News for hackers. Stuff that matters.
Re:Don't use third party auth to sign in by DaiPlusPlus on Saturday November 14, 2020 @06:26AM (#25091607)
Yeah but they’ve still got your emails.
Re:Don't use third party auth to sign in by signal11 on Saturday November 14, 2020 @07:10AM (#25091842)
There are alternatives to GSuite -- for instance, Fastmail. Or even the old PObox.com service which has been around since the 90s and is really cheap (Fastmail have bought it now, I notice).
Re:Don't use third party auth to sign in by snorremd on Saturday November 14, 2020 @07:34AM (#25091932)
Fastmail is very good. The web client is pretty simple, but feels so darned responsive (as in fast) compared to what I was used to from GMail. And spam is so far a non-issue.
Re:Don't use third party auth to sign in by ryandrake on Saturday November 14, 2020 @11:52AM (#25093492)
Or, host your own on your own metal, to avoid depending on any third party. Alternatively, if you are ok with semi-dependence on a third party, get a $5/mo Linux VPS, and host your E-mail there.

With your own Linux instance, you can host whatever you want, have full control, can host other services too like www, git, whatever, and have the assurance that you're not going to suddenly lose access because AI-BOT-204432 decided you violated some obscure terms of service. I've been doing this for close to a decade now (exim + dovecot for E-mail), and it works great. Back in the 90's, this used to be the default. How did we end up in this world where we so utterly rely on 3rd parties for such everyday critical Internet services?

Re:Don't use third party auth to sign in by wool_gather on Saturday November 14, 2020 @12:15PM (#25093694)
> How did we end up in this world where we so utterly rely on 3rd parties for such everyday critical Internet services?

The same way we ended up in a world where we so utterly rely on 3rd parties for such everyday critical services as growing our food and fixing our cars. There's too many things to do for everyone to do them all on their own.

Re:Don't use third party auth to sign in by bsder on Saturday November 14, 2020 @08:09PM (#25097154)
> How did we end up in this world where we so utterly rely on 3rd parties for such everyday critical Internet services?

For email? Because Google and Microsoft broke SMTP federation in the name of "anti-spam".

It's practically impossible to get Google, especially, to reliably deliver your email anymore if you aren't an actual email service provider.

Re:Don't use third party auth