Hacker News Reader

Comment by tolmasky | Hacker News Reader

Forget the movies you lose, if your AppleID is disabled, you also lose:

1. All your emails if you use iCloud for your email, and thus potentially locking you out of any other sites that use email as a 2-factor-auth.

2. All your backups on iCloud.

3. All your data on iCloud.

4. Every single login you have where you used sign-in-with-Apple.

5. Every app on your phone that you have a paid subscription for.

6. The fallback login mechanism on any of your Macs where you used iCloud as the login fallback.

The list goes on. They ask you to tie your life to iCloud. They tell you to make backups on iCloud. According to the reddit thread, this can happen if there was a fraudulent charge made with a credit card associated with the account... Not even done on the account. So then all of your data disappears?

View on HN

AFAIK you should be able to request a copy of your data under EU regulations.

But honestly, it freaks me out that Google might someday disable my account. Unlike the Apple stuff, Gmail is a gateway to all my internet stuff since 1st of April, 2004. Lately Apple is also trying to be that middleman and IMHO account blocking should be more like denying anything new but providing a clear path out or a clear path for re-activation.

Another thing that I can't stand is the policy of not disclosing the reason for account blocking or rejection. This should be straight out illegal, it creates real stress and even trauma on people and I don't believe that the justification on making their job easier by hiding their methods to fight bad actors is a reasonable one.

A number too small to show up in the analytics dashboard is someone very upset, maybe crying maybe going through life changing situation due to a glitch or bad design in the system. These things happen all the time and get resolved when gain traction in social media.

The tech companies need to understand that they are dealing with real people and the outcomes of their actions are real and that's why they are paid so much in first place.

Shameless plug; I'm building FaangSupport[0] to try to solve this issue, did a Show HN[1] to try and get some feedback but It didn't get enough traction; Most Important Feedback I needed is whether my idea is even legal. But I believe we have to democratize accesss to customer support for Faang.

[0] https://faangsupport.com

[1] https://news.ycombinator.com/item?id=36899787

That's a pretty neat idea.

Obviously might be a challenge to find enough volunteers and this is unfortunately really only a bandaid on the actual problem.

Curious to know why you included a login with Google account though. Feels like they're particularly well known for disabling accounts.

Thanks!

And true, the service is only good if Fanng/Fortune500 employees signup. I agree, its only a bandaid because Faang needs to step-up to solve this.

I think the only reason I added Login with google is that it's frictionless, just to enable users quickly setup accounts.

> the service is only good if Fanng/Fortune500 employees signup

Make it a paid service. It's the only way it will work. People may be willing to spend a few minutes of their weekend or evening to help when it's a front-page post on HackerNews, but nobody will voluntarily waste their free time helping strangers at an industrial scale on what will end up being 99% stupid issues.

I would be very surprised if FAANGs permit their employees to moonlight like this.

I work for a FAANG and it's a violation of company policy for me to profit from privileges associated with my employment.

That's why I was wondering whether the service would be legal. Thanks

Company policies aren't laws. Employees could be fired over it, but some would definitely take the risk, as they already do with providing mock interview services, moonlighting without receiving formal authorization, having 2 jobs, etc.

Of course it would be forbidden, the same way it's forbidden to sell mock interview services, yet they florish.

Makes sense

not speaking for Amazon or any other FAANG entity, but one fun and important thing to do when thinking of an idea is to imagine the risks and downsides.

For example, let's say someone uses your service to steal money or personal information from unwitting customers who think they're dealing with official 'FAANG support', or the bad actor provides erroneous information that ends up causing harm or death. Where do you think that open-ended liability would be assigned, were the legal system(s) to get involved?

For another, let's assume for a moment that there's an unfilled demand for FAANG support. Most interesting support calls likely require customer identification and also, crucially, internal backend access (e.g. to account systems, server logs, billing systems, and so on). Your site will not have that capability. That limits you to the boring support calls, which might as well be a wiki or stackoverflow, raising the question of whether you were able to address this unfilled demand.

