Hacker News Reader

Comment by CGamesPlay | Hacker News Reader

I'd extend this even further: never use a single account for more than one purpose. Create a separate account at the same company for the other purpose. Some examples:

- Every product/project you manage should be on a separate account on Google, Facebook, Amazon, etc.

- Nothing tied to your consumer accounts should be used for anything business related.

- Your Amazon shopping account and your AWS account should definitely not be the same account.

- Don't use services where you're required to mix accounts like this.

Some examples:

- If the issue in this thread is actually an automatic ban, account siloing very likely would have avoided the issue. ([edit] likely, it would not have been possible to silo accounts in this case, as a child comment points out)

- Facebook apparently lacks the willingness to block an account from Marketplace, but they will block an account from all Facebook properties.

- Paypal has banned businesses because the account was created years ago by someone who at the time the account was created was 17.

The point of this isn't that it's impossible to connect the dots that you are the same person. The point is to make it difficult for an automated system to deal too much damage to you, and make it difficult for someone looking at a single account's history from accumulating too many "strikes" against that account.

View on HN

(Author here.) This is excellent advice for consumer apps/products, (it's especially important to keep enterprise accounts fully separate from your individual consumer accounts), but it wouldn't have helped DroidScript in this case.

DroidScript is a non-profit organization; when they signed up for Google AdMob and Google Play Store, they provided the same tax ID (their EIN) in both cases. Creating separate Google accounts with separate email addresses would not have been sufficient; Google knows that they're paying the same company.

(The ads in question were being run inside the same app that accepts Google subscription revenue. Google can and will follow that thread!)

Creating a subsidiary business for every type of Google account you have would be quite expensive, and, if Google realizes what you're doing, it will make you look like you have something to hide, making you more likely to get banned, not less.

>Creating a subsidiary business for every type of Google account you have would be quite expensive,

Do you really have to create a separate subsidary business? Why not just get another EIN for the account? Then as far as the online service is concerned, that will be another taxpayer id, unlinked to the original one. The IRS does have limitations[0] (you can only apply for one EIN per day), but as far as I could tell, there is no limit to the number of EINs you can get for your company.

In fact, I would argue that if you are a self-employed person, you should get an EIN and use it when creating accounts at any SAAS that require a social security number.

[0] https://www.irs.gov/businesses/small-businesses-self-employe...

Yeah, you are right, and I don’t disagree with your article either. Our points are different lenses on the idea of account isolation.

If you wonder if a computer system can think logically or if its very stupid, its always the latter.

Computers don't think they just follow programming. The fault always lies at the humans who wrote the code. See HAL in 2010.

HAL was envisioned based on an early approach to AI. Modern AI techniques really don’t fit that model.

Modern AI techniques also don't really work as well as many think; they're awesome, but the hype far exceeds the reality. (For example, self-driving cars are very far away.) A HAL-like approach is actually better for most purposes I've encountered than “throw the problem at a deep neural net”.

The hype is excessive, but a lot of stuff is good enough for the real world even if it’s far from perfect.

Self driving crashes for example are rare enough to make the news. That might not be good enough, but it is a very high bar. We crossed a threshold where it’s significantly more dangerous for someone do 90+MPH on the open road than set their car to do 5 over the speed limit and take a nap on that same trip.

That’s a long way from level 5, but Honda has approval to operate at level 3 where drivers don’t have to monitor road conditions under specific conditions. https://carbuzz.com/news/honda-reveals-first-level-3-self-dr...

> Creating a subsidiary business for every type of Google account you have would be quite expensive

Costs roughly $1000/yr to run a properly sheltered LLC. Just saying, that’s a low barrier to overcome for any company turning modest revenue.

We have done this in past. At one point we had 4 LLCs with 4 adsense accounts each making $30K per day. There was nothing fishy here it was perfectly legal and 100% legitimate traffic. Over time we even split our large website into multiple domains under these 4 accounts to make them profitable. Google eventually banned all 4 over time without ever telling us why. We shut down out company eventually.

I had several domains once for a couple of ideas I was working on, due to them taking about a year to do as it was just personal thing I did in spare time in between playing games and attempting to have a life, I decided to domain park them with Adsense.

I set them up. Clicked on each one once to make sure it worked. Closed it. Didn’t open the domains again.

Week later banned from Adsense for click fraud…

I don’t get it. But I really hate Google now.

"make sure it worked" is when the ads are displayed — unless you've accidentally disabled clicks or something..?

