5 ms·

What is the alternative? For Gmail, I take the precautions of configuring mobile phone, authenticator app, backup email address, and printed out codes. What els

by bmitc 4y ago

What is the alternative? For Gmail, I take the precautions of configuring mobile phone, authenticator app, backup email address, and printed out codes. What else can I do? Is it really better to use several different email addresses? For Facebook, I’m currently completely locked out. I have the right username and password, but the email accounts I used to create the Facebook account are disabled now, being university accounts. At one point, Facebook wanted my credit card or driver’s license as proof to tenable the account, which I wasn’t comfortable with. Then it got paired down to three randomly chosen connections that I needed to contact outside of Facebook. Once chosen by Facebook, these contacts cannot be changed. For me, it included a deceased person and two people I haven't even seen since high school. Now, it just wants to validate the email addresses with no other options. So now what? Nothing in my control ever went wrong. I know my account, I am the person, and I have the username and password. It would be nice to be able to just call a number with a human on the other line to verify that it is me. We've entered the era of "death by scale". We and the government allow these companies to treat customers and people as statistical entities. They don't give a shit if their products either flat out don't work or ruin a customer's life for "only" x percent if x is small enough.

zelphirkalt 4y ago
What you can do is to not use providers like Google or Facebook for you e-mail or identity. Pay for a good e-mail service with human beings in charge and use a safe password, probably a password manager that generates it.
- bmitc 4y ago
  Do you or others have suggestions for email providers? I have been considering using Fastmail. Do people use custom domain names to get around the fact of switching email providers? Aren’t there rejection/filter issues when using custom domain names?
  - zelphirkalt 4y ago
    I like posteo.
- justsomehnguy 4y ago
  This. I rarely needed to ask for support, but every time FastMail response was by an actual humans, not by a tincans.
  - whiplash451 4y ago
    Until fastmail either grows like google and becomes a death-by-scale problem, or goes under for some random reason.
    - solids 4y ago
      Yes, but then you just take your domain and go somewhere else.
      - tinaclaussen 4y ago
        no possible for average person...
BiteCode_dev 4y ago
I never used facebook for this reason and advised people not to. Now that you are locked in, there is not good solution. It's like smoking and getting cancer, there is no magic to solve the problem and a lot of pain. The best is to not start. For gmail, have several addresses, with redirections to each others, use imap, don't use social sign it.
- bmitc 4y ago
  Well, I never used Facebook for any login nor did I ever give them my personal phone number or email because I never had any reason to. I deactivated the account a couple years ago, which doesn't delete it. It would just be nice if they let me recover it, but they don't want that as they'd rather force me to create a new account to get their hooks in. I also never use social sign in for anything other than using my GitHub account for certain things.
vtail 4y ago
Facebook did offer you two ways to recover: a) provide your driving license or credit card (a reasonable offer, IMHO) and b) reaching out to your three friends online. I agree that in b), it sucks that once chosen, the 3 people cannot be change (although I kinda see the security angle of it), but what else would you want Facebook to do if you lost access to your email?
- bmitc 4y ago
  Accept my username or password that's being rejected for no reason? Driver's license or credit card is unacceptable, to me, to give to an organization like Facebook. Still, those options went away. I don't understand why it can't just ask me questions about my account. It's not like I'm resetting my password. It was Facebook that randomly decided it needs to send an email, something it never did for the longest time.
MattGaiser 4y ago
Why is a credit card so horrible? It is designed to be given away anyway. And if FB stole it, congrats, you are rich off the settlement.
phepranto 4y ago
