Hacker News Reader

Comment by AdmiralAsshat | Hacker News Reader

Article reminded me how much I use my Gmail account for, and what a colossal inconvenience it would be were it to be deleted. Just off the bat:

- E-mail

- Calendar

- Android account, and all purchased apps, games, etc.

- Drive storage (Somewhere around 1TB, although I don't even use 1/10th that)

- Google Keep note-taking app

- Blogspot blog

- Domain host

- Secondary phone number via Google Voice

- Two-factor authentication device

- Cloud music storage player via Google Play Music

It's really, really unsettling how entangled that singular account is with my everyday workflow.

I've begun trying to compile a list of how each of these components could be migrated to something self-controlled ala OwnCloud. Perhaps I'll make it into a website when I'm done.

I am not sure what would happen to any of the Android apps I had downloaded, however. Do we as consumers get any more legal redress if the account is attached to things we actually paid for?

View on HN

Some friends of mine have similar concerns, and it surprises me. I have multiple Exchange 360 accounts and multiple Gmail accounts, and OneDrive. I use offline .PST files in Outlook to copy everything older than 3 months into. Everything on my OneDrive is on my local hard drive. To be fair I don't do cloud music - my entire 80Gb collection is on my hard drive and duplicated on my phone. Do you just have so much stuff that something like what I described isn't feasible?

Are you serious? Nevermind all the complexity your solution introduces, how is someone supposed to keep track of it?

When we're able to identify problems and come up with solutions that only help people with tons of experience and obviously too much time on their hands, we do others a disservice.

I have a different, but effectively similar, setup to Spearchucker for managing and backing up my data, identity, etc.

>how is someone supposed to keep track of it?

Very carefully. No sarcasm intended. Same as one's personal finances, for example.

>and come up with solutions... we do others a disservice.

I can't speak for Spearchucker, but I devised my particular solution for my own sake, and "doing others a service" didn't factor into that process.

Nor do I feel it necessarily should. If someone without experience asks how I navigate our messy digital world (and they have), I give them my honest answer and describe my system. Sometimes I propose a few less-effective, consumer-friendly alternatives, along with their drawbacks. Yes, my solution involves a lot of cobbled-together, semi-automated and semi-manual systems. That's because these systems change so frequently that it was the best I could do to get my own system working in the first place. It seems you are implying some obligation exists to do someone else the "service" of managing their personal digital hygiene, at some arbitrary ease of use that fits their level of expertise.

It is not because I'm some blackhearted bastard with no regard for my fellow man that I don't feel that obligation. It is because that, even if I have crafted a solution that adds resilience to the failure of services X, Y and Z, which I use, I don't know what I could/would do when the other person begins to rely on service W, where W is a service I do not use and do not understand the intricacies of.

In short, I find it strange that you frame someone having shared what works for them on a service-vs-disservice axis for the broader world. I'm happy that Spearchucker has a system for, and the discipline to, maintain his digital hygiene.

Whats absurd is saying "how complicated could your system be?" Not the solution.

This is a technical forum so I get it, but the solution for a person well versed in technology isnt actually applicable to anyone else. Consider that youre at the leading edge of a bellcurve.

Theres no one click install, no service to give 5$/mo to, nothing. Just a big pile of stuff people are supposed to squirrel away, as though theyre even good at their own finances.

We should all be sharing what works for us. But to suggest things are trivial or easy just creates a divide between people who understand and those who do not.

> Very carefully. No sarcasm intended. Same as one's personal finances, for example.

That is a very interesting comparison. I wonder how long it will take before people start taking their digital footprint as seriously as they take personal finance? Before digital maturity is seen as a mark of adulthood the way finance savvy is seen today?

Your analogy is apt because they are both areas that the average person doesn't understand, but is still forced to wade their way through. I look forward to the day when there are digital security self-help books and blogs like the personal finance and investing material we have now.

Data Security and Privacy are never going to be convenient.

If someone does not respect their own security and privacy enough to do their work themselves they can never enjoy privacy and security, as by definition if you are not setting up and maintaining the systems, you are giving up control of your privacy and security to a 3rd party, be that Google, MS, Apple, or some other "Trusted" party

AFAIK your Two-Factor is not connected to your google account. Or maybe we're talking about different things. Mine is an app that happens to be made by Google but it has no connection to my google account. If I Google kicked me off the two factor app would keep running

https://github.com/google/google-authenticator

Eh, it should be highlighted that the Google Authenticator app on the Play Store is NOT the one on GitHub, which is a much older version. The current version is closed source, and cannot be assumed to keep working if a Google account is banned.

(I strongly recommend people compile and switch back to the old open source version.)

Maybe use an alternative TOTP 2FA app such as Authy (closed-source but not tied to a Google account)

Maybe for something important like account access, keep things open-source and use FreeOTP as a drop-in replacement. It's on F-Droid here: https://f-droid.org/repository/browse/?fdid=org.fedorahosted...

Is there a simple CLI TOTP client? Or what do you use a backup system if/when your phone fails?

My recommendation for backing up 2FA is to print the QR code that you set up your phone with, and lock it in a very safe real world place. Do not keep a copy on a digital format.

I don't know of any CLI clients (that would be perfect with a Bash alias) but I just store the initial 'seed' passcode in my password manager. When setting up a new device, I manually enter that instead of scanning a QR code and it works perfectly.

If you store your 2FA recovery codes in the same place as your passwords, there is effectively no point in you having 2FA, because compromising one factor, your password manager, compromises both.

