Hacker News Reader

Comment by tolmasky | Hacker News Reader

If they disable your account, you're not going to get any new email. So if a website uses your email address for 2-factor-auth, then you are straight out of luck, as I'm sure they also use that email for any sort of account changes. To be clear, "don't use email for 2-factor-auth" isn't a real answer here, there are plenty of services that don't give you an option.

Additionally, you can't send email. That's also a pretty important part of the whole "email" thing. Any ongoing discussions will just be cut off.

Seems pretty walled garden-y to me, considering the entire framing of this is that nothing bad was done with said email. It was because Apple has a unilateral switch that turns everything off if anything bad happens to an associated credit card. That is to say, if your credit card number is stolen, completely outside of your control, this could happen to your email. I'm not aware of any other email service where that is the case.

View on HN

But that's true of... any email provider, though? You'd lose access to your ISP email account if you switch ISPs, etc.

Federated email just generally sucks, insofar as email addresses are expected to stick around indefinitely, yet are almost-always associated with some service provider you might eventually no longer be a customer of (for whatever reason) and with "owning your own email providing" being nigh-impossible for deliverability reasons.

Also, people's emails to you wouldn't go into a black hole; they'd start bouncing. Which would mean that those people would realize that they should be reaching out to you some other way.

(In fact, properly-coded 2FA systems should recognize an SMTP bounce and use it as a signal to temporarily reduce the level of authentication required to reset 2FA. Things like this are why it's so hard to get 2FA right.)

No, it isn't true of any other provider, that's the whole point. If my HBO Max account detects a fraudulent charge, my completely unrelated email provider doesn't then irreversibly disable my email account and tell me to just set up a new one.

Yes, if my non-Apple email service "locks me out", then the same would happen as here. The point however is that:

1. Usually this would only happen if something weird specifically happens on that account. For example, if I am paying for an email provider and my card is declined. Notice that with the Apple case, a problem in something completely unrelated to email can cause this (including apparently the card being flagged for a fraudulent charge on some unrelated service).

2. Even then, usually the next step is I am told that that happened. Notice that in the Apple case they won't even tell you what the situation is to give you a chance to remedy it.

3. Finally, you then almost always have a way to remedy the problem. For example, by giving them a new credit card. Notice in the Apple case they insist that the account is disabled forever.

Do you see the difference? It's not in the "what happens if your email stops working" part, it's in the "what leads to your email not working anymore" and "how do you fix your email" parts.

> Notice that with the Apple case, a problem in something completely unrelated to email can cause this

Uhm, conjecture? The Reddit poster complained about app/media store lock, if they lost something more important like iCloud with photos and email that'd be a totally different story instead of "I lost some movies".

If you read the rest of the thread, its clear the entire account was locked. That's why they were told to get a new account. The expectation is not that he use one account for email and another for... new movies?

They said the issue manifested when trying to update an app. If the account was disabled, they'd get system errors saying iCloud couldn't be reached/account errors.

Second, they only ever said they asked the rep about their purchase content. Nowhere in the thread do they imply they lost anything else.

Uhm, then the rest of this subthread is conjecture? Typical HN sensationalizing/piling on. Losing bought content is bad but not like having all personal stuff locked. and nowhere the poster complained about the second.

> If my HBO Max account detects a fraudulent charge, my completely unrelated email provider doesn't then irreversibly disable my email account and tell me to just set up a new one.

Do you have any evidence Apple has done that here?

It is a natural consequence of the services being bundled together, and with Apple not telling you what the cause is. The response from the person who says they used to work at Apple is informative: https://old.reddit.com/r/applehelp/comments/15gechw/apple_ju...

Again, nobody has said they have an account that's been flagged and lost iCloud access, including the post you linked to.

Based on the OP, Apple did not provide any reason as to why the account was flagged, just that they exhibited "Fraudulent patterns". What evidence are you expecting them to provide here when the service provider is so tight-lipped?

No, I mean is there any evidence they did more than disable the account's iTunes / App Store access?

Technically, you don't need an email account to send email. "telnet example.com 25; HELO there; MAIL FROM: you@example.com; RCPT TO example@example.com; DATA; ...; ." Viewing the reply is, of course, more challenging.

I don't think there exist any Mail Submission Agents well-connected to the graph of what you would think of as "email on the Internet", that allow you to send FROM an arbitrary address without SMTP AUTHing yourself as an account that maps to someone with privileges to send from that address.

You connect to the recipient's server. It's nice that iCloud Mail automates this all for you (and is allowlisted), but you don't need an email provider to send email.

Let me know when you can telnet into gmail to send mail as an unauthenticated user to another gmail user. Let alone DMARC, SPF and other modern protections. The last time I could do what you describe was more than a decade ago.

This used to be a thing, with open mail servers making it trivial to send emails to your friends masquerading as whitehouse.gov for instance.

Reply on news.ycombinator.com