Keep in mind, this is the same public IP address that we've had for ages. I am the recovery contact for the account since she is a minor, and have filled out the forms several times now, even giving the exact date and the "verification code" from when the account was created. We are now stuck in an endless loop.
She can still access her account from a macbook and from a linux desktop, but I fear once she is signed out that she will be locked out forever.
All of my important stuff (finance, etc) is in protonmail now, and I'm happy that I made that move.
If you can, your own domain backed by a fastmail or a proton is the sweet spot of easy and flexible, or at least an @fastmail, @proton or similar. With payment comes the possibility of human support, which I have received easily from fastmail.
So, now I’m in a situation where, if my gmail account gets banned, and the DNS provider decides to reset my password, then I’m permanently locked out of everything. I could point my DNS provider at my “real” email address, but that’s even worse, since needing to update the MX record could lock me out.
Does anyone have any creative solutions to this problem?
This doesn’t solve the “everything is in one basket” issue, but you don’t hear stories of these email providers just “closing” an account and causing immense trouble for the person, at least in part because they have actual support.
What do you mean "ground it out"?
As a consumer, I suspect hosting a "holding" domain, and possibly email, with AWS Route53 DNS might be a sensible approach that wouldn't break the bank. AWS has policies on account and password recovery that even include a notarised affidavit.
It might help to further separate your AWS account from the Amazon account you use to shop with, since there's a chance Amazon might be trigger-happy with banning if you violate one of their shopping policies with too many returns.
This is what I do.
Totally isolated AWS account that owns `my-account-recovery.com` in my country-code TLD (because I have legal rights and strong and easy access to appeals processes with that, so unlikely the domain could be wrestled from me and likely I could eventually regain ownership if lost).
I use Amazon SES for incoming email to simply drop all incoming messages as objects in a S3 bucket.
I have SNS notifications going out to my regular operational email whenever a new message comes in with the metadata (sender, subject, etc but not the body as that could contain actual reset/account recovery links) so I can keep an eye on what's coming in.
Haven't looked at my bills lately, but including domain renewal and stuff this is maybe $100/yr to establish this as a root of trust/access. Even if other accounts are breached/suspended/etc, I will still have access to this account and can recover my way down from there.
I'm putting all my eggs into the AWS basket here, but I've had a good experience with them in the past and I really can't find any examples of people being locked out of their accounts in the same way I can with Google. And I know from experience that it's not impossible to get in contact with a real live person when it's required to resolve an issue.
https://support.google.com/accounts/answer/3024190?hl=en
Edit: Looks like Google Takeout lets you schedule the download (ie once every month)
If takeouts could be configured to download automatically through Google drive, that would be amazing.
They can. And Dropbox, and various other cloud providers.
Public utilities are highly regulated, and do not have the right to interrupt your service.
Why do they do this? Did you contact them about it? I would say it seems, at face value, that your city's utilities company did not serve you while Protonmail did.
That's fair- that's a better way of saying it. Every time I've had to email them (which admittedly has only been a handful of times) with proof of something, I always end up calling them up and they'll say "but protonmail isn't on the blacklist that IT posted, so you're lying or you sent it to the wrong place," then I'll send screenshots from a different email provider proving that I sent the protonmail email(s) to the right place, then they'll say "oh, I promise to talk to IT to get this straightened out."
It's pretty obnoxious.
1. You can't search message content. gmail is very good at this, so I've had to become more organized to make sure that I can find a particular message in protonmail.
2. Notifications on mobile do not clear if I've read the message on another device. I have to open up the app and sync to stop them from popping up with outdated information.
3. I wish that there was a way to mark a message as archived and read from the mobile notification.
Other than that, I can't complain.
(They do have Protonmail Bridge now, but it doesn't work great for alternate mobile clients unless they've changed it)
edit: Family Link is also for android devices and chromebooks. She doesn't have a phone / android device or a chomebook.
Long story but fairly serious legal issues issues with their mother making false claims of care/activities etc and needed things like calander and location tracking services and this was just by far the easies way at the time. For safety reasons I put a forward to my gmail of all their incoming emails, once again best known option at the time.
I sense a problem possibly looming, but not seeing that coming clean and engaging with Google likely to be a happy experience.
Anyone got any advice, other than abandon current accounts?