Exactly, I did think of all this, especially about the Security implications of running such a service, another example, what happens when said Faang Employee leaves Faang and does not explicitly say so but keeps representing the former company.

Thanks for your feedback. This is why I thought I should get feedback before coding further.

> But honestly, it freaks me out that Google might someday disable my account.

Then don't wait. There are plenty of alternatives such as Fastmail. You pay a small amount of money but you can talk to a human being if anything goes wrong.

I also don't get why people put all their eggs in one basket. I'm so glad that my email, password manager, YouTube profile etc are not the same account.

Switching is very hard, It's lot of work to go through all the things. Abandoning Gmail right now would be the same as Gmail disabling my account.

You set up mail forwarding today and eventually, in the span of just a few years you'll be free of Google.

But where is the current greener grass?

I keep seeing fastmail here. Is that the best alternative right now?

The e-mail provider is less important. Just make sure it’s pointed to a domain you own

I migrated some family email to Zoho the other day. There's a decent free tier and their email service alone is pretty cheap ($1/user/mo). For $1.25 you can get exchange activesync support as well.

It’s much, much easier to change account details when you can still access the old email. Get your own domain for $20/year and you never have to worry about losing access again. You can always redirect your domain to a new email provider if something happens

> you never have to worry about losing access again

Don't you still have to worry about losing the domain?

Ideally, you get your own domain and point that at whatever provider you feel like. Should you ever be locked out by a provider you point the domain to another one. If you follow a semi regular back up schedule for email you could even import your existing emails to some providers.

That won't work when all the sites you use auth with Google as an identity provider.

It's not as bad as you think. Fastmail has a great import process.

Transitioning to a new email address isn't really that bad. I did it about 15 years ago. Whenever you log in to a site and you notice that it's using your old email address, you go into your profile settings and update it. After about a year you'll probably have hit 90% of your meaningful accounts.

I think the point is that you don't abandon gmail right now, you give yourself an alternative, and when you access a service or decide to change something about it or need to recover an email, you change it then (and store the new info in your password manager, maybe mark/rename the old info as OBSOLETE if you have that sort of control), and eventually you've decoupled yourself mostly.

Truly decoupling yourself is hard, and you'll probably be finding old accounts and dealing with them for years, but getting 95% of the stuff moved over the next year or so will likely give you a lot of peace of mind if you're actaully worried about it.

FWIW if you're actually worried about it, you should also make sure your email is through a domain you control (even if just pointed towards a service, or even gmail) and that domain service is not linked administratively to the same account that you use for email (e.g. don't register domain through google and then point at gmail), so worst case you can change the destination service by changing MX records and just swap all your email at once to a new handler (or if you're a masochist or as a last resort point towards your own mail server you admin). Just make sure it never expires (in the end, there's always something to worry about, you need to find the risk you're most comfortable with).

1) Buy domain

2) Buy mail services from fastmail

3) Set up forwarding in Gmail

4) Every Saturday you go through your inbox and change the email address on accounts important to you, and unsubscribe from the rest.

And you should still log in to Gmail of course, to avoid account shutdown. Also, Gmail doesn't forward what it considers spam.

I tired that for 6 months. Fastmails crappy spam assassin bases filtering is a deal breaker. I ended up just pointing it back at my gmail. Just an inundation of spam.

I also found their search (which I rely on heavily) to be a joke compared to gmail.

I transitioned to my own domain plus fastmail years ago, and found I barely get any spam. I made sure to make a unique email per service and barely get any spam, and if I do, I can ban the email address. Helps you detect breaches or spam sales way before it becomes public.

I still have the old gmail account, but almost nothing of value goes through it.

The key is the domain, you don't even need to go away from gmail, but own your domain.

> Abandoning Gmail right now would be the same as Gmail disabling my account

There's your problem fishbulb.

I started my move in November of 2018 according to my Fastmail billing history.

