from what I've read elsewhere, that the threshold for banning is as low as a single click on a known machine. this means that you can't even do a legitimate check of your own adverts. In essence, this means that the Googles and Facebooks of the world are working to connect and consolidate identity information, and we now must work extra hard to dis-aggregate it. Seems there's an opportunity in this space to simplify and automate parts of identity fragmentation...
driverdan 6y ago
While I agree with the suggestion it is explicitly not allowed on some platforms. We recently had this issue with Apple. We wanted to create a separate account for App Store Connect to use with automated builds. Apple locked the account and required identification scans. Our VPE submitted his own info and it was rejected. For now we're stuck using someone's personal account.

genuine_smiles 6y ago

> - Every product/project you manage should be on a separate account on Google, Facebook, Amazon, etc. I wouldn’t do this with Facebook. Creating a second account is against Facebook policy, and they may ban both accounts.

ryandrake 6y ago
Legit question: is there any other service/company on earth that bans you for having multiple accounts? This seems like an insanely restrictive policy. One of the defining characteristics of internet communication is that you can have a “work persona” and a “home persona” and maybe another one for your hobbies, another one for your porn browsing and gambling, another one for your aunts and uncles. To deny this basic, universal concept is backwards and frankly shouldn’t be acceptable to anyone.
- coliveira 6y ago
  Internet companies have decided to deny this right the moment they figured out that your identity is valuable. Nowadays Google and FB, among others, will punish you if you use different online identities without their knowledge.
- dasyatidprime 6y ago
  GitHub disallows multiple free accounts in the TOS, meaning identity separation seemingly implies a continuous subscription cost forever. I'm not aware of any high-profile enforcement, but it's there.
- matkoniecz 6y ago
  https://en.wikipedia.org/wiki/Wikipedia:Sockpuppetry https://en.wikipedia.org/wiki/Wikipedia:Sockpuppetry It is also a common policy on many forums. And while I love complaining about policies and behavior of FB, Google, Amazon etc, this one makes sense. Almost always you ban person, not account - so standard is to allow one account or to require accounts to be clearly linked (for example, a separate bot account that is clearly declared).
  - panic 6y ago
    Wikipedia's policy doesn't say you can't have multiple accounts, just that you can't misuse them.
- numpad0 6y ago
  Microsoft reportedly has internal one identity policy, Facebook is notorious for forcing people to expose, etc.
  - PeterisP 6y ago
    It would be so ridiculous for Microsoft to have a one identity policy because Microsoft software accounts are generally provided by employers and tied to them, I have 4 MS identities (personal, two companies and university) and MS does not provide an option to use a single identity for that.
CGamesPlay 6y ago
You can create Page accounts directly, which are not "people", so they aren't subject to that policy. They also do not have access to the same features, however.
rexf 6y ago
It seems like a risk with Google too. It's common to be logged into Google/Gmail with multiple Google accounts. Even with separate Google accounts, Google can tell they are related and could potentially ban them too. A quick web search came up with Google's "associated account ban": > "Associated account ban" means not just explicit account linkages, but also implicit ones, where a wife can be banned for the misbehavior of her husband https://www.reddit.com/r/androiddev/comments/ckoej1/googles_practice_of_associated_account_ban_aka/ https://www.reddit.com/r/androiddev/comments/ckoej1/googles_...
- deleted 6y ago
  [deleted]
- malka 6y ago
  It is funny how Google behaves like the worst dictatorship on the planet. Guilt by association is such a bunch of crap.
- pudmaidai 6y ago
  I just can’t wait for my personal Google accounts as well as several others business accounts I access regularly to suddenly be blocked all at once.
ipaddr 6y ago
Every older person I know does this because some games require to be unlocked at different stages by a friend.
inopinatus 6y ago
Facebook's demand is this brain-damaged garbage: If you want to represent your business, organisation, brand or product on Facebook, you can use your personal account to create and manage a Page. We have a diametrically conflicting policy, by which personal accounts absolutely may not be used to manage company resources, for exactly the aforementioned reasons of minimising blast radius; so, we basically gave up on Facebook. The double standard is evident: can you imagine any FAANG security team allowing a major corporate communications channel to be owned by a personal account? Answer: no; because doing something that fucking stupid would be a disciplinary offence.
- bennyp101 6y ago
  Yep, I wanted to set up a Facebook page for my company, but as I don't want a personal Facebook account, I figured it wasn't worth it because it would end up being fake info, and they could then just shut it down.