Cue the "businesses can choose who they do business with!" and "if you don't like it, build your own!" people.
We signed up for many of those things individually and they've connected them more and more. Now we have a single point of failure that can take down everything across all your sytems.
And it's not just those. Don't forget about Google Voice, Android, and every service where you used "sign in with Google"
This is a problem with one sided none negotiable terms of service being considered valid contracts under the law
They should not be.
We need to change data ownership laws, and force companies to do vetting on Account Creation, and put in provisions on how accounts can be terminated once a company accepts a user owned data. i.e Accounts must have a human reviewed appeal process, with full and articulated reporting as to exactly which rules were violated, and exactly what activity was the violation. And have a View Only data Take-Out period
At a minimum
Are they even valid contracts now? Many gmail accounts are missing consideration or capacity -- which are required elements of a valid contract.
eCommerce and ad supported businesses that want to avoid Google are screwed though.
Perhaps there's some authoritative site about what exactly you need to do?
For me, that started with email. Email is a root for a lot of your digital identity.
I can't guarantee access to @gmail addresses going forward, but I can at least _start_ fixing that problem. I picked up a new domain, hosted the email with someone else, and set all my other accounts to forward to it. I updated a few really critical things right away, but for the most part it's just as I go log into various accounts with the old email address, I update it.
I didn't really bother trying to migrate the email out of my gmail account. Instead I did a bulk download from Google Takeout so I know I _can_ access that old email if I really need to find something.
Six months or so in, the bulk of my identity is now tied to a domain that _I_ own, and email hosted with someone I can trust more than Google.
It's not perfect, but already the impact if Google were to suspend my account has dropped immensely.
Cutting Google completely is something you do on principle. Instead, just look at what the impact of losing access to various services would be and address those specifically. (E.g., losing drive? Switch to NextCloud if availability is a concern; or set up a regular Takeout download if data loss only is a concern but an interruption in availability is okay, etc)
It's like pulling teeth to work with that interface to edit documents. It's hard for me to believe that anyone actually uses it.
In that case, depending what your actual acceptable risk/goal is... continue using Google Docs and set up a regular backup? Your worst case is that Google Docs goes away tomorrow, and you still have all your data you just need to spend a bit of time restoring to a different account / setting up alternative software / etc and move forward from there. For most people I expect that's more than enough.
If nothing else you should set up your own email address, even if it is just a simple forward to your gmail. Google blocking access to your mailbox would be pretty bad, having control of your MX record gives you an out.
For me, I've switched to DDG full-time for search and I'm veeery gradually swapping over to Protonmail for email (using Thunderbird as the client to ease the transition). Once email's over, I'll be able to rest a lot easier.
However, if you're a heavy Docs user, NextCloud is a Google-like suite with a few hosting options (self-hosted, third-party host, or enterprise).
The principle options are:
- Integrated replacement services. Don't do this.
- Multiple independent free services. At least you've diversified risk. Mind that these may (and likely will) consolidate with time. Skype, WebMeeting, Instagram, YouTube, GitHub, and Blogger were once freestanding companies. They no longer are.
- Self-hosted solutions. NextCloud, FreedomBox, etc., or DIY service bundles on your home, office, and/or a hosted service can avoid the problem entirely at least for highly stateful services (email, contacts, files, documents)
https://duckduckgo.com/?q=google+alternatives
It doesn't need to be (and shouldn't be). Just use an email provider that respects you as a customer and don't put all your eggs into one corporate basket (especially not one that treats you as nothing more than data cattle). Horror stories like this one will, over time, educate people that this behavior pattern is dangerous.
IMO self-hosting is the ideal because that aligns responsibility with incentive (and it can be done extremely cheaply), but if not, there are paid email services that actually treat the user as a customer.
Normal people will only put up with this for so long. Either regulate it intelligently now, or expect actually scary regulation a decade or two from now.
There's nothing wrong with a law that says: "You cannot close a customer's account with no remediation, no recourse, and no explanation." What is Silicon Valley so afraid of there? How is that unreasonable?
>This victim-blaming needs to stop before the tech industry backlash hits. This is exactly why we need regulation.
Google will simply dilute the language of the regulation, to the point where they will simply add a "your account can be deleted at any time for any reason, proceed at your own risk" popup during sign-up, and people will happily hit continue/next.