This was like in 2005. I didn’t really know what I was doing because it wasn’t adding JS to the page. And when updating the NS records it wasn’t rendering properly. So yes I clicked on the ad. It linked me to the site. And I deemed it working. I also even added my (static) ip to the list for ignored clicks.

Why were the accounts banned?

"without ever telling us why" indicates that they do not know.

Sometimes one may be able to take a good guess at where one did not comply with the letter or the spirit of a certain rule, but still not be told which specific violation was detected and triggered a ban. Both are useful information and the question could have referred to either.

We do not know. I am sure the banning email must have mentioned something but it was far too vague and non-actionable for us.

There was a Reddit thread just yesterday asking if the bullying stops once you become an adult.

Evidently not. And sadly there’s no teacher to refer to, unless you can afford to shell some real cash.

why so expensive? in the UK it's £13/year (under $20)

Depends what US state you choose. In CA, you pay $800 a year for your LLC.

> An $800 annual tax is generally imposed on limited partnerships (LPs), LLCs, ...

Source: https://www.ftb.ca.gov/forms/2020/2020-568-booklet.html

It does depend on the state. I am also including registered agents, physical (mailing address) and digital presence. Depending on the nature of the business, insurance is also included in that cost. I did not include increased accounting costs

It can be much cheaper in other good states. $250 to 400 yearly rings a bell for WY, NV, DL

Only if you live in those states. If you live in and operate out of CA, but incorporate in DE, you end up paying both DE and CA franchise taxes.

WY is even less than that--more like $50. $52 if you pay with a credit card. Though you'll need to pay for the registered agent $25 / year.

https://sos.wyo.gov/Business/docs/BusinessFees.pdf https://www.wyomingagents.com/

But yes--if you live in another state, you'll need a company in that state regardless.

It's going to be more expensive than that to get accounts prepared, right?

For small company accounts in the UK, you can file them yourself. It is not completely easy depending on what you are doing but well within the ability of an engineer, as long as you are keeping the relevant receipts etc.

For me, running a company was never expensive, just hassle like sending your annual update to Companies House and understanding the various overlapping communications from HMRC for tax.

Interesting - I thought all companies had to file electronically with tagged accounts - ie you need some level of an accountant.

You can file them online yourself.

https://www.gov.uk/file-your-company-accounts-and-tax-return

if you're a "micro" enterprise (turnover <£500k and fewer than 10 employees) you don't even need to produce a P&L, just a balance sheet

it can be done entirely for free on the Government's Companies House site, which generates your accounts, the regulatory statements and also does your tax return

takes me about 10 minutes a year, sending the figures to an accountant rather than punching them into the government's website would take longer

Is it even per year? I thought the fee was just upon first registration

You are lucky. Over here, it's rather over 2.5k€ because of the accountants, notaries and state taking good care of themselves...

> Costs roughly $1000/yr to run a properly sheltered LLC. Just saying, that’s a low barrier to overcome for any company turning modest revenue.

I'm paying $200ish annually in Georgia. Am I missing some major filing requirement? This is a big discrepancy.

OP was including other base fees beyond just the registration fee. The registration fee is $50-$500 annually depending on the state. With most states charging $250 or less.

Can confirm this solid advice.

Even at a mega-scale social games publisher like Zynga, we had to deal with automated bans all the time. That's why at one point we used an avatar for each game that was separately managed and was basically a separate identity with a separate bank account with a holding company etc.

- Invent an avatar that has their own profile, residence, birth date, gender etc.

- Use separate email addresses, not on your company's domain (to avoid domain bans).

- Use a separate mobile phone number, if possible.

- Use a separate smartphone device. There's Android devices for less than 100 bucks now, so that shouldn't be an issue.

- Make sure the geolocation of the Android device doesn't change too often. Paypal and others block you immediately because they're too stupid to realize people can actually travel and work from multiple locations; even with 2FA and SS7 enabled.

- Use a password manager, use 2FA, and make sure to backup account data and every security question. (and all the other standard practice advice)

- Treat your app's / game's avatar as a separate identity, which means don't have the same friends that your private accounts do. Don't link to other accounts of your ownership. Don't mention other projects of your company, otherwise they'll likely ban both accounts for click fraud.

I find it hard to believe Zynga had to use such techniques unless you’re referring to very early days. I, too, have used the techniques you’ve mentioned and went way down the rabbit hole. Among the things you’ve mentioned also found myself shipping friends and family laptops and Teamviewering into them to use alias accounts. Not fun to have to resort to such tactics. If Zynga still employs such, I shall make a mental note to stay the heck away from their stock.