dfabulich 6y ago

(Author here.) This is excellent advice for consumer apps/products, (it's especially important to keep enterprise accounts fully separate from your individual consumer accounts), but it wouldn't have helped DroidScript in this case. DroidScript is a non-profit organization; when they signed up for Google AdMob and Google Play Store, they provided the same tax ID (their EIN) in both cases. Creating separate Google accounts with separate email addresses would not have been sufficient; Google knows that they're paying the same company. (The ads in question were being run inside the same app that accepts Google subscription revenue. Google can and will follow that thread!) Creating a subsidiary business for every type of Google account you have would be quite expensive, and, if Google realizes what you're doing, it will make you look like you have something to hide, making you more likely to get banned, not less.

o-__-o 6y ago
> Creating a subsidiary business for every type of Google account you have would be quite expensive Costs roughly $1000/yr to run a properly sheltered LLC. Just saying, that’s a low barrier to overcome for any company turning modest revenue.
- blibble 6y ago
  why so expensive? in the UK it's £13/year (under $20)
  - rexf 6y ago
    Depends what US state you choose. In CA, you pay $800 a year for your LLC. > An $800 annual tax is generally imposed on limited partnerships (LPs), LLCs, ... Source: https://www.ftb.ca.gov/forms/2020/2020-568-booklet.html https://www.ftb.ca.gov/forms/2020/2020-568-booklet.html
    - o-__-o 6y ago
      It does depend on the state. I am also including registered agents, physical (mailing address) and digital presence. Depending on the nature of the business, insurance is also included in that cost. I did not include increased accounting costs

paxys 6y ago

While I get what you are saying, this is sounding more and more like an abusive relationship. "Getting beaten by your husband? Try not being around him when he is drunk." At some point we have to face the reality that the tech ecosystem needs some serious fixing, for both consumers and developers.

nawgz 6y ago
Since when have we not looked at capitalist entities as abusers and exploiters? No one wants to be in this situation wrt megacorps and their stranglehold on the internet, free speech, and so many livelihoods. Putting the onus on consumers to fix this is hilarious and naive.
- vineyardmike 6y ago
  While I agree that the onus should not be on consumers, it’s generally not bad advice to say “avoid those who abuse you”. it would be better, of course, to say “avoid those who abuse you… but I’ll be trying to protect you”
- jerf 6y ago
  Look at it as a part of the portfolio of approaches we take to address this problem. It may not solve the problem on its own, but it's an important step to take. And arguably a necessary one; a great deal of what gives these companies so much power is that people simply can't imagine trying to do without them and don't even try. Just because people say to stop giving them so much money and attention doesn't mean that they think that's the whole solution. But if you aren't making even a token effort to stop giving them so much money and attention, you're probably more part of the problem than the solution. If you think these companies are a problem... take action. If you aren't willing to even so much as cancel a streaming subscription or take responsibility for backing up your own photos or whatever the issue is, you're sending major signals to the legislative system or whoever else it is you expect to swoop in and save you that you don't care enough for them to need to do anything either. I don't mean this to be absolutist, either. I use Google in a few places, even despite my distrust and distaste of them. But even there, I hold them at arm's length. If they completely nuked my current accounts, it would mostly be an inconvenience. Worst bit would be the ~$20 of apps I'd have to repurchase. (I'd lose more than that but mostly I could just let them go.)