Systemic reform can't exclusively happen top-down or bottom-up. There needs to be some of both. We need to stop giving Google free good-will on HN. Stop up-voting Google product launches, stop promoting Chrome, etc, etc.
After all, 15 years ago we still thought Google was "not evil". A lot can change in that time.
Agreed. Then they will learn that Google is not to be trusted with email and move to a provider that is (sort of like how kids migrated away from Facebook when their parents showed up, even though Facebook remains a dominant brand). Disruption occurs when an incumbent is bad at something which the disruptor beats them at. In this case, there is an opportunity for an email provider to disrupt Google by providing actual customer service. Protonmail is already making waves in this space (in addition to the encryption).
The reason I'm anti-regulation is that every law is a headache waiting to happen (and one more barrier to entry) where to me -the- beauty of the internet is that there's almost no barrier to entry once you have an internet-capable device. The more we regulate the internet, the more difficult doing something as simple as running a personal discussion forum becomes. Regulation is, at its best, a necessary evil, to be avoided until no other solution has proven viable. And there are plenty of other solutions for this particular problem.
And to clarify, I'm anti-Silicon Valley (IMO venture capital's expectation of high returns is the direct cause of many of the "evils of tech"). But I do tend to agree with the anti-regulation stance. IMO the problems people want to solve with regulation (even including GDPR) are better solved by better tech and organizations that align their incentives with those of their users.
Sure, they have the right to cut off users any time they like. But it's ultimately self-destructive. Once trust is lost, it's difficult to regain it. I've moved away from my Google dependencies as much as I can, and have urged friends and family to do so as well. I'm only influential with around two dozen people, but once you start multiplying people like me by the millions, then Google has a problem.
And I'd argue it's at least a little immoral. Their services, especially Gmail, were set up in a way to make users highly dependent upon them. Google wanted that dependency for their path to near-monopoly status. To suddenly cut them off without the option of support or a clean exit creates real world chaos as the users try to pick up the pieces. Your email address might not be used much socially these days, but it's crucial for business contacts. For logins and customer interactions. The loss of it can cause serious damage. Google may not be legally responsible for the damage caused by a user's loss of their free services, but they're arguably morally responsible. Maybe they should pop up a warning to everyone using Gmail: "Don't rely on us. We're not going to do anything to help you if you can't use it one day."
Or more precisely: Why do you think any outsider could understand Google's rational?
History is littered with the corpses of successful companies that lost their way.
Today's Google reminds me of General Motors. Utterly dominant, untouchable. But needed to keep making more money. So they bring auto loan financing in house, GMAC. Woot, more money. But they forgot how to make money making cars. So upstarts ate their lunch.
It's a rough analog. Maybe IBM is closer.
The point is Google's rolling in cash despite their antipathy towards their end users (note that I did not say "customers"). Which will continue to be fine, until it isn't. And then it'll be too late.
What? You don't pay paxes in your country? No rent to the owner of your house or paid for owning the house yourself? What country is that?
You want a mail-address? Grab your own domain (thus pay "tax"), put a server there (build a "house") and you are there. Getting an address, be it physical or digital never comes for free, and there is not human right for having one.
However, that doesn't change the fact that the economic model has changed when it comes to email. We no longer pay with money, but we pay in other ways when we use Google. So it's actually worse than with mail, because there used to be a clear exchange of goods but it is now obfuscated. And thus, there is nothing mandating good service, which is why people can be randomly banned from using it.
A contract without consideration is not a valid contract. There are a few laws in some places that require companies to provide service outside of a contractual service agreement, but those are typically limited to public utilities, emergency services, etc.
They do. But does their ToS say that your data and attention is consideration for use of their services? I do not believe it does. In fact, it says:
> You have no obligation to provide any content to our services
Throughout their terms, I don't see anything that implies an obligation of exchange.
There are certainly other rights that exist... But contractual rights to a service is not a right you'd have without a valid contract.
You can sue your caterer if they run out of food, but not the soup kitchen.
I say “steal”, because they are not opt-in.
Also, there is no comprehensive opt-out. I cannot tell their ad networks to stop tracking all the devices I own.