I've _still_ got a few places that insist sending mail to Gmail (mostly sites that don't let me switch email for some weird reason).

I got my own domain, set it up on Fastmail, imported all my old mails from Gmail and set up a permanent forward from Gmail to Fastmail.

Then I set up a filter on Fastmail that shows all mails that were sent to my Gmail address and slowly went through that list and switched from @gmail.com to my own domain.

Now I'm the customer for my email instead of the product and I 100% own my own domain so no single company can take it away.

There isn’t anything really. I drank the koolaid and I lived in my mail for decades. My inbox has 100000s emails and my life is there. Alternatives I tried, for instance outlook, fastmail and others simply die when I turn the hose there. And that’s just new email, not import which I need too, of course. Gmail doesn’t flinch and is always fast.

Just be prepared for it all to go away when you need it the most. Thunderbird can import your past mail

I run google exports and that makes a massive mbox file; thunderbird cannot import it. It hangs and then crashes.

Use pop and download/delete each message at a time.

You still end up beholden to a service. They have human beings now, but they might not in the future. Or they could vanish. Even running everything on your own systems is risky because you still end up being reliant on domain registrars.

> Even running everything on your own systems is risky because you still end up being reliant on domain registrars.

But much less risky because if you have a problem with your registrar, you can move to another registrar without having to change anything else.

> But honestly, it freaks me out that Google might someday disable my account. Unlike the Apple stuff, Gmail is a gateway to all my internet stuff since 1st of April, 2004.

Then don't use gmail? It is very much possible.

Something being possible is fine however this situation is becoming untenable and needs regulation ASAP. Google, apple et al have too much power and are involved in too many aspects of life. If they are borderline utilities, governments must regulate them so. situations like this have some legal recourse.

Get the US government agencies to enforce the anti trust laws that already exist, and poof! Problem solved.

Alphabet would get broken up into seperate entities: Gmail, Google, YouTube, AdSense, etc, should all be different companies and your single source of life failure disappears

>Alphabet would get broken up into seperate entities

That doesn't necessarily solve the issue of having a sudden death round of Gmail dying would lock you out of a lot of services using 2FA email and/or "Login with Google."

I don't understand the netizens of HN sometimes. Can someone explain to me what is going on in their mind?

On the one hand, they complain constantly about this or that centralized service that they are throughly dependent on, and admit to being terrified of that service doing something "unaligned" with their interests. A few days ago, it was Stripe, before that it was Twitter, Reddit, now it's Apple, Google, etc. They complain and throw their hands up in despair, and Cory Doctorow even recently coined the word "enshittification" showing that this will always happen to for-profit platfoms. And Google Chrome's new client attestation API has everyone freaking out.

On the other hand, a lot of them gang up en masse on any decentralized and open alternative, especially Web3-related, that actually solves the problem technologically. They fight tooth and nail arguing that it isn't popular yet, and never should become. Because only centralized, government-regulated platforms that had years to become entrenched, are good, the rest is bad and should not belong on HN.

So what is the alternative?

Also this same group of people, seemingly, is totally nonchalant about the prospects of AI destroying human civilization, despite its own creators consistently giving that a 10-20% chance. They say that you shouldn't be worried so much. I just don't get this crowd, honestly. It seems like insanity.

PS: It's not all people on HN, just the most activist and vocal ones, and the ones with the silent downvote button trigger finger with massive hyperthrophy from constant use.

> Web3-related, that actually solves the problem technologically

Is this true though? Sure, there are tech demos but people use the tech as a mean to the end(which is some content or interaction) and just because it works on technical level it doesn't mean that it fulfil the needs of the user. For example, if all the best stuff about LK-99 is on Twitter and Reddit, I'm going to be on Twitter and Reddit. Convenience? network effect? Does it matter?

Also it's usually different people complaining about different stuff and as a result it's not a contradiction. We are not coordinated.

