5 ms·

If they disable your account, you're not going to get any new email. So if a website uses your email address for 2-factor-auth, then you are straight out of luc

If they disable your account, you're not going to get any new email. So if a website uses your email address for 2-factor-auth, then you are straight out of luck, as I'm sure they also use that email for any sort of account changes. To be clear, "don't use email for 2-factor-auth" isn't a real answer here, there are plenty of services that don't give you an option. Additionally, you can't send email. That's also a pretty important part of the whole "email" thing. Any ongoing discussions will just be cut off. Seems pretty walled garden-y to me, considering the entire framing of this is that nothing bad was done with said email. It was because Apple has a unilateral switch that turns everything off if anything bad happens to an associated credit card. That is to say, if your credit card number is stolen, completely outside of your control, this could happen to your email. I'm not aware of any other email service where that is the case.

jrockway 3y ago
Technically, you don't need an email account to send email. "telnet example.com 25; HELO there; MAIL FROM: you@example.com; RCPT TO example@example.com; DATA; ...; ." Viewing the reply is, of course, more challenging.
- derefr 3y ago
  I don't think there exist any Mail Submission Agents well-connected to the graph of what you would think of as "email on the Internet", that allow you to send FROM an arbitrary address without SMTP AUTHing yourself as an account that maps to someone with privileges to send from that address.
  - jrockway 3y ago
    You connect to the recipient's server. It's nice that iCloud Mail automates this all for you (and is allowlisted), but you don't need an email provider to send email.
    - hiatus 3y ago
      Let me know when you can telnet into gmail to send mail as an unauthenticated user to another gmail user. Let alone DMARC, SPF and other modern protections. The last time I could do what you describe was more than a decade ago.
  - hiatus 3y ago
    This used to be a thing, with open mail servers making it trivial to send emails to your friends masquerading as whitehouse.gov for instance.
derefr 3y ago
But that's true of... any email provider, though? You'd lose access to your ISP email account if you switch ISPs, etc. Federated email just generally sucks, insofar as email addresses are expected to stick around indefinitely, yet are almost-always associated with some service provider you might eventually no longer be a customer of (for whatever reason) and with "owning your own email providing" being nigh-impossible for deliverability reasons. Also, people's emails to you wouldn't go into a black hole; they'd start bouncing. Which would mean that those people would realize that they should be reaching out to you some other way. (In fact, properly-coded 2FA systems should recognize an SMTP bounce and use it as a signal to temporarily reduce the level of authentication required to reset 2FA. Things like this are why it's so hard to get 2FA right.)
- tolmasky 3y ago
  No, it isn't true of any other provider, that's the whole point. If my HBO Max account detects a fraudulent charge, my completely unrelated email provider doesn't then irreversibly disable my email account and tell me to just set up a new one. Yes, if my non-Apple email service "locks me out", then the same would happen as here. The point however is that: 1. Usually this would only happen if something weird specifically happens on that account. For example, if I am paying for an email provider and my card is declined. Notice that with the Apple case, a problem in something completely unrelated to email can cause this (including apparently the card being flagged for a fraudulent charge on some unrelated service). 2. Even then, usually the next step is I am told that that happened. Notice that in the Apple case they won't even tell you what the situation is to give you a chance to remedy it. 3. Finally, you then almost always have a way to remedy the problem. For example, by giving them a new credit card. Notice in the Apple case they insist that the account is disabled forever. Do you see the difference? It's not in the "what happens if your email stops working" part, it's in the "what leads to your email not working anymore" and "how do you fix your email" parts.
  - throwaway290 3y ago
    > Notice that with the Apple case, a problem in something completely unrelated to email can cause this Uhm, conjecture? The Reddit poster complained about app/media store lock, if they lost something more important like iCloud with photos and email that'd be a totally different story instead of "I lost some movies".

jrockway 3y ago

Technically, you don't need an email account to send email. "telnet example.com 25; HELO there; MAIL FROM: you@example.com; RCPT TO example@example.com; DATA; ...; ." Viewing the reply is, of course, more challenging.

derefr 3y ago
I don't think there exist any Mail Submission Agents well-connected to the graph of what you would think of as "email on the Internet", that allow you to send FROM an arbitrary address without SMTP AUTHing yourself as an account that maps to someone with privileges to send from that address.
- jrockway 3y ago
  You connect to the recipient's server. It's nice that iCloud Mail automates this all for you (and is allowlisted), but you don't need an email provider to send email.
  - hiatus 3y ago
    Let me know when you can telnet into gmail to send mail as an unauthenticated user to another gmail user. Let alone DMARC, SPF and other modern protections. The last time I could do what you describe was more than a decade ago.
- hiatus 3y ago
  This used to be a thing, with open mail servers making it trivial to send emails to your friends masquerading as whitehouse.gov for instance.

derefr 3y ago

But that's true of... any email provider, though? You'd lose access to your ISP email account if you switch ISPs, etc. Federated email just generally sucks, insofar as email addresses are expected to stick around indefinitely, yet are almost-always associated with some service provider you might eventually no longer be a customer of (for whatever reason) and with "owning your own email providing" being nigh-impossible for deliverability reasons. Also, people's emails to you wouldn't go into a black hole; they'd start bouncing. Which would mean that those people would realize that they should be reaching out to you some other way. (In fact, properly-coded 2FA systems should recognize an SMTP bounce and use it as a signal to temporarily reduce the level of authentication required to reset 2FA. Things like this are why it's so hard to get 2FA right.)

tolmasky 3y ago
No, it isn't true of any other provider, that's the whole point. If my HBO Max account detects a fraudulent charge, my completely unrelated email provider doesn't then irreversibly disable my email account and tell me to just set up a new one. Yes, if my non-Apple email service "locks me out", then the same would happen as here. The point however is that: 1. Usually this would only happen if something weird specifically happens on that account. For example, if I am paying for an email provider and my card is declined. Notice that with the Apple case, a problem in something completely unrelated to email can cause this (including apparently the card being flagged for a fraudulent charge on some unrelated service). 2. Even then, usually the next step is I am told that that happened. Notice that in the Apple case they won't even tell you what the situation is to give you a chance to remedy it. 3. Finally, you then almost always have a way to remedy the problem. For example, by giving them a new credit card. Notice in the Apple case they insist that the account is disabled forever. Do you see the difference? It's not in the "what happens if your email stops working" part, it's in the "what leads to your email not working anymore" and "how do you fix your email" parts.
- throwaway290 3y ago
  > Notice that with the Apple case, a problem in something completely unrelated to email can cause this Uhm, conjecture? The Reddit poster complained about app/media store lock, if they lost something more important like iCloud with photos and email that'd be a totally different story instead of "I lost some movies".