(They have a page for stopping tracking of things I use my Google account for. That doesn’t count: They track me even when I am not logged into Google, and even on devices that cannot log into Google.)
Also, I can’t delete my gmail accounts. They were issued by third parties that decided to outsource email to Google.
There is nothing consensual about my use of Google services. I shouldn’t be bound by their EULA. I’m sure the courts would disagree.
In google's view if I accept the terms google will treat me as a customer internally and using that relationship will sell my data.
Is google not in a legal position to do this?
The acceptance of the terms creates a customer relationship
Everyone pays with their data and the ads they and others are seeing. Just because you pay no cash, does not mean ther is no payment at all.
Addtionally, it's used to be quite hard to even pay in cash for googles services. Though, this changde in the last years, as there is now youtube premium and google one. But still not possible for all their services.
It is like building a house on the edge of a cliff then falling off the cliff one day. It was always a real possibility. Being locked out of your stuff is quite a likely end of the story with Google.
I bought 3 Nest thermostats long before Google bought them. I wouldn’t have done so after the buyout.
If google bricks my thermostats because my kid does something dumb on YouTube (through the linked tv accounts) that will suck.
I suppose regulators could also prevent companies from bundling lockouts in that shutting down gmail for YouTube problems. Or shutting down Nest for gmail problems, etc.
The phone company can’t just randomly cut off service and ghost me. Regulators are the reason for that, as I’m sure they’d love to if they could.
So indeed, buying open API stuff only is a good start, unfortunately one still needs to be vigilant.
>You need a government regulator to stop large companies from buying up lots of small companies and adding them to this risk pool.
These two statements are not even close to arguing the same thing.
The previous commenter is saying that it's common sense that "centralizing all your data with Google" may not be a great idea, especially if you don't have any backup of that data and keep all of it in Google.
They are being downvoted, wrongly, by people who knee-jerk about the "don't need a government regulator" bit. But they only used that phrase as a kind illustration of the common sense that people should have about not having a backup of their data.
Yes, Google does need some government regulation. And yes, people shouldn't need a government regulator to tell them not to keep all their data in the cloud without any local backup at all.
If you're paying your bill, why would they care?
Regulation is part of the answer, but it's also part of the problem. If a YouTube comment wasn't at risk of "being mean" or breaking arbitrary rules (pushed by regulators, Google isn't doing it on their own), you couldn't be locked out. Corporations don't gain by cancelling their customers.
Sure they do. If a certain customer's behaviour is alienating or obstructing other customers, then that customer gets cancelled, because they are having a negative impact (on the business - not the users!) that is larger than the benefit they provide.
That's a net positive result.
Ignoring your whole concept of "mean", it is 100% up to the company to decide what the negative behaviour is, which is part of the problem.
Sure some of it might be "mean behaviour" and so we look at it as Google doing a good thing perhaps.
But what if you went around Google's services and informed people of better alternatives to their services, and you started to actual gain traction and cause people to stop using Google?
There's nothing mean about that, in fact you're providing a good service to those people. But in Google's eyes your actions are negative, and they could just cancel your account at their discretion because they don't like what you're saying.
That is the kind of thing that regulation protects from, when dealing with essential services - and I think there's a stronger and stronger case to be made that these large providers are in fact essential services.
p.s. Devil's advocate: the theoretical actions I described above (recommending alternatives) could so easily cross the line into spam. But who decides where that line is, if Google was to be regulated?
This is not a random cancellation.
There is zero incentive for your phone company to cancel an account in good standing otherwise.
The OP said "they'd love to [cancel my account] if they could". Why would a phone company "love" to cancel accounts?
To address your point too though, there are definitely customers that the phone company is required to serve that they would rather not serve, because the costs are higher than the revenue.
Remote rural customers, customers who need accessibility-related support, certain outdated services that people are grandfathered into and don't want to cancel, etc...
And again that's where regulation protects the customer from the corporation that doesn't care about the customer's needs, unless they align with their own needs or are forced to via regulation.
Personal experience, once I created an Adword ad using one of the image that Google Ad creator had suggested. It was nothing, just a woman in bikini. It was approved and then rejected with warning that I violated their guidelines. I wanted protest but thought probably not worth it. This could have perma banned me from Google, I stopped using AdWords.