HN loves decentralized solutions. Talk about blogs, RSS, the old web, mashups and you get a lot of positive feedback. Also mastodon and matrix got a lot of coverage here, everything in the category of peertube. And encrypted alternatives to potential monopolies as well, Signal vs Whatsapp for example.

But you are simply mistaken if you believe a bunch of obvious scams with not a single usecase bundled to one illegitimate buzzword is a decentralized solution, and of course the crowd here will see right through such bullshit. That web 3.0 scambubble never had a chance here.

Nitpick: WhatsApp uses litetally the same encryption algorithm that Signal does. That said, I trust Signal a lot more, just because it isn't owned by Facebook.

To clarify the point made above: Do you trust Meta not to change your key to one they control without notifying you? Do you think they haven't implemented this functionality already?

I don't. I think we can decompile WhatsApp and look if something suspicious has been implemented (e. g. some backdoor that hides the key change message), but I'm not sure if somebody does this on a regular basis. That's a bit simpler with the open source Signal, although we still need to verify they haven't slipped a backdoor to their official build.

And this backdoor might not be needed though, as UX for key change is (was?) atrocious in both Signal and WhatsApp: https://keybase.io/blog/chat-apps-softer-than-tofu (2019)

I still think Urbit has a chance.

Urbit stems from a politically unacceptable author, and is far too much ideology, not usecase. I'm convinced it has no chance at all.

I'm glad you've heard of it!

There are lots more authors now. I'm not sure why you're so hung up on this one. (He was literally forced out of town. So don't hold him against us.)

I was also pretty sure that story would be a good one to explain why it does have a chance. Ever heard of Elinor Ostrom? (I'll assume you didn't hear of her, but you might have heard of Garrett Hardin who came up with Tragedy of the Commons, which I learned was one of the most widely cited "wrong arguments" in the history of publishing papers...)

I'm not a scholar in the field, but it was my understanding that retaining the capability for "driving someone especially bad out of town" was literally the thing that made it possible for "tragedy of the commons" to have been found an invalid construct as foregone conclusion or an inevitable outcome of working with communal shared resources.

They did studies of the tight-knit communities in Africa where they had managed to avoid the tragedy of the commons for many generations, and I'm sure I'm drastically over-simplifying the conclusion, someone here can explain it better than I can...

But so, we've got that going for us, as well. We can kick people out without "losing their shit for them" on the way.

It's a weakly motivated opinion I strongly stated :) Urbit back then was strange, it wasn't understandable what it wanted to be, and then there was all the political ramifications from the author's ideology. So in my mind it's still marked as dead, and if things really changed, I'll add "sadly". Because I won't be alone with that.

I had just a very short look at the project now, it does look different than what I saw back then. I'm just not convinced "inventing the stack completely anew" and "needing to pay for identities" can result in something that wins users, but hey, who knows. The thing that was attractive back then and still is, is the part about "one programmer should be capable to understand the whole stack." But that's only attractive for devs.

In the end all the background doesn't matter, only how the layer behaves that users can interact with. On the one hand that's good for Urbit, its history doesn't matter much. One the other it's not as good, since I don't see how Urbit could be a foundation for a service that wins against regular apps or websites. Publishing, reading, shopping, listing to music and watching videos, how can Urbit improve any of that?

Well I mean, you don't actually need to pay for it, you only need to "make them cost something." (You know, like a JPEG? Nobody really pays for these, do they?)

It's just a bit of friction, think of it like I'm giving you an egg. You need to carry the egg around with you and keep it safe, I'm not giving you another one. OK, maybe just one more. (But do try not to break it!)

But there are egg-as-a-service managers so you don't really have to carry the egg, just pay a small fee and someone will handle it for you according to the protocol. They are actually giving the managed accounts away now, if you wanted to remove all that cost and hosting friction and see what "superconducting feels like" J/K

The point about the identities is that they shouldn't be easily forged. If enough people do have them, if they're actually buying them, they won't have bought just one. They'll have them in bulk, they'll hold surplus, and they'll be careful about who they invite. You'll probably get one at no cost. Unless of course it's really becoming popular, and there is real scarcity. If Urbit is still around long enough for there to be any question of real scarcity, that will have been something else!