chayleaf 6y ago

Sometimes when one of your accounts get banned you (the account owner) are legally required to stop using any other accounts. Bottom line - it increases survivability, but at the cost of breaking ToS. Separating corporate and personal accounts is a good idea in any case though.

ryandrake 6y ago

> I'd extend this even further: never use a single account for more than one purpose. Create a separate account at the same company for the other purpose. This should really go without saying. I’m sometimes shocked at the extent to which it has become normalized to mix up one’s personal accounts with work. I can’t count the number of times a colleague accidentally sent me an email using their personal account, or texted me from their personal phone. Some people even use their personal phone directly for work, without even doing so much as creating a work profile. Why are you doing this to yourself? You’re just asking for trouble. Don’t even get me started on how entrenched “Sign In With [Company]” schemes have gained traction. Why deliberately have such a single point of failure? To save what? An additional password?

twright0 6y ago
Firm agree on mixing work/personal contexts. However, in practice, using "Sign in with Google" by default dramatically increases resilience to most failure modes for almost everyone without a sophisticated threat model. > To save what? An additional password? The average person does not manage their passwords in a sophisticated way; if someone is signing up for many different services, they are probably using the same password everywhere, or some simple enumeration scheme. Then, when some random forum or web service gets compromised (as they inevitably are), their password to everything is compromised - including Google! On the opposite end of the spectrum, if Google is the only service with a password, and everything else is driven by Google-owned SSO, that person is essentially immune to compromise; whatever I think about the company, I do believe in Google's security team to keep passwords safe and block dictionary attacks more than any other service on the internet. And while we can evangelize setting up password managers and using strong random passwords everywhere, the truth of the matter is that many people simply cannot accomplish this. "Sign in with {Google, Facebook, Microsoft}" gets them 95% of the benefit at much higher reliability.
- ximeng 6y ago
  Using Google SSO is fine unless Google arbitrarily closes your account with no recourse.

taneq 6y ago

> Don't use services where you're required to mix accounts like this. In fact don't let your business depend on these services full stop. EVER.

serial_dev 6y ago

Then you will get flagged for creating too many accounts...

cookiengineer 6y ago

Can confirm this solid advice. Even at a mega-scale social games publisher like Zynga, we had to deal with automated bans all the time. That's why at one point we used an avatar for each game that was separately managed and was basically a separate identity with a separate bank account with a holding company etc. - Invent an avatar that has their own profile, residence, birth date, gender etc. - Use separate email addresses, not on your company's domain (to avoid domain bans). - Use a separate mobile phone number, if possible. - Use a separate smartphone device. There's Android devices for less than 100 bucks now, so that shouldn't be an issue. - Make sure the geolocation of the Android device doesn't change too often. Paypal and others block you immediately because they're too stupid to realize people can actually travel and work from multiple locations; even with 2FA and SS7 enabled. - Use a password manager, use 2FA, and make sure to backup account data and every security question. (and all the other standard practice advice) - Treat your app's / game's avatar as a separate identity, which means don't have the same friends that your private accounts do. Don't link to other accounts of your ownership. Don't mention other projects of your company, otherwise they'll likely ban both accounts for click fraud.

andi999 6y ago
How do you make an avatar with a bank account?
- tomcam 6y ago
  I too am trying to work that one out. My guess is that they used DBAs, each with a separate bank account.
- mnd999 6y ago
  They said they used holding companies.
- DocTomoe 6y ago
  Many fintech banks do give you the option to open up separate accounts with individual bank account numbers quickly and hassle-free, e.g. bunq.
- 6y ago

KorematsuFred 6y ago

This in general is sound advice however most large cos will have the ability to detect cluster of ids that are owned by same person. - Beware of impersonation. It is a felony offense. When you create accounts give the same first name and last name. There are many forms where you have to answer questions like "Have you ever used any other alias?". While 99% of times it is fine, there are rare cases where you might get into trouble. I know some people who did.

dangero 6y ago
Can you elaborate on how people got busted for an alias?

nickphx 6y ago

I would exercise caution doing that. If the accounts are created from the same infrastructure (IP, computer, mobile device), they are easily associated and can be swept up in a ban.

anoncow 6y ago

We need competition, an alternate app store or a rule that says that companies involved in making operating systems cannot get into the business of maintaining/curating/controlling app stores. Else these app publishers end up being beholden to the whims of the companies controlling the app stores.