I am not sure what you are implying. I am not an expert in this field but based upon the article and comments here it seems that this is something you have to do unless you want to be banned, even nowadays?

How do you make an avatar with a bank account?

They said they used holding companies.

If you are just paying a couple of $100 a month for app related stuff you can just use a new bank if you want and just transfer the amount needed each month. Opening accounts is something banks really like when you do so its usually not hard.

Don't you have to name the account after a real or legal person?

Depends on the country. A well regulated bank has to know who the real or legal person behind the account is, but that doesn't necessarily mean the name of the bank account has to correspond to the name on a birth certificate. It's the business of the state to make sure they can tax you, but it isn't the business of the state to make sure Google can ban you.

It also depends on whether your company legally resides in the US or not. And also where the HQ is located (as that's the legal baseline for taxes in Ireland).

Most of those mega companies probably are not even paying taxes in the US, due to them having their legal residence in a postbox office in Dublin.

In addition to my initial comment: Most banks that offer enterprise/business bank accounts have a feature to split up accounting so that you can manage the financials of teams and suborganizations in a separate manner which eases up filing tax reports, too. I know that this is the case in Europe, but dunno anything about the banking system in the US.

I think you are looking for the term 'legal entity' instead of 'legal person'.

No, “legal person” (as opposed to “natural person”) is a real term.

Many fintech banks do give you the option to open up separate accounts with individual bank account numbers quickly and hassle-free, e.g. bunq.

I too am trying to work that one out. My guess is that they used DBAs, each with a separate bank account.

Funny thing, that sounds precisely like what you'd do with shell companies and any other kind of alter-egos making you hard to find. Bonus points if the companies have different owners and formal directors.

Nice of Google to educate people how to do this stuff.

> - Your Amazon shopping account and your AWS account should definitely not be the same account.

My Amazon account has been locked for a few days now because I tried to buy a friend a gift card, and I can't even access my AWS account at all. Thankfully all I have on there currently is some old backups in S3, but I previously used AWS for some projects and this could've been a fucking disaster.

I tried to buy an Amazon gift card the other day for a friend's birthday, and a few minutes afterwards, the transaction was reverted and my account "was locked for unusual activity". I got an email saying they thought an unauthorized party accessed my account, and it included instructions to reset my password. I did so and then tried to buy the gift card again. A few minutes later, my account was locked again, and this time it told me to wait two hours and then call customer support. I did so, explained everything, got my account unlocked, and the customer service rep assured me the gift card purchase would work this time and volunteered to stay on the line for a few minutes while I reordered the gift card to make sure it worked correctly. It seemed to go through, and then an hour later it got reverted and my account got locked a third time. I waited two hours, called customer service again, and they told me that they'll mark the purchase as legitimate and that I should try logging in again after 24 hours. It's been a few days and my account is still locked. I need to call again. Seriously what the fuck.

I've just had a similar experience with ebay.

About 75% of the times I log on to ebay, (no exaggeration, I only purchase something a few times a year and this happens almost every time), my account gets locked for suspected unauthorised access and I'm forced to reset my password.

I have a static IP, and only ever use the same two devices. I have a strong unique password.

I spent 15 minutes on the phone with their account security team who could tell me nothing about what triggered the lock, nor did they have any advice on what I could do to prevent this from recurring.

Something in their automated system is giving a false positive, and neither I nor seemingly anyone on the account security team has any way to address it.

I had this same issue with "suspicious activity" many years ago, and I had to call a US number to have it sorted. Though I did have it sorted.

They keep spamming me with the meaningless "help us protect your account" emails tho. The kind with a lock icon and zero useful information. I set up a rule to auto-delete those.

you can just go onto your account settings and uncheck the relevant box to stop the messages

At least you can talk to staff at Amazon who have the power to help you.

Just got an update!

"""

We have closed your Amazon.com account and canceled any pending orders.

We took these actions because our records show that an unauthorized person has signed into your account. For your security, the credit card information stored on your Amazon.com account cannot be accessed via our website and your full credit card number is not displayed in your account.

"""

What the actual fuck. Do I at least get refunds for my digital kindle book purchases?!

... I called again, they insisted my account was permanently closed, I talked about all of my Kindle e-book purchases and that I really wanted my account back, they said they'd forward the case to their account specialists, and 30 minutes later I got an email saying my account has been reinstated. So it turned out good, but I gotta say I'm pretty soured on Amazon right now.

Something very similar happened when I tried to buy a MacBook on Amazon.com with an European credit card. It just would not work, probably due to my **ty bank rejecting the payment… from Amazon. Good job.