You are correct but in my use-case I have my browser remember the passwords and use a standalone password manager for storing credentials that I infrequently access. An exploit compromising the browser would next have to compromise the password manager's encrypted database.

Admittedly this is not perfect, but I am comfortable with the level of security it provides. I think it is also roughly comparable to users who have a 2FA app on their mobile and a password manager syncing to the same device.

F-Droid has an .apk of the old FOSS version: https://f-droid.org/repository/browse/?fdfilter=otp&fdid=com...

Along with multiple alternative apps: https://f-droid.org/repository/browse/?fdfilter=otp&fdpage=1...

I was in the same place, when I started hating the Lollipop release, which turned the great working Nexus 5 with Kitkat into a piece of crap (Google Play Services drain, memory leaks). Being a Nexus, I could downgrade it back, but couldn't disable updates, since they're handled by GPS now. Then I realised what else beside the device I paid my money for Google owns.

>- E-mail

Already had a domain, so found a neat hosting in EU, 10GB of space with ActiveSync, CalDAV, CardDAV, IMAP.

>- Calendar

Email hosting has DAV, which syncs to all clients.

>- Android account, and all purchased apps, games, etc.

This is the only thing the gmail account is still being used.

>- Drive storage (Somewhere around 1TB, although I don't even use 1/10th that)

Using Dropbox (because I can rely on it) and MEGA

>- Google Keep note-taking app

Remember the milk todo app, I enter notes in a Notes list, or even make to-dos directly

>- Blogspot blog

Jekyll blog, hosted on github, with own domain

>- Domain host

Gandi

>- Secondary phone number via Google Voice

Don't have the in the land of dragons (outside US).

>- Two-factor authentication device

Authy

>- Cloud music storage player via Google Play Music

Fuck the cloud, local music in iTunes synced by iSyncr Android app.

At first it all looked like a pain to do, but now I can't imagine going back into the Google silo. The gmail/google account now serves only as Play Store account, YouTube account (when will G+ finally die), Chrome Sync account. The location, web search and targeted ads are paused and disabled.

Like you, I've moved away from relying on a Google account; the only exception is Keep, since I'm yet to find a decent FOSS alternative - not that they're bad, but Keep just fits so well with how I approach note-taking.

Even as a paying customer of Google Apps (albeit only for one user), I've got no way out without losing access to all my paid apps - and that's Support's official answer. I suspect in Australia I could take Google to small claims court and get some money back but I'm not sure I have the time or energy.

That's my situation as well. The customer service agents pull the "it's not my department" card whenever I try to cancel my apps account and move my Play library over to a standard Google account.

Half a year ago I used a Google Apps for Business account for pretty much the same things (minus Blogspot, domains, voice, plus address book and Hangouts).

Now I only have a non-apps account for Google Scholar. Besides that I have moved everything off Google. The most painful thing was losing all paid Android apps, but since I planned on moving back to iOS again I took the loss. All the other stuff was not hard: I switched to Fastmail for e-mail, who have a nice migration tool, calendars and contacts are on iCloud (since my wife uses iCloud as well), files are on Dropbox.

If possible, I would like to switch away from Dropbox to something that is end-to-end encrypted. We used Bittorrent Sync for quite some time, but I had serious problems in the last few versions (basically, it corrupted its own metadata and re-added all shares from scratch). Syncthing is not really an option (too hard to share with family/colleagues).

Regarding moving from Dropbox to something encrypted, you might look into SpiderOak - I've not used them, but they've been around for quite a while and "encrypted zero-knowledge" is basically their selling point.

I don't believe they have a free tier, so I suspect they have a sustainable revenue model - basically everyone's on their equivalent of Dropbox Pro, with no free account leeches eating up their marketing budget.

edit: minor grammar

That's the big thing that stuns me every time Google does this. For people dependent on their services, Google is effectively giving them an online death sentence. Without access to your email, you may have a lot of difficulty regaining control of accounts of yours all over the Internet as well, depending on their email change policies. If you've been using Gmail for as long as a lot of us have, ten years of your online correspondence is just... gone. And if there was a clear avenue of appeal or communication, this wouldn't even be so bad, but when Google gets rid of you, they won't even give you a chance to talk to them about why they did.

Completely agree.

The issue here is that Google accounts are a "free service" (obviously advertiser funded), and they're not even really tied strongly to real people. A given account could be shared between people, or change owners over time.

I've always felt that, done right, this could be a revenue opportunity for Google - offer a premium account where you give them your proper identity details, and tick a few boxes about how you want your account to be managed if you lose login access (reset to someone who can show ID? destroy?). I'd gladly pay a non-trivial amount to get decent service like that in an emergency.

As it stands, you're not paying Google anything. You're not the customer, you're the thing being sold.

With no revenue from users, it's understandable that they won't entertainment appeals about their decisions.

I suspect they wouldn't want to offer a premium account though, due to the bad press of admitting the problem.

Exactly. The cost of them making a premium option would pale in comparison to the loss of reputation they would gain for admitting they need one. That's why you'll never be able to pay for privacy with Google: Google doesn't want people to realize that using their free services compromises their privacy.

I'm not really talking about paying for privacy, just paying for manageability and support in the case of a problem.

That's the paid Google Apps account you're looking for.

That was the plan :) I've done it thought, I pay for my mail now etc.

There is something about not feeling like a product that is so satisfying.

Reply on news.ycombinator.com