Hacker News Reader

Comment by mikulabc | Hacker News Reader

This isn't your average "Oh no, I became a victim too" post.

I want to collect your ideas how we can fix this problem/issue once and for all

I think the fix (from a legal perspective) is very simple.

Ban me from your services if you want, but banned accounts should be able to download their information, for a reasonable timeframe.

In the case you were using Google products as a business (YouTube, Google apps), allow the banned user to show a text communicating to their users the service they moved to or where they can be contacted.

It's a bare minimum, but it would get us real far.

Also, a provision that enables the person to switch emails from all accounts that depend on it. This requires giving the user limited access to email (basically viewing confirmation emails from other services) until they migrate everything out.

This needs to be law.

Good point, I had missed the impact of email as an authentication tool. I think the industry should move towards a decoupling of that from email (or worse, social networks). I think there's been some movement towards using phone numbers instead, but that presents its own kind of issues.

Does CCPA or GDPR allow for this?

I'm not sure, to be honest. I think GDPR would grant you access to the personal data the service holds of you, but AFAIK they have no obligation to keep the data, so they could have previously removed it (?).

There must be a provision for that I guess, since otherwise companies could potentially react to GDPR requests of access by nuking all the information they hold about that user and then replying they've got nothing, which would be a major hole. But I honestly don't know.

And also transfer out everything non-downloadable, like DNS domain registrations.

Google seems to have no desire or incentive to fix this problem. However, people can reliably prevent the problem from happening to themselves by not using Gmail. (If you want a recommendation for an e-mail provider, I can recommend Fastmail - I've been using them for years and they've been very reliable. They also have customer support. Their service is not free, however.)

Pay for hosted email. You can always get human support if you pay for e.g. MS Exchange. Use a custom domain, so you can switch providers if needed. There’s no substitute for having control.

Sue. There are bound to be country with consumer protection laws guaranteeing actual consumer support.

One of the biggest problems, I’ve found, is that if you enable mandatory hardware 2FA (U2F) on your Google account, the so-called Advanced Protection Program, you can no longer get app passwords to log in with IMAP, essential for mirroring your email somewhere else automatically.

It’s really frustrating.

You actually can. It's possible to create app specific passwords. Well, a while ago at least.

That initially got deprecated for paid accounts. But I think they’ve since delayed the deprecation indefinitely, probably because they got strong push back.

Not if you have mandatory hardware 2fa (advanced protection program) on, no. You're probably thinking of just 2fa enabled, which still permits TOTP (and app passwords). Once you enable APP, it is U2F only, and app passwords are no longer possible.

Sure you can. Read this https://support.google.com/mail/answer/185833?hl=en

This was going to be disallowed for paid accounts. The change is on ice for now as far as I know.

Reply on news.ycombinator.com