Many attempts, calls, and hours later, I used my debit card from N26 and it finally went through.

While I get what you are saying, this is sounding more and more like an abusive relationship. "Getting beaten by your husband? Try not being around him when he is drunk." At some point we have to face the reality that the tech ecosystem needs some serious fixing, for both consumers and developers.

I had this exact comparison pop up into my mind yesterday when I read this, yet another, news of Google flexing on someone.

Actions of both tech companies and content publishers make it clear as day that they have zero respect for people. Well, since consumers keep returning to them, they evidently don't have much respect for themselves either.

Since when have we not looked at capitalist entities as abusers and exploiters?

No one wants to be in this situation wrt megacorps and their stranglehold on the internet, free speech, and so many livelihoods. Putting the onus on consumers to fix this is hilarious and naive.

While I agree that the onus should not be on consumers, it’s generally not bad advice to say “avoid those who abuse you”. it would be better, of course, to say “avoid those who abuse you… but I’ll be trying to protect you”

Look at it as a part of the portfolio of approaches we take to address this problem. It may not solve the problem on its own, but it's an important step to take. And arguably a necessary one; a great deal of what gives these companies so much power is that people simply can't imagine trying to do without them and don't even try.

Just because people say to stop giving them so much money and attention doesn't mean that they think that's the whole solution. But if you aren't making even a token effort to stop giving them so much money and attention, you're probably more part of the problem than the solution.

If you think these companies are a problem... take action. If you aren't willing to even so much as cancel a streaming subscription or take responsibility for backing up your own photos or whatever the issue is, you're sending major signals to the legislative system or whoever else it is you expect to swoop in and save you that you don't care enough for them to need to do anything either.

I don't mean this to be absolutist, either. I use Google in a few places, even despite my distrust and distaste of them. But even there, I hold them at arm's length. If they completely nuked my current accounts, it would mostly be an inconvenience. Worst bit would be the ~$20 of apps I'd have to repurchase. (I'd lose more than that but mostly I could just let them go.)

It's likely not 'tech' but abusive customer interaction practises. Don't need tech for that, just an a-hole with an MBA.

When the only tool you have is an MBA, every customer looks like a nail.

If there was a screwdriver analogy, we could turn this in to: "If all you have is an MBA, every customer looks like it needs to be screwed".

All of this is of course fine banter, but there does seem to be a pattern where the end-of-the-chain responsible party just has some generic business related schooling that results in questionable practises in the name of profit, or in some cases just growth (or some derivative).

It's not the customer support agent that woke up one day and thought "how can I screw over the next customer I get on the line", it's probably not the engineer that made the software in such a way that it just screws over everyone who comes in contact with it. Middle management probably doesn't have much to do with it either; they are often just doing what their manager told them, and don't want to go against that and risk their position. They are often not responsible for the top-down policy either... so that leaves us with the people that feed a bad policy to the rest of the company.

More critically, it's people that claim positions of authority while not having any clue of how real work actually gets done, making protecting their own position their primary goal. These people excel at playing politics such that nobody is responsible for any given problem, so once you get a critical mass it becomes a stable situation where little can change.

If you created a new company with ten random people from this thread, it would not suffer this banning problem as everyone would be aware of this failure mode. But if you fed the same people one by one into Google, they would each either succumb to corporate politics or quit, and at the end nothing would change.

These kind of bullshit jobs are the best argument for basic income. Our society would be better off if they were paid to stay home and stay out of the way.

If you don't like the way these businesses handle (or, more accurately, don't handle) customer support, you should avoid doing business with them.

Delete your accounts and shop elsewhere.

Oh hey it's the "you should leave him" guy. As with abusive spouses, there are usually circumstances trapping people there. Not least the unequal power relationship.

This is a circumstance where society, in the form of government, needs to weigh in to force tech giants to behave more sanely, because only society as a whole is a bigger fish than Google, Facebook, etc.

No one is forced to do business with Google.

If you want to sell Android apps, you are. Yes, I know Android allows installs from sources other than Play Store, but if you want to be popular, you have to be in Play Store.

I'm actually surprised/impressed with how successful that strategy has been for Google. I've always considered sideloading and alternate app stores to be an advantage for Android, but Google's store is effectively a monopoly anyway.

> If you want to sell Android apps, you are.

No one is forced to sell Android apps, therefore, no one is forced to do business with Google.

Statements like this are technically correct, but not very useful to discussion of the problem of Google and other large corporations being in control of such large pieces of widely-used infrastructure that they effectively decide what kinds of things others will create.

