Google should be able to disable access to a specific service, not shutting down the whole account.

They want to be the identity of the online world, they need the responsibilities that comes with it.

When I was a kid I had a Yahoo site with some images hotlinked to another domain. The domain owner changed the images to porn, reported my Yahoo account, and it got my account entirely deleted. Emails and groups and chat and all. Really dumb

Since when has Google ever took on "the responsibilities that come with it"?

I remember a story (maybe from here?) a couple years back where someone had their gmail account blocked - and they lost google services - and they needed access to docs and other things to work with his team.. and after trying for days to get it brought back, he was essentially laid off from work as he could not participate in any of the tools that were being used by the rest of the company.

I had a time a while back when my youtube account got blocked - and then I found that googleplus had put a block on the account and it auto-blocked the youtube videos - and they said all the videos were find for youtube and no problem there - but they would not go over the heads of the googleplus team, so we were screwed.

we should have posted on many more sites your advice about "you don't own your own mailbox. When was the last time you made a backup of your GMail account? What contingency plan do you have in-place if Google ever accidentally, unintentionally, or in this case, intentionally, shuts it down?"

like how this site has recently added info about big G's censorship: https://news.ycombinator.com/item?id=21490272

most people don't know about these issues - they just assume gmail will be there, and google's search shows truth.

Or self-host. Linode VPS: $5/mo and for that I can host E-mail, a light duty web server, and other various odds and ends. I don't have to worry about some random algorithmic account suspension removing access to my E-mail (and all of my online accounts, since they use my E-mail address for verification). And I don't have to worry about some random algorithmic process determining what E-mails I receive and which ones get silently dropped into a black hole. So far no problems with misconfiguration or other providers dropping my mail--while it probably happens, I think the risk of that is overblown if you configure SPF, DKIM, and so on correctly.

We're there any good resources you used for learning how to configure SPF and DKIM?

Linode's documentation tends to be pretty good: https://www.linode.com/docs/email/postfix/configure-spf-and-...

That guide assumes you're using postfix as your MTA. For exim, their documentation can be found here: https://www.exim.org/exim-html-current/doc/html/spec_html/ch...

Distributions often have their own documentation, for Debian: https://debian-administration.org/article/718/DKIM-signing_o... and https://debian-administration.org/article/719/Avoiding_mail-...

Keep in mind this is all to increase deliverability of your outgoing mail. You may also optionally want to check SPF and DKIM on incoming mail to cut down on spam: https://debian-administration.org/article/721/Validating_SPF...

We need legislation. Google is too powerful.

Legislation to protect e-mail mailboxes as the same way we do with official postal (snail-)mail services in most countries needs to be handled very carefully, because otherwise we'll end up protecting spammers - the very opposite of the people we want to protect.

I see this story as Google's equivalent of when Valve would ban people from Steam for crude comments they made on the Steam forums, which I understand meant they forfeited their entire game library - or Amazon banning people for reviews.

If there is going to be any law or legislation - it should be to require service companies like Google, Valve and Amazon to treat the customer's "online personality account" (i.e. forum account, "community" account, etc) separately from their "value" account (i.e. whatever that which has _value_, be it their Steam library, their GMail mailbox, etc) - or at the very least, companies must be required to export 100% of the data in an account and providing that to the customer/user in the event they shut down an account (with reasonable constraints, such as the account having existed for at least 3 months and having been in good-standing until this specific incident, etc).

And under no circumstances should anyone lose their software copyright licenses for violating a community ToS - feel free to ban them from the forums, et cetera, but being banned from the Steam forums must not mean they lose the right to play the copy of Half-Life 2 that they paid for.

Nit: Valve just banned them from forums, not Steam. They already do what you're proposing.

Got a link? I remember reading that people were banned from their Steam accounts entirely without any refunds and they had to resort to CC chargebacks.

No link, but I got a personal anecdote.

I found a persistent XSS vulnerability on steamcommunity.com once upon a time. It used to be if you were playing a mod, the name of the mod could be shown in activity graphs and screenshot views. This was not sanitized whatsoever.

After 4 weeks of no response from their official email contact, I posted it on the (then entirely detached vBulletin based) Steam forums, with a notice I had disclosed the issue to all known to me @valvesoftware.com email addresses (including security@, which didn't bounce)

I had my account disabled, and spent 3 weeks emailing them asking what the fuck that was all about. It got re-enabled silently.