Just don't expect to purchase another one on any street-corner if you burned yours by sending spam, (then well it's better to have been a productive spam that made you at least back in value as much as the burned ID cost!)

Nobody really pays for this now. It's all million dollar art projects, and I think it's like the old days when you just went on IRC and who knows what you'll find!

I'm really glad to see you're willing to debate this in spite of having a strong opinion front-loaded, and I'm sure you're right about most people that heard of Urbit so far, ...but I think you'll find that many people will have only heard the good news and intentionally shied away from the controversy. We humans don't like conflict. No need to create it fresh from the bones of our ancestors, I say.

Or most people in reality probably haven't heard of Urbit yet at all.

People have lost funds on blockchain technology due to scam / bugs / errors. With no one to complain too, regulations is always the way imho, more anarchy can’t be the answer to anarchy

> On the other hand, a lot of them gang up en masse on any decentralized and open alternative, especially Web3-related, [...] So what is the alternative?

A decentralized and open alternative that's not "Web3-related"? Most of the objection is to the so-called "Web3" part, ranging from ecological concerns to the fact that its money-oriented aspect leads to it being full of grifters. We can have distributed systems without everything being about some kind of monetizable token.

How do you make decentralized identities that are spam-proof? You have to make them cost something, that's how. That's what this argument misses, and why you are all wrong about this IMHO.

> How do you make decentralized identities that are spam-proof? You have to make them cost something, that's how.

Not all costs have to be expressed as money or as a money analogue. For instance, a web-of-trust system could have reputation as the cost: someone who introduces too many spam accounts to the network could be marked as a spammer in turn.

OK, but if it has value (utility) and it has scarcity, then it's going to get a cash price. My favorite internet argument about Web3 was the time that I had two people on Twitter telling me that "scarcity" was a problem with my imagination.

If I could just imagine a world with no scarcity, then it would be so! Shame for this tremendous failure of my imagination. It's clear enough that I'm the problem now.

Well friend, I'm here to tell you that it isn't so. There will always be some kind of resource scarcity, and as long as there is money, people will be putting dollar amounts on our million dollar art projects. Whether or not we think they are worth the money, is not at issue. Whether someone will pay the money, is not at issue.

If there isn't a "finitely deep supply" for long-term holders to protect somehow, and the "cost to create more supply isn't negligible" then what cost is there to burn your pseudonymous identity? Just mint another one. It has to have some cost, or spammers will just push this button continuously and ruin it for all us good people. It only takes a few bad apples, (but there is really nothing worse than infinitely many procedurally generated bad apples!)

It requires someone (it can be a shared job) to take ownership of these barrels, and occasionally remove some dangerous bad apples. There can be enough barrels for everyone (even the bad apples! they can get a barrel to themselves...) even if a few are spoiled, but there cannot be infinitely many barrels with infinitely many apples and still make a good community platform. It has to have boundaries. This is just IMHO.

These are the table stakes for a successful distributed community platform to grow without limits. (It has to have limits!)

Decentralized is fine, especially Matrix and ActivityPub. In fact it's critical these open protocols get enough support to provide some antidote to Google, Facebook and the rest going full corporate capitalist utopia on internet services.

The Crypto crowd LARPing as Bernie Madoff or being wall street hedge funds are not. I notice you didn't event mention Crypto or blockchain, "Web3" won't fool anyone here though.

Actually, enough people were fooled to conflate FTX and Celsius with Blockchain and Smart Contracts, exactly because they were all lumped into one thing by the word “crypto”. I wouldn’t be surprised if many people are now against end-to-end cryptography also because the word “crypto” was co-opted:

https://amp.theguardian.com/technology/2021/nov/18/crypto-cr...