EvangelicalPig 6y ago

> - Your Amazon shopping account and your AWS account should definitely not be the same account. If you need another reason. I've heard allegations that the recovery process for Amazon shopping accounts and for dedicated AWS accounts are different, with the former being easier to socially engineer. Probably some risk management department figuring that in the case of the former any "fraud" can be resolved with any chargebacks/refunds

privacyking 6y ago

Even if you use separate accounts, Google can and has banned all associated accounts (including personal accounts) in the past.

dgs_sgd 6y ago
What do you mean by associated accounts? How does Google know they are linked?
- avereveard 6y ago
  Same device access, same email domain, same tax registration number, going off other answers in the thread
  - kwdc 6y ago
    Its just about same anything. Simple guilt-by-association is a real thing for google at least. You have an employee who's deemed by google as a bad app developer? That can impact the business that employs them even if its an unrelated app.
    - pudmaidai 6y ago
      If I remember correctly GitHub also locked an entire organization’s repos because someone accessed GitHub from a red-flagged country probably 2 years ago. I can’t wait for regulation to arrive and stop this kind of behavior.
      - sundarurfriend 6y ago
        That's a very different thing, because they were worried about breach of US law. Not saying that makes it fair or non-destructive to the business, but it's not in the same league as Google being over-aggressive in protecting their ad money. (And if there were regulations around this, Github would probably still have done the same thing, because "national security" regulations punch through "consumer protection" regulations every time.)

dheera 6y ago

> account siloing very likely would have avoided the issue Not necessarily, if your personal@gmail.com and business@corp.com Gmail accounts almost always access Google from the same Comcast IP address, from the same Wi-Fi BSSID, and awake/active at similar hours, Google could easily tell these two accounts are likely the same person. AFAIK AdSense also tries to detect forms of click fraud where you ask people in your network to help you click ads, and I can only imagine they can do that because know who you have e-mailed before, whose phone contacts you have, and who you have had calendar events or Hangouts with before. Banning apps with no recourse or appeal process, however, should really be illegal. They could easily bankrupt certain small businesses and livelihoods from their rash algorithmic decisions.

purplecats 6y ago

Agreed. But this causes so much energy expenditure in setting up and maintaining these separate profiles for each project. We need more tools in this space, along the vein of password managers.

BeyondLimits99 6y ago

Couldn't agree more. My Amazon retail account got flagged for fraud (cause I had an old CC attached to the account). My AWS account got disabled as well

mschuster91 6y ago

> Create a separate account at the same company for the other purpose. To make it even worse: you should even keep separate devices for the profiles. God knows who uses device-unique identifiers to join "sock puppet" accounts together, it is pretty much suspected that Twitter does.

ashkankiani 6y ago

Until those services decide to force you to have a phone number registered, which means that you can't have more than one of those services, unless you're willing to sign up for a new cell contract because they don't accept prepaid cell numbers anymore or VOIP numbers. (yes, this is based on personal experience)

pretext 6y ago

I'd called it 'account sandboxing'.

bryanrasmussen 6y ago
I wonder if there is a business model for this.

Tepix 6y ago

This is what makes the forced Facebook login for the newer Oculus VR devices so problematic. You can't create a second Facebook account just for VR. If you get banned on Facebook, you lose access to your paid Oculus store apps on your VR glasses. Of course, granting Facebook access to the extremely private tracking data that you can gather during use of VR is another terrible idea.

johnx123-up 6y ago

IMHO, it is not true with GitHub. Once I had to access a couple of my clients' GitHub account and all of them got banned. It was a stressful process to remove the flag.