Well sure, they could go flip burgers instead.

The parent's comment is so infuriating: yes, you can chose something else instead of Google, but it hardly matters because all of them are more or less equally terrible. Which, I guess, only makes sense in the competitive market: way too terrible or way too pleasant entities go bust (for slightly different reasons), what's left are entities that are just "good enough", and there is not much reason for them to try and improve the quality.

So I’m going to say “yes they absolutely are”

And you’re going to argue with me on the semantic definition of “force”, ignoring the sheer power Google (and a few other tech companies) wield over the technological word, which now encompasses basically all commerce and industry to varying degrees. The smartphone market alone means you’re forced to deal with Google.

Single line pithy comments set up these situations. They’re not good communication really, in my opinion.

It is absolutely possible to make an app that doesn't support iOS or Android and runs on weird unpopular Linux smartphones, and thereby bow down to nobody.

Except your landlord when rent comes due.

This is what makes the forced Facebook login for the newer Oculus VR devices so problematic. You can't create a second Facebook account just for VR. If you get banned on Facebook, you lose access to your paid Oculus store apps on your VR glasses.

Of course, granting Facebook access to the extremely private tracking data that you can gather during use of VR is another terrible idea.

Even if you use separate accounts, Google can and has banned all associated accounts (including personal accounts) in the past.

What do you mean by associated accounts? How does Google know they are linked?

Idk how but it’s happened before - https://old.reddit.com/r/tifu/comments/8kvias/tifu_by_gettin...

Same device access, same email domain, same tax registration number, going off other answers in the thread

Its just about same anything. Simple guilt-by-association is a real thing for google at least. You have an employee who's deemed by google as a bad app developer? That can impact the business that employs them even if its an unrelated app.

If I remember correctly GitHub also locked an entire organization’s repos because someone accessed GitHub from a red-flagged country probably 2 years ago.

I can’t wait for regulation to arrive and stop this kind of behavior.

That's a very different thing, because they were worried about breach of US law. Not saying that makes it fair or non-destructive to the business, but it's not in the same league as Google being over-aggressive in protecting their ad money.

(And if there were regulations around this, Github would probably still have done the same thing, because "national security" regulations punch through "consumer protection" regulations every time.)

> - Your Amazon shopping account and your AWS account should definitely not be the same account.

If you need another reason. I've heard allegations that the recovery process for Amazon shopping accounts and for dedicated AWS accounts are different, with the former being easier to socially engineer.

Probably some risk management department figuring that in the case of the former any "fraud" can be resolved with any chargebacks/refunds

> I'd extend this even further: never use a single account for more than one purpose. Create a separate account at the same company for the other purpose.

This should really go without saying. I’m sometimes shocked at the extent to which it has become normalized to mix up one’s personal accounts with work. I can’t count the number of times a colleague accidentally sent me an email using their personal account, or texted me from their personal phone. Some people even use their personal phone directly for work, without even doing so much as creating a work profile. Why are you doing this to yourself? You’re just asking for trouble.

Don’t even get me started on how entrenched “Sign In With [Company]” schemes have gained traction. Why deliberately have such a single point of failure? To save what? An additional password?

Firm agree on mixing work/personal contexts.

However, in practice, using "Sign in with Google" by default dramatically increases resilience to most failure modes for almost everyone without a sophisticated threat model.

> To save what? An additional password?

The average person does not manage their passwords in a sophisticated way; if someone is signing up for many different services, they are probably using the same password everywhere, or some simple enumeration scheme. Then, when some random forum or web service gets compromised (as they inevitably are), their password to everything is compromised - including Google! On the opposite end of the spectrum, if Google is the only service with a password, and everything else is driven by Google-owned SSO, that person is essentially immune to compromise; whatever I think about the company, I do believe in Google's security team to keep passwords safe and block dictionary attacks more than any other service on the internet.

And while we can evangelize setting up password managers and using strong random passwords everywhere, the truth of the matter is that many people simply cannot accomplish this. "Sign in with {Google, Facebook, Microsoft}" gets them 95% of the benefit at much higher reliability.

> if someone is signing up for many different services, they are probably using the same password everywhere, or ...

This is completely the case, and at least from my experience the reality is worse than what is often believed: people don’t have distinctions between websites.

i.e. if a layman registers john@cool-website.invalid:correctStaple, and then they open another-sitename.invalid the other day, and presented with login screen, his intuition will be “john@.:correctStaple has to work”, because that’s what he “entered” yesterday.