How should the person on the phone verify your identity if not by your drivers license or similiar ID?
tzs 4y ago
For email I'd say the most important precaution is to have an address at some domain of your own. You don't need to host the email servers yourself. Many email hosting services will let you use our own domain with them. If you want to use an email hosting service that does not directly support using your own domain, many domain registrars include free email forwarding so you can forward mail sent to your domain to your address at your email host, although there might be problems with sending from your domain if you use the forwarding approach [note 1]. It might at first seem that this is just pushing the problem back a little. Instead of the problem being losing your account at a mail hosting service like Gmail, you now have to worry about losing your domain. The big difference is that a domain registration is a lot more passive. With a Gmail or other mail hosting account it is something you are actively using. Content you generate goes through it. Content other people generate goes through it to you. That gives all kinds of opportunities to trigger false positives on their automated anti-abuse systems. With a domain you register it and designate name servers and periodically pay to keep it from expiring. Most registrars include basic name service so you don't have to deal with finding a name service provider. Once you've set up name service to designate your email host as handling your domain, or set up forwarding if that's what you are doing, you pretty much don't have to touch anything there and content to/from you doesn't go through those systems so there is simply much less opportunity for something to trigger some sort of automated anti-abuse systems. Pick you domain and registrar carefully. Don't pick a domain name that is close to some trademark. Pick a top level of .com or .net or maybe your country's top level if you are going to want to send email from that domain [note 2]. Pick a registrar that is not in some country likely to do things that get your country to put sanctions on it. [note 1] You might not have enough control over the headers on outgoing mail to be able to send a mail that doesn't look like a forgery attempt. For email addresses that you will just need for receiving things the forward approach should be fine, which will cover email needed for account recovery in most cases. [note 2] The newer top level domains that are available for general use have been pounced upon by large numbers of spammers, to the point that having an email address in them can make it very difficult to get through spam filters. Spammers are all over .com and .net too of course, but that's also where most of the non-spammers are too. With the newer top levels the spammers jump on in large numbers from the start and so from the point of view of a random email receiver those domains are mostly spam.
laegooose 4y ago
What's wrong with providing a credit card?! What's wrong with asking your high school friends to help you recover the account? You had multiple reasonable options to recover, declined them and now complain that "Nothing in my control ever went wrong". This annoys me so much
- bmitc 4y ago
  You can be annoyed all you want, but the process is insane. The only options available to me are my two university emails. One of the email domains simply no longer exists. I actually took the time today to call my old university, and they were kind enough to temporarily turn on my old university email address for the other email tied to my Facebook account. Facebook won't send the code to the email after I correctly login. It reports an error. (I verified that the email is working.) There's no way to report the error anywhere. The only way you can report an error to Facebook is to be logged into Facebook. There's another login screen that allows you to reset your password. I did so there since that actually worked by sending an email code. After I do that, it takes me back to the "browser verification" screen. Now, the email I verified has disappeared from that list! The only one left is the email that is tied to a domain that no longer exists. It is impossible to get an email at that address. It's ridiculous. TLDR: I actually recovered my old university email address, and Facebook refuses to send a code to that email and has now removed it as an option.