So why would I want to use it? It just confuses the issue. And by the way FTX and Celsius and their ilk are exactly the sort of black box funds-custodying middlemen that Bitcoin and crypto was designed as an alternative to! They are closer to Stripe than blockchain. So when you try to equate smart contracts on a blockchain with FTX, who is the one being disingenuous?

> And Google Chrome's new client attestation API has everyone freaking out.

I know quite a few people (many of them technically-minded and/or software developers) who don't like Google and don't like ads, and know that Chrome is just Google's way to get people to see more ads, and gain more control over the web itself.

And yet, when I suggest they switch to Firefox (or something else), they just start making excuses.

> But honestly, it freaks me out that Google might someday disable my account.

I moved my email to Fastmail over a year ago. I was able to do this easily because I used GSuite with a custom domain, so it was just a matter of updating MX records and moving my old mail.

But it doesn't have to be a huge chore even if you have an @gmail.com email address. You can register a domain, and sign up with Fastmail (or some other mail provider where you are actually the customer and not the product), and move things slowly. Set up forwarding from your GMail account to your Fastmail account. Start using the new email address for new accounts. Slowly start changing the email addresses on old accounts. You don't need to do it all at once; just maybe set aside 15 minutes a day, or maybe an hour on a weekend, and gradually change things. Focus on the important things first, like financial accounts. Eventually you'll stop getting email that you care about through the GMail address.

I'm now worried about my other Google-held data, like photos and documents. Some of them are backed up, but I still haven't made sure everything is.

> it freaks me out that Google might someday disable my account.

Any time you are utterly dependent on any provider, you are at risk. This is something I was taught about being in business, but it holds just as true for personal things.

That you are nervous about this is entirely reasonable, and you should channel that nervousness into finding a way to reduce your exposure.

You can at least download all your data from google. See this:

https://support.google.com/accounts/answer/3024190?sjid=1769...

It might take a long time, but do it. Hey, I'm going to do it right now and I don't even use google that much!

And then, one of the replies...

"They can't tell you, but trust me, if they were allowed to tell you why, you'd understand and even thank them."

Wuh?!?

People who work in anti-spam and anti-fraud are all like that. "I can't tell you how, but we're the only thing keeping civilization from collapsing."

As described in this post, they don't disable your iCloud account for fraudulent transactions. They block you from their app and media stores.

> Forget the movies you lose, if your AppleID is disabled

How does Movies Anywhere fit in here? If I buy a movie at one of {Apple, Amazon, Google, Xfinity, Microsoft, Vudu, DirecTV, Verizon} that is from a studio that participates in Movies Anywhere and then lose or close my account at the place I bought the movie, does it remain on Movies Anywhere for me?

Also holds true if you str_replace iCloud for Google

Do Apple services have an equivalent of Google's Takeout[1]? Local backups of online services that can be severed at anytime is advisable. If you're paranoid about continued access to your email - use a domain you control! Regaining access to your email address will be one mx-record update away.

1. https://takeout.google.com/

Yes indeed, I just used it yesterday.

https://privacy.apple.com

> Do Apple services have an equivalent of Google's Takeout?

Yes, it's one of the services at privacy.apple.com.

Interesting and terrifying observation. Who exactly would one go about making backups of ones iCloud data. The internet is of no help, it's all about backing up TO iCloud.

Apple has instructions [0].

Looks like there is a download link accessible via the web interface on icloud.com. But you can also set an auto-syncing folder on OSX/Windows and copy them from there using standard OS commands.

[0] https://support.apple.com/en-us/HT204055

Thanks, annoyingly it seems like there's no automated solution for photos.

Setting up a Smart Folder in MacOS may work but it’s been a long time since I’ve used them. I use rsync to backup photos to my NAS. It looks like you can use rsync on an iCloud directory.[1] I just ordered a new MacBook Pro and plan to use them method for my NAS and to iCloud.

[1] https://www.jessesquires.com/blog/2019/09/27/icloud-backup-u...

I sync photos with my google account. I realize it’s not ideal, but at least something.