Federated sign-in solves this by allowing users to use coherent id:password string for any login page without having to have distinctions between domains.

Using Google SSO is fine unless Google arbitrarily closes your account with no recourse.

Strongly agree! And if Google closing your account is a big part of your threat model, that's something to hedge against.

But I suspect that for the average consumer - people using their gmail to send and receive emails, and doing stuff like watching Youtube and installing Android apps - the odds of that are quite small, especially if they don't have a business or developer context associated with their personal gmail. Account loss/takeover due to password re-use is a much bigger threat for the average person.

> Don’t even get me started on how entrenched “Sign In With [Company]” schemes have gained traction. Why deliberately have such a single point of failure? To save what? An additional password?

Well, no, it doesn't save a password. People use the same password across all their independent accounts.

Sign in with [Company] doesn't improve that, obviously, but there is the idea out there that [Company] might be doing a better job not leaking your password than the couple dozen sites that know it under the other system.

In other words, Sign in with [Company] is a way for a website to protect itself (from touching your password) at your expense. It's not there for you.

It’s pretty helpful for online shopping to be able to use Apple Pay. On your phone, you just click the button, use FaceID, and confirm shipping address. It can be done in 2 seconds compared to regular checkouts which step you through 4 or 5 screens.

Sign in with GitHub has also been nice for me on gitter. I don’t need a separate gitter account for any reason, and sharing my GitHub account on gitter is reasonable.

> Don’t even get me started on how entrenched “Sign In With [Company]” schemes have gained traction.

Absolutely!

My advice is to never, ever, use these links to sign in with a different company. It is a sure fire way to lose completely unrelated accounts just because ML went crazy somewhere and banned you.

(Also, on the advice front, always run your own domain for email. You need to be able to transfer it elsewhere when gmail blocks you, if you're using gmail.)

I'm not sure if this isn't a bit too paranoid approach. Using single sign on is imho fine as long as you use that account only for single sign ons. At least I haven't ever heard of anyone banned for this. Sure, it isn't ideal, but it significantly lowers overhead of managing too many identities.

> - Every product/project you manage should be on a separate account on Google, Facebook, Amazon, etc.

I wouldn’t do this with Facebook. Creating a second account is against Facebook policy, and they may ban both accounts.

Facebook's demand is this brain-damaged garbage:

If you want to represent your business, organisation, brand or product on Facebook, you can use your personal account to create and manage a Page.

We have a diametrically conflicting policy, by which personal accounts absolutely may not be used to manage company resources, for exactly the aforementioned reasons of minimising blast radius; so, we basically gave up on Facebook.

The double standard is evident: can you imagine any FAANG security team allowing a major corporate communications channel to be owned by a personal account? Answer: no; because doing something that fucking stupid would be a disciplinary offence.

Yep, I wanted to set up a Facebook page for my company, but as I don't want a personal Facebook account, I figured it wasn't worth it because it would end up being fake info, and they could then just shut it down.

It seems like a risk with Google too. It's common to be logged into Google/Gmail with multiple Google accounts. Even with separate Google accounts, Google can tell they are related and could potentially ban them too.

A quick web search came up with Google's "associated account ban":

> "Associated account ban" means not just explicit account linkages, but also implicit ones, where a wife can be banned for the misbehavior of her husband

https://www.reddit.com/r/androiddev/comments/ckoej1/googles_...

It is funny how Google behaves like the worst dictatorship on the planet. Guilt by association is such a bunch of crap.

I just can’t wait for my personal Google accounts as well as several others business accounts I access regularly to suddenly be blocked all at once.

Legit question: is there any other service/company on earth that bans you for having multiple accounts? This seems like an insanely restrictive policy. One of the defining characteristics of internet communication is that you can have a “work persona” and a “home persona” and maybe another one for your hobbies, another one for your porn browsing and gambling, another one for your aunts and uncles. To deny this basic, universal concept is backwards and frankly shouldn’t be acceptable to anyone.

Internet companies have decided to deny this right the moment they figured out that your identity is valuable. Nowadays Google and FB, among others, will punish you if you use different online identities without their knowledge.

https://en.wikipedia.org/wiki/Wikipedia:Sockpuppetry

It is also a common policy on many forums.

And while I love complaining about policies and behavior of FB, Google, Amazon etc, this one makes sense.

Almost always you ban person, not account - so standard is to allow one account or to require accounts to be clearly linked (for example, a separate bot account that is clearly declared).

Wikipedia's policy doesn't say you can't have multiple accounts, just that you can't misuse them.