by bmitc 4y ago

zelphirkalt 4y ago

What you can do is to not use providers like Google or Facebook for you e-mail or identity. Pay for a good e-mail service with human beings in charge and use a safe password, probably a password manager that generates it.

bmitc 4y ago
Do you or others have suggestions for email providers? I have been considering using Fastmail. Do people use custom domain names to get around the fact of switching email providers? Aren’t there rejection/filter issues when using custom domain names?
- zelphirkalt 4y ago
  I like posteo.
justsomehnguy 4y ago
This. I rarely needed to ask for support, but every time FastMail response was by an actual humans, not by a tincans.
- whiplash451 4y ago
  Until fastmail either grows like google and becomes a death-by-scale problem, or goes under for some random reason.
  - solids 4y ago
    Yes, but then you just take your domain and go somewhere else.
    - tinaclaussen 4y ago
      no possible for average person...

BiteCode_dev 4y ago

I never used facebook for this reason and advised people not to. Now that you are locked in, there is not good solution. It's like smoking and getting cancer, there is no magic to solve the problem and a lot of pain. The best is to not start. For gmail, have several addresses, with redirections to each others, use imap, don't use social sign it.

bmitc 4y ago
Well, I never used Facebook for any login nor did I ever give them my personal phone number or email because I never had any reason to. I deactivated the account a couple years ago, which doesn't delete it. It would just be nice if they let me recover it, but they don't want that as they'd rather force me to create a new account to get their hooks in. I also never use social sign in for anything other than using my GitHub account for certain things.

vtail 4y ago

Facebook did offer you two ways to recover: a) provide your driving license or credit card (a reasonable offer, IMHO) and b) reaching out to your three friends online. I agree that in b), it sucks that once chosen, the 3 people cannot be change (although I kinda see the security angle of it), but what else would you want Facebook to do if you lost access to your email?

bmitc 4y ago
Accept my username or password that's being rejected for no reason? Driver's license or credit card is unacceptable, to me, to give to an organization like Facebook. Still, those options went away. I don't understand why it can't just ask me questions about my account. It's not like I'm resetting my password. It was Facebook that randomly decided it needs to send an email, something it never did for the longest time.

MattGaiser 4y ago

Why is a credit card so horrible? It is designed to be given away anyway. And if FB stole it, congrats, you are rich off the settlement.

phepranto 4y ago

How should the person on the phone verify your identity if not by your drivers license or similiar ID?

tzs 4y ago

For email I'd say the most important precaution is to have an address at some domain of your own. You don't need to host the email servers yourself. Many email hosting services will let you use our own domain with them. If you want to use an email hosting service that does not directly support using your own domain, many domain registrars include free email forwarding so you can forward mail sent to your domain to your address at your email host, although there might be problems with sending from your domain if you use the forwarding approach [note 1]. It might at first seem that this is just pushing the problem back a little. Instead of the problem being losing your account at a mail hosting service like Gmail, you now have to worry about losing your domain. The big difference is that a domain registration is a lot more passive. With a Gmail or other mail hosting account it is something you are actively using. Content you generate goes through it. Content other people generate goes through it to you. That gives all kinds of opportunities to trigger false positives on their automated anti-abuse systems. With a domain you register it and designate name servers and periodically pay to keep it from expiring. Most registrars include basic name service so you don't have to deal with finding a name service provider. Once you've set up name service to designate your email host as handling your domain, or set up forwarding if that's what you are doing, you pretty much don't have to touch anything there and content to/from you doesn't go through those systems so there is simply much less opportunity for something to trigger some sort of automated anti-abuse systems. Pick you domain and registrar carefully. Don't pick a domain name that is close to some trademark. Pick a top level of .com or .net or maybe your country's top level if you are going to want to send email from that domain [note 2]. Pick a registrar that is not in some country likely to do things that get your country to put sanctions on it. [note 1] You might not have enough control over the headers on outgoing mail to be able to send a mail that doesn't look like a forgery attempt. For email addresses that you will just need for receiving things the forward approach should be fine, which will cover email needed for account recovery in most cases. [note 2] The newer top level domains that are available for general use have been pounced upon by large numbers of spammers, to the point that having an email address in them can make it very difficult to get through spam filters. Spammers are all over .com and .net too of course, but that's also where most of the non-spammers are too. With the newer top levels the spammers jump on in large numbers from the start and so from the point of view of a random email receiver those domains are mostly spam.

laegooose 4y ago

What's wrong with providing a credit card?! What's wrong with asking your high school friends to help you recover the account? You had multiple reasonable options to recover, declined them and now complain that "Nothing in my control ever went wrong". This annoys me so much

bmitc 4y ago
You can be annoyed all you want, but the process is insane. The only options available to me are my two university emails. One of the email domains simply no longer exists. I actually took the time today to call my old university, and they were kind enough to temporarily turn on my old university email address for the other email tied to my Facebook account. Facebook won't send the code to the email after I correctly login. It reports an error. (I verified that the email is working.) There's no way to report the error anywhere. The only way you can report an error to Facebook is to be logged into Facebook. There's another login screen that allows you to reset your password. I did so there since that actually worked by sending an email code. After I do that, it takes me back to the "browser verification" screen. Now, the email I verified has disappeared from that list! The only one left is the email that is tied to a domain that no longer exists. It is impossible to get an email at that address. It's ridiculous. TLDR: I actually recovered my old university email address, and Facebook refuses to send a code to that email and has now removed it as an option.