Do you think Google really cares about this, or do they get pressure from "outside" forces to impose such rules?
I seriously doubt Google cares one wink about people posting bikini photos. These rules exist because activists put pressure on the company to enforce such rules, for better or worse.
They could decide to randomly throw every 5th email that is not a gmail into spam and blame it on other providers having low reliability. Make it random enough to gently encourage you to get a gmail account again.
These are extreme examples, but Google could easily do these kinds of things and there is nothing any of us could do whether we use Gmail or not; it will affect us because they control so much.
How would that kill gmail? It's not like they're going to lose any real part of their user base. Short of a press release from google confirming the behavior, the average user is not going to go through the hassle of finding a replacement provider and then changing every email address associated with every service they use (if it's even possible for the service) all for some nebulous and impossible-to-confirm conspiracy theory put forth by tech experts and security experts that don't get listened to even when there is proof. And it's not like other companies and services would take a stand by ceasing to offer service to customers with gmail accounts- that's an incredible way to lose a vast portion of your customer base.
I wish it weren't this way, but I just can't see that bringing down gmail. Especially not when every google service requires a gmail account- probably the same one most people have had for years.
They can't afford to let 20% of that go to spam without a backlash. And if they kept doing it despite the backlash, who knows what would have happened to gmail.
Lose a few thousand dollars or an entire vacation by google regularly blackholing messages from important and expensive services like airlines, when they send you email telling you your flight departure was changed, and you'll be looking for a better email service in no time.
Now imagine this happens to 1/5 of the customers of said airline, just because of google's 1/5 non-google mail go to spam policy. It would be a scandal.
They will launch a 'secured sender' program where you pay Google a monthly fee so your company's email doesn't fall into spam.
It hasn't kill gmail. How could it unless other providers refused to route gmail emails the way google refuses to route your personal server's email.
The scenario you describe does not seem so unlikely to occur...
The issue seems to me that it's a global ban.
If Google only locked you out of the functionality you seem to have violated somehow, it would still be a viable strategy to use their services.
Imagine losing the ability to comment or upload videos on YouTube because you wrote something offensive or published a video with copyrighted materials.
Potentially bad for YouTube creators, but definitely not dangerous for normal users which also use other services.
Reports like this were the reason why I removed almost all Google services from my life a few years ago, but I wouldn't have done it if the bans had been granular.
Global bans "seem" to be new. I've read many stories of shell scripts randomly permanently banning android developers for life from their platform, but those stories always involved being banned from the play console and so forth, not being banned from search / maps / gmail / youtube / etc.
It seems to be news that if you tell people in public youtube comments that you vote for Trump, or whatever it is they're enforcing today, google will fight back by disabling your thermostat or whatever.
Global bans are not new. They were standard a decade ago. The reason is due to the structure of the various spam/abuse industries that plague any service that allows user generated content. What happens is this:
1. Accounts get harder to create as signup security improves
2. Black/grey-market account sellers come in and start creating accounts that get bought by spammers/fraudsters.
3. Spammer/fraudster abuses an account on service X, it gets locked for service X. They sell the accounts _back_ to the seller, who then resells the account once again with a note that it can't be used for YouTube or whatever.
4. Different spammer/fraudster buys the account, abuses it on a different service, goto step 3.
Their systems have some notion of why accounts were suspended or blocked, and the tech does support individual service level blocks. But they weren't used much back then because the pattern of a user being bad on one service and then being bad on every other service was too strong.
The problem of false positives was well known a long time ago, and the noise:FP rate is very good - if a script accidentally disabled good users with even quite low volume the people in question would be on Twitter or HN within hours making articles like this one, which did get noticed. So false account blocks were pretty rare.
Back then and still now, I think Google need to make it easier to handle this situation. Strong end-user support in these situations is hard because genuine fraudsters will happily file support tickets and socially engineer support to get their accounts back - I even witnessed auto-generated pleas to support once. They were quite convincing individually, only when you saw a few thousand of them with re-arranged sentences all begging for help with identical language was it clear they were spam. However they could still make it a lot easier, and in particular, could improve Google Takeout to be easier to use (e.g. automatically uploading the backups to various non-Google services).
Why are accounts suspected of TOS violations not simply put into read-only mode instead of shutting out users completely? If the identity/authorisation of the user is not in doubt it makes zero sense to not let people download their data before closing the account.