Well, fairly simple to solve; mail services should be able to restrict sending mail (possibly only to family contact, limit of 25 contacts or so) until the matter is handled, ie temporarily if it's not blatant abuse of the service (ie spam). Otherwise, receiving mail should be a right once you have a mail address at a larger provider.

Why isn't "use a different email provider" an option? Why do we need laws to enforce good customer service?

For a large part of the population, losing their email account could be devastating. "Could" is deliberate, because once you lose it you wouldn't even know whether anything important landed in your inbox. Like a personal update from a friend, or some official business you need to respond to within days. Can you imagine trying to remember every single friend, business and government agency which might conceivably contact you, and figuring out how to contact each of them to let them know of your new email, plus getting them to re-send anything since you were blocked? It could put a wrench into someone's life for days or weeks.

I understand the problems losing access to your email can cause, in fact, I have experienced this exact problem several years ago. It took me 3 weeks to recover my email, and after that experience I switched from gmail to protonmail.

Most people won’t switch until something like this happens to them. We shouldn’t go, “just switch!” because it won’t work. And we definitely shouldn’t go, “screw you if you didn’t switch because you didn’t listen”

Yeah, the reason most people don't switch is because it doesn't happen to most people, ever. If you don't like a company's service you switch to a different one, that's how capitalism works, especially services you pay nothing to use.

More importantly, pay for your own email DOMAIN.

And keep backups of your email.

Then, even if your account gets shut down, you can get up and running elsewhere quickly.

Be careful:

By hosting your main email on a custom domain(not a provider) you open a new attack vector for identity theft.

Someone can hijack your godaddy/namecheap/gandi account and point the MX DNS records of the domain to their own server and receive all your "Forgot your password? here is the link to reset!" emails

This a very bad advice unless you actually know what are the risks.

Is there a good way to protect against this aside from good password hygiene at your domain registrar?

I use namecheap if that is relevant--maybe there's a better/more secure registrar to move to.

But I guess, equivalently, someone can just equivalently hijack your email account directly if you use a service like Gmail or Yahoo.

I think namecheap does not have a bad reputation, godaddy is known to be bad though(both security and customer support).

The thing is, of course people can hack your gmail or yahoo mail somehow, but when you host your own domain, you have the same attack vectors + dns hijacking and this last addition is easier to exploit with social engineering. Google atleast is virtually immune to DNS hijacking.

Just the usual advice, I would think: Strong, unique password, and enable 2FA.

It may helps if the sender send you password-reset email in encrypted format

How is that any different than someone hijacking your mail account directly? I mean, yes, now there are 2 things to secure, but it doesn't seem like very much added attack surface.

No only that but, by doing so, they're effectively taking away any remaining semblance of proof that you weren't spamming.

Worth noting: I'm not sure about Microsoft's procedures for shutting down an account the way Google did here, but they document what happens if you stop paying for it: https://docs.microsoft.com/en-us/office365/admin/subscriptio...

Basically it goes through Expired, Disabled, Deprovisioned. During Expired users have access, Disabled only Admins have access, Deprovisioned is gone. Those are usually 30/90 days but it varies by how you purchased.

Not sure about Personal/Home, but I suspect it's similar.

Yeah.. True that. I lost access to paid email account due to problem coming up with funds for paying this year's fee. Was not a fun 2-3 weeks.

I am with you but I think protocols and apps that are designed to allow users to own and host content on primarily their own device would be great.

For mail, what if email was always delivered to device for free and you pay a service provider to mirror it so that while your account is active,they provide backup,spam filtering and content search on their servers?

I would also recommend never storing mission-critical stuff only in your email. Losing the contents of your inbox should be the least of your concerns if there’s a chance you might lose access to your account. There are far worse repercussions - e.g. a) how do you update everyone else's record of your email address? b) how many services have you locked yourself out of, or made doing so much more likely?

It makes owning your email address (including the domain name part) crucial.

It's time people separated the hosting of email from the interface (the address).

I think most people just don't realize how easy this is and you can even keep using gmail.

Most domain registrars have free email forwarding so you can forward *@domain.com to your gmail. This by itself is already good enough for signing up for things or resetting passwords.

If you also need to send from that domain in gmail there's just a few more steps: https://support.google.com/domains/answer/9437157?hl=en

Unfortunately it is no longer free to use a custom address in gmail; it used to be that just owning a domain would do the trick.