You can set Photos.app to download all photos locally (on the Mac at least)

There is a Photos program Apple makes for Windows, and I think it has the same option.

There is also https://privacy.apple.com/ and "Transfer a copy of your data" (photos/videos) to Google Photos.

Plus a data export feature for the other data. That can take up to 7 days. Not exactly a backup in the traditional sense however.

>... to Google Photos.

The same exact thing can happen, and has happened, if Google disables your account.

Sure, but what's the likelihood that both your iCloud and Google accounts get disabled at the same time? Personally I would opt for something safer, like using a true backup solution, but convenience often trumps safety. Using two cloud providers with trigger-happy account termination policies is better than just one.

That's a fair point, I hadn't considered that before.

I knew someone would reply making that point. Well done.

Thanks, I appreciate your snark!

Have a great day/evening/whatever it is where you are. Genuinely.

While true, as observed elsewhere there's no reason to believe Apple restricts these things if you get banned for fraudulent transactions. The linked post doesn't make that allegation.

I'm pretty tied to Apple for lots of things, and I generally trust them (or I wouldn't be tied this way), but even I won't put myself in a position where a single vendor can utterly cripple me.

My email isn't at iCloud. It's at Fastmail.

My iCloud data -- contacts, calendars, etc -- is backed up locally.

My login to my Mac isn't run by Apple.

Regardless of how much you trust a vendor, you should never create a single point of failure, right?

I'm so worried now, I think there's a bigger problem to be solved here. Sounds like I need to use the Apple Credit Card only with my Apple ID, remove all other payment instruments and make sure my Apple Credit card isn't used anywhere else.

I've had fraudulent charges on my Apple card multiple times. They were almost always detected by Goldman Sachs. I was issued new cards (and virtual cards) immediately, and nothing happened to my Apple ID. I think there's far more to this post on Reddit than we're seeing.

Honestly, that's the sort of terror that keeps me still using GMail, but at the same time at least my email is on a domain I control, and worst case I'd just need to hard migrate to another provider while keeping the address.

From the discussion on the Reddit link this was related to financial issues and limited to app store and iTunes accounts, not all iCloud.

That's crazy, how the heck is every Apple user comfortable with that.

I wonder how many use those services. Google is the same way.

Google supports simple exports.

So does Apple... https://privacy.apple.com does full data exports

> All your emails if you use iCloud for your email, and thus potentially locking you out of any other sites that use email as a 2-factor-auth.

...but you can use iCloud Mail through regular POP3/IMAP and thus have a local copy of all your mail. (And, as far as I know, this is what Mail.app itself does, save for some push-notification optimization; am I wrong here?) There's no walled garden here. It's email.

That is why I don't use webmail I rather use Thunderbird.

Second reason I use Thunderbird (or whoever wants whatever else) is that I have 10 or 20 mail boxes like separate for shopping separate for more important stuff separate for stupid stuff.

You don't have to have a single mailbox with a single provider.

Another advantage of Thunderbird is that I already have a downloaded copy of my past emails. If I ever get locked out, I can change my MX records and start over elsewhere with minimal disruption or data loss.

If they disable your account, you're not going to get any new email. So if a website uses your email address for 2-factor-auth, then you are straight out of luck, as I'm sure they also use that email for any sort of account changes. To be clear, "don't use email for 2-factor-auth" isn't a real answer here, there are plenty of services that don't give you an option.

Additionally, you can't send email. That's also a pretty important part of the whole "email" thing. Any ongoing discussions will just be cut off.

Seems pretty walled garden-y to me, considering the entire framing of this is that nothing bad was done with said email. It was because Apple has a unilateral switch that turns everything off if anything bad happens to an associated credit card. That is to say, if your credit card number is stolen, completely outside of your control, this could happen to your email. I'm not aware of any other email service where that is the case.

Technically, you don't need an email account to send email. "telnet example.com 25; HELO there; MAIL FROM: you@example.com; RCPT TO example@example.com; DATA; ...; ." Viewing the reply is, of course, more challenging.