GitHub disallows multiple free accounts in the TOS, meaning identity separation seemingly implies a continuous subscription cost forever. I'm not aware of any high-profile enforcement, but it's there.

Microsoft reportedly has internal one identity policy, Facebook is notorious for forcing people to expose, etc.

It would be so ridiculous for Microsoft to have a one identity policy because Microsoft software accounts are generally provided by employers and tied to them, I have 4 MS identities (personal, two companies and university) and MS does not provide an option to use a single identity for that.

You can create Page accounts directly, which are not "people", so they aren't subject to that policy. They also do not have access to the same features, however.

Every older person I know does this because some games require to be unlocked at different stages by a friend.

> Create a separate account at the same company for the other purpose.

I'd love to create separate accounts for other purposes, but doing this has become such a big pain that I only did it a couple of times so far.

Most services now require mobile number during account registration. It seems necessary to provide a unique number, but how to get one? Numbers from "burner" apps often cannot get the text with confirmation code. Also, the registration process itself is difficult; sometimes multiple genuine attempts at account registration get your IP blocked, at least temporarily.

If anyone has any tips, I'd be happy to hear them.

Couldn't agree more.

My Amazon retail account got flagged for fraud (cause I had an old CC attached to the account).

My AWS account got disabled as well

Until those services decide to force you to have a phone number registered, which means that you can't have more than one of those services, unless you're willing to sign up for a new cell contract because they don't accept prepaid cell numbers anymore or VOIP numbers.

(yes, this is based on personal experience)

I would add that buy your domain separately.

All cloud/hosting providers offer domains sometimes for free. You don't want that.

Because if you get locked out of an account you get locked out of your domain. Sure you can sometimes get at least domain back, but that usually involves layers and can take weeks or months.

If you can (its often not practical, but when it is) hosts your DNS elsewhere as well.

And most importantly, have at least one backup somewhere else (if you host on AWS have backup on something that isn't using AWS as a backend)

I would exercise caution doing that. If the accounts are created from the same infrastructure (IP, computer, mobile device), they are easily associated and can be swept up in a ban.

Yup

This is also why I NEVER use "Log In with Google" on any other service or site. I also just realized that even using the gmail address as the contact/backup is a bad idea, as if the acct gets reset and I no longer have access to that email, it's unrecoverable (exit's stage left making task to change all acct contacts off of Google..).

Also, seems from what I've read elsewhere, that the threshold for banning is as low as a single click on a known machine. this means that you can't even do a legitimate check of your own adverts.

In essence, this means that the Googles and Facebooks of the world are working to connect and consolidate identity information, and we now must work extra hard to dis-aggregate it. Seems there's an opportunity in this space to simplify and automate parts of identity fragmentation...

Sometimes when one of your accounts get banned you (the account owner) are legally required to stop using any other accounts. Bottom line - it increases survivability, but at the cost of breaking ToS. Separating corporate and personal accounts is a good idea in any case though.

> Don't use services where you're required to mix accounts like this.

In fact don't let your business depend on these services full stop. EVER.

This is the right thing to do, however Google has ways to detect multiple accounts from the same individuals. Cookies, credit card numbers, IP addresses, etc. It's really hard to separate them enough so they can't link them.

And sometimes they will ban all your accounts if they find something they dislike on one of them.

Yep, separate devices is the way to go. It can be a hassle but to setup but its worth it in the long run.

We need competition, an alternate app store or a rule that says that companies involved in making operating systems cannot get into the business of maintaining/curating/controlling app stores. Else these app publishers end up being beholden to the whims of the companies controlling the app stores.

While this is good and practical advice, it does irritates me that there isn't more of a push for regulation to protect people against automated actions like this. I know in the EU we have protections under GDPR which allow us to request an explanation for an automated action, but I don't believe we have anyway to request human review.

Part of the problem it seems is that even if these actions are unfair and unjustified it still makes financial sense for these companies to be trigger happy with automated account bans rather than implementing a more nuanced and intelligent approach which would likely require some human intervention or investment in more intelligence automated systems.

If we had some way to request human review or dispute automated actions it would become far more expensive to take unjustified automated actions as people would just complain and request a human reviews the case. Personally I think we've become far too comfortable with tech companies making it almost impossible to contact them. Requiring a human review process for automated actions and requiring companies have some way for customers to contact a human would create jobs and give us some legal right to adequate consumer service. It's weird to me that we have rights when it comes to how our data is used (at least in the EU), but no right to basic consumer service when our business is destroyed overnight because Google takes some automated action.