AgentME 6y ago

> - Your Amazon shopping account and your AWS account should definitely not be the same account. My Amazon account has been locked for a few days now because I tried to buy a friend a gift card, and I can't even access my AWS account at all. Thankfully all I have on there currently is some old backups in S3, but I previously used AWS for some projects and this could've been a fucking disaster. I tried to buy an Amazon gift card the other day for a friend's birthday, and a few minutes afterwards, the transaction was reverted and my account "was locked for unusual activity". I got an email saying they thought an unauthorized party accessed my account, and it included instructions to reset my password. I did so and then tried to buy the gift card again. A few minutes later, my account was locked again, and this time it told me to wait two hours and then call customer support. I did so, explained everything, got my account unlocked, and the customer service rep assured me the gift card purchase would work this time and volunteered to stay on the line for a few minutes while I reordered the gift card to make sure it worked correctly. It seemed to go through, and then an hour later it got reverted and my account got locked a third time. I waited two hours, called customer service again, and they told me that they'll mark the purchase as legitimate and that I should try logging in again after 24 hours. It's been a few days and my account is still locked. I need to call again. Seriously what the fuck.

deleted 6y ago
[deleted]
epicalex 6y ago
I've just had a similar experience with ebay. About 75% of the times I log on to ebay, (no exaggeration, I only purchase something a few times a year and this happens almost every time), my account gets locked for suspected unauthorised access and I'm forced to reset my password. I have a static IP, and only ever use the same two devices. I have a strong unique password. I spent 15 minutes on the phone with their account security team who could tell me nothing about what triggered the lock, nor did they have any advice on what I could do to prevent this from recurring. Something in their automated system is giving a false positive, and neither I nor seemingly anyone on the account security team has any way to address it.
- 6y ago

unionpivo 6y ago

I would add that buy your domain separately. All cloud/hosting providers offer domains sometimes for free. You don't want that. Because if you get locked out of an account you get locked out of your domain. Sure you can sometimes get at least domain back, but that usually involves layers and can take weeks or months. If you can (its often not practical, but when it is) hosts your DNS elsewhere as well. And most importantly, have at least one backup somewhere else (if you host on AWS have backup on something that isn't using AWS as a backend)

thih9 6y ago

> Create a separate account at the same company for the other purpose. I'd love to create separate accounts for other purposes, but doing this has become such a big pain that I only did it a couple of times so far. Most services now require mobile number during account registration. It seems necessary to provide a unique number, but how to get one? Numbers from "burner" apps often cannot get the text with confirmation code. Also, the registration process itself is difficult; sometimes multiple genuine attempts at account registration get your IP blocked, at least temporarily. If anyone has any tips, I'd be happy to hear them.

eloisant 6y ago

This is the right thing to do, however Google has ways to detect multiple accounts from the same individuals. Cookies, credit card numbers, IP addresses, etc. It's really hard to separate them enough so they can't link them. And sometimes they will ban all your accounts if they find something they dislike on one of them.

wwn_se 6y ago
Yep, separate devices is the way to go. It can be a hassle but to setup but its worth it in the long run.

londons_explore 6y ago

For Google specifically, do not use one email address as a recovery address for another - both will be banned together. Also, do not share recovery phone numbers.

ezoe 6y ago

Well, if you took such strategy, obviously you nee more precautions. - Never share the same IP address among accounts. - But keep IP address range consistent for one service because anomaly means automatic ban. - Never share the same physical computer among accounts. Or you can be like never bother to relies on a single platform.

thiht 6y ago
Hopefully they wouldn't ban other accounts linked to the same IPs? I mean, what about families sharing a single IP? A single computer? Sometimes a single phone number? What about companies VPNs? What about hotspots and public WiFi?

simiones 6y ago

That is quite a bit of effort to protect from accidental temporary bans. It's definitely important (and easy) not to mix personal and business accounts, even for for single-person companies. But keeping different accounts for different parts of the same company without committing fraud is not that easy. If the ban is permanent and results from a change in policy, this won't help significantly anyway: if Google actually wants to ban your business, they will find all related accounts, and ban them.