I don't think there exist any Mail Submission Agents well-connected to the graph of what you would think of as "email on the Internet", that allow you to send FROM an arbitrary address without SMTP AUTHing yourself as an account that maps to someone with privileges to send from that address.

You connect to the recipient's server. It's nice that iCloud Mail automates this all for you (and is allowlisted), but you don't need an email provider to send email.

Let me know when you can telnet into gmail to send mail as an unauthenticated user to another gmail user. Let alone DMARC, SPF and other modern protections. The last time I could do what you describe was more than a decade ago.

This used to be a thing, with open mail servers making it trivial to send emails to your friends masquerading as whitehouse.gov for instance.

But that's true of... any email provider, though? You'd lose access to your ISP email account if you switch ISPs, etc.

Federated email just generally sucks, insofar as email addresses are expected to stick around indefinitely, yet are almost-always associated with some service provider you might eventually no longer be a customer of (for whatever reason) and with "owning your own email providing" being nigh-impossible for deliverability reasons.

Also, people's emails to you wouldn't go into a black hole; they'd start bouncing. Which would mean that those people would realize that they should be reaching out to you some other way.

(In fact, properly-coded 2FA systems should recognize an SMTP bounce and use it as a signal to temporarily reduce the level of authentication required to reset 2FA. Things like this are why it's so hard to get 2FA right.)

No, it isn't true of any other provider, that's the whole point. If my HBO Max account detects a fraudulent charge, my completely unrelated email provider doesn't then irreversibly disable my email account and tell me to just set up a new one.

Yes, if my non-Apple email service "locks me out", then the same would happen as here. The point however is that:

1. Usually this would only happen if something weird specifically happens on that account. For example, if I am paying for an email provider and my card is declined. Notice that with the Apple case, a problem in something completely unrelated to email can cause this (including apparently the card being flagged for a fraudulent charge on some unrelated service).

2. Even then, usually the next step is I am told that that happened. Notice that in the Apple case they won't even tell you what the situation is to give you a chance to remedy it.

3. Finally, you then almost always have a way to remedy the problem. For example, by giving them a new credit card. Notice in the Apple case they insist that the account is disabled forever.

Do you see the difference? It's not in the "what happens if your email stops working" part, it's in the "what leads to your email not working anymore" and "how do you fix your email" parts.

> Notice that with the Apple case, a problem in something completely unrelated to email can cause this

Uhm, conjecture? The Reddit poster complained about app/media store lock, if they lost something more important like iCloud with photos and email that'd be a totally different story instead of "I lost some movies".

If you read the rest of the thread, its clear the entire account was locked. That's why they were told to get a new account. The expectation is not that he use one account for email and another for... new movies?

They said the issue manifested when trying to update an app. If the account was disabled, they'd get system errors saying iCloud couldn't be reached/account errors.

Second, they only ever said they asked the rep about their purchase content. Nowhere in the thread do they imply they lost anything else.

Uhm, then the rest of this subthread is conjecture? Typical HN sensationalizing/piling on. Losing bought content is bad but not like having all personal stuff locked. and nowhere the poster complained about the second.

> If my HBO Max account detects a fraudulent charge, my completely unrelated email provider doesn't then irreversibly disable my email account and tell me to just set up a new one.

Do you have any evidence Apple has done that here?

It is a natural consequence of the services being bundled together, and with Apple not telling you what the cause is. The response from the person who says they used to work at Apple is informative: https://old.reddit.com/r/applehelp/comments/15gechw/apple_ju...

Again, nobody has said they have an account that's been flagged and lost iCloud access, including the post you linked to.

Based on the OP, Apple did not provide any reason as to why the account was flagged, just that they exhibited "Fraudulent patterns". What evidence are you expecting them to provide here when the service provider is so tight-lipped?

No, I mean is there any evidence they did more than disable the account's iTunes / App Store access?

Reply on news.ycombinator.com