> I know in the EU we have protections under GDPR which allow us to request an explanation for an automated action, but I don't believe we have anyway to request human review.

There is, with limitations. The relevant part of GDPR is Article 22, "Automated individual decision-making, including profiling" (Full text: https://gdpr-info.eu/art-22-gdpr/)

This is probably the most restricted of the rights granted under GDPR. You have the right to manual review of algorithmic decisions, only when those decisions result in "legal effects concerning him or her or similarly significantly affects him or her."

Whether it applies to Google depends on how you interpret "similarly significantly affects," and that's something likely to vary from country to country and well beyond my experience with GDPR. If this were the US, I would expect that to include housing and employment. There's a much stronger argument that this right applies to a Google account if it represents a significant fraction of your business income.

GDPR is for people. It doesn't help you if you're a business.

There is broad precedent that some GDPR protections also apply to businesses that consist of a single person.

> account siloing very likely would have avoided the issue

Not necessarily, if your personal@gmail.com and business@corp.com Gmail accounts almost always access Google from the same Comcast IP address, from the same Wi-Fi BSSID, and awake/active at similar hours, Google could easily tell these two accounts are likely the same person.

AFAIK AdSense also tries to detect forms of click fraud where you ask people in your network to help you click ads, and I can only imagine they can do that because know who you have e-mailed before, whose phone contacts you have, and who you have had calendar events or Hangouts with before.

Banning apps with no recourse or appeal process, however, should really be illegal. They could easily bankrupt certain small businesses and livelihoods from their rash algorithmic decisions.

Then you will get flagged for creating too many accounts...

Well, if you took such strategy, obviously you nee more precautions.

- Never share the same IP address among accounts.

- But keep IP address range consistent for one service because anomaly means automatic ban.

- Never share the same physical computer among accounts.

Or you can be like never bother to relies on a single platform.

Hopefully they wouldn't ban other accounts linked to the same IPs?

I mean, what about families sharing a single IP? A single computer? Sometimes a single phone number?

What about companies VPNs?

What about hotspots and public WiFi?

Agreed. But this causes so much energy expenditure in setting up and maintaining these separate profiles for each project. We need more tools in this space, along the vein of password managers.

That is quite a bit of effort to protect from accidental temporary bans. It's definitely important (and easy) not to mix personal and business accounts, even for for single-person companies. But keeping different accounts for different parts of the same company without committing fraud is not that easy.

If the ban is permanent and results from a change in policy, this won't help significantly anyway: if Google actually wants to ban your business, they will find all related accounts, and ban them.

IMHO, it is not true with GitHub. Once I had to access a couple of my clients' GitHub account and all of them got banned. It was a stressful process to remove the flag.

This in general is sound advice however most large cos will have the ability to detect cluster of ids that are owned by same person.

- Beware of impersonation. It is a felony offense. When you create accounts give the same first name and last name. There are many forms where you have to answer questions like "Have you ever used any other alias?". While 99% of times it is fine, there are rare cases where you might get into trouble. I know some people who did.

Can you elaborate on how people got busted for an alias?

While I agree with the suggestion it is explicitly not allowed on some platforms.

We recently had this issue with Apple. We wanted to create a separate account for App Store Connect to use with automated builds. Apple locked the account and required identification scans. Our VPE submitted his own info and it was rejected. For now we're stuck using someone's personal account.

Isn't that textbook ban evasion?

The company is for sure tracking your IP's and if they see two account with the same IP chances are they could ban both accounts.

I would use a VPN with your other account to be careful, or just in general.

And then they could also be fingerprinting your browser.

I don't know of any safe way to have multiple accounts, other than separate computers and one of the computers is on a VPN.

> Create a separate account at the same company for the other purpose.

To make it even worse: you should even keep separate devices for the profiles. God knows who uses device-unique identifiers to join "sock puppet" accounts together, it is pretty much suspected that Twitter does.

> Create a separate account at the same company for the other purpose

fyi this is against Google Ads's terms last time I looked into it. You can do it if you've got the secondary account registered as it's own legal entity but one Ad account per entity

Amazon groups accounts they think they belong to the same person and when one is banned, they band them all. Just ask 3rd party marketplace sellers. I doubt G/FB aren't doing the same.

For Google specifically, do not use one email address as a recovery address for another - both will be banned together. Also, do not share recovery phone numbers.

I'd called it 'account sandboxing'.

I wonder if there is a business model for this.

Using multiple accounts like this can also assist with implementing separation of duties.

Reply on news.ycombinator.com