kypro 6y ago

While this is good and practical advice, it does irritates me that there isn't more of a push for regulation to protect people against automated actions like this. I know in the EU we have protections under GDPR which allow us to request an explanation for an automated action, but I don't believe we have anyway to request human review. Part of the problem it seems is that even if these actions are unfair and unjustified it still makes financial sense for these companies to be trigger happy with automated account bans rather than implementing a more nuanced and intelligent approach which would likely require some human intervention or investment in more intelligence automated systems. If we had some way to request human review or dispute automated actions it would become far more expensive to take unjustified automated actions as people would just complain and request a human reviews the case. Personally I think we've become far too comfortable with tech companies making it almost impossible to contact them. Requiring a human review process for automated actions and requiring companies have some way for customers to contact a human would create jobs and give us some legal right to adequate consumer service. It's weird to me that we have rights when it comes to how our data is used (at least in the EU), but no right to basic consumer service when our business is destroyed overnight because Google takes some automated action.

irl_ 6y ago
GDPR is for people. It doesn't help you if you're a business.
- lmkg 6y ago
  There is broad precedent that some GDPR protections also apply to businesses that consist of a single person.
lmkg 6y ago
> I know in the EU we have protections under GDPR which allow us to request an explanation for an automated action, but I don't believe we have anyway to request human review. There is, with limitations. The relevant part of GDPR is Article 22, "Automated individual decision-making, including profiling" (Full text: https://gdpr-info.eu/art-22-gdpr/ https://gdpr-info.eu/art-22-gdpr/) This is probably the most restricted of the rights granted under GDPR. You have the right to manual review of algorithmic decisions, only when those decisions result in "legal effects concerning him or her or similarly significantly affects him or her." Whether it applies to Google depends on how you interpret "similarly significantly affects," and that's something likely to vary from country to country and well beyond my experience with GDPR. If this were the US, I would expect that to include housing and employment. There's a much stronger argument that this right applies to a Google account if it represents a significant fraction of your business income.

bitL 6y ago

Amazon groups accounts they think they belong to the same person and when one is banned, they band them all. Just ask 3rd party marketplace sellers. I doubt G/FB aren't doing the same.

corobo 6y ago

> Create a separate account at the same company for the other purpose fyi this is against Google Ads's terms last time I looked into it. You can do it if you've got the secondary account registered as it's own legal entity but one Ad account per entity

1MachineElf 6y ago

Using multiple accounts like this can also assist with implementing separation of duties.

nickthemagicman 6y ago

Isn't that textbook ban evasion? The company is for sure tracking your IP's and if they see two account with the same IP chances are they could ban both accounts. I would use a VPN with your other account to be careful, or just in general. And then they could also be fingerprinting your browser. I don't know of any safe way to have multiple accounts, other than separate computers and one of the computers is on a VPN.

toss1 6y ago

Yup This is also why I NEVER use "Log In with Google" on any other service or site. I also just realized that even using the gmail address as the contact/backup is a bad idea, as if the acct gets reset and I no longer have access to that email, it's unrecoverable (exit's stage left making task to change all acct contacts off of Google..). Also, seems from what I've read elsewhere, that the threshold for banning is as low as a single click on a known machine. this means that you can't even do a legitimate check of your own adverts. In essence, this means that the Googles and Facebooks of the world are working to connect and consolidate identity information, and we now must work extra hard to dis-aggregate it. Seems there's an opportunity in this space to simplify and automate parts of identity fragmentation...

driverdan 6y ago

While I agree with the suggestion it is explicitly not allowed on some platforms. We recently had this issue with Apple. We wanted to create a separate account for App Store Connect to use with automated builds. Apple locked the account and required identification scans. Our VPE submitted his own info and it was rejected. For now we're stuck using someone's personal account.