This simple change would fix all the consumer related horror stories with zero cost to Google. In fact it would become cheaper for Google because people would stop pleading with them.
Also, why is there no one-off paid support option that covers the cost of a human checking evidence and is expensive enough to deter mass abuse by fraudsters? Why is there no option to provide a photo ID upfront so that there is always a last resort to check whether a user is who they say they are?
Read only mode would make sense for content that's truly private, or which can be made private. Nothing stops them allowing Google Takeout for disabled accounts, heck maybe they do these days.
Paid support:
1. the optics of false positives being held to ransom to get their account back is terrible. Giving the money back isn't always easy (credit cards support this sometimes but many users don't have them). And this is made worse by:
2. many accounts aren't easily verifiable. People imagine that every Google/FB user puts their entire life on these accounts. A very small number do. For those, expensive ad-hoc processes could maybe increase the account verification rate by a little bit. But most accounts that get disabled are accounts with fake names, that use exclusively one service, etc. It's extraordinarily difficult to come up with reliable ways to verify the identity of the holder of accounts that required no identity to sign up.
Right, but removing an offending comment can easily be done indepenently of any other action against the account.
>the optics of false positives being held to ransom to get their account back is terrible.
That's true and I had that thought as well, but it's clearly the lesser evil compared to stories of people losing irreplaceable data.
>many accounts aren't easily verifiable.
True, but as I said, users could be given an option to make their account easily verifiable.
How much are accounts currently worth on the market? It seems that making the recovery procedure more expensive than the worth of the account should resolve that issue. At the same time legitimate users are probably willing to invest some money in order to recover their account.
For example offer a $20 option to send a registered letter to an address provided by the user. Then Google can check if: 1) The name on the credit card matches the name on the account, 2) a given address hasn't been used too often, 3) the identity check done by the postal service (checking if the recipient actually has a given name) succeeded.
This won't be a perfect solution and there are definitely edge cases for which it won't work (in countries without registered mail, if someone doesn't have a credit card, etc.). But it should be able to cover the majority of cases where legitimate accounts have been locked.
However that's basically what phone verification does. In case of suspicion someone has to provide their mobile phone number. It's texted with a code and a counter increased. The same number can't be used over and over. Unlike credit cards, the assumption of universal mobile phone access (amongst people who have internet access) is very strong. It works very well. In this case, the account was shut down without this being possible, which is only used normally for very clear cut cases. Don't assume the full story is public.
This is a problem that is largely solved at government scale, which is what Google is now, and there's no reason not to take advantage of existing infrastructure to do so.
My point is there are limits that what private companies can do. Stretching the boundaries like that is sure to cause a strong regulatory reaction at some point.
And we are free to complain and vote to change those rules. Guess what happens then?
I do love these sorts of arguments. There is a modern expression that goes "f* around and find out". Like Standard Oil did.
https://www.britannica.com/event/Sherman-Antitrust-Act
When you have governments using Google logins or schools communicating with parents via Facebook groups, or state broadcasters reporting on Twitter as news, then the line between private company and public utility has been crossed.
The worst is that they are certainly keeping your data, because they never throw anything out, while they are preventing you from getting to it.
That is theft, pure and simple.
If there were a definition for "set up to fail" it would be that customer... Or are we to assume google is a potentially hostile force, whenever it feels like being one.
We used to ban the sales of products that harmed customers.
What do you expect your average person to do? Set up their own mail provider?
A tiny number of companies set out to have an unbreakable joint monopoly over the Internet, and succeeded. Now you're blaming the average person for this - like the average person has the skills or the time to do anything about it.
Google photos also 'helpfully' offers to delete your uploaded photos with 'some guarantee'!!!
If this isn't an indication of a giant shitty monopoly that doesn't care about its customers at all, I don't what is.
They have some AI ML fucking crap but can't figure basic user trust because that won't get anyone promoted nor grow some Director-level person's headcount.
Large promo-manufacturing teams that casually handle all your data. Pray to God that some L4 didn't get promoted doing some impactful work because they sure ain't gonna do maintenance work protecting your shit. Their motivations are not users, product nor team: manipulate some metrics to get promoted and move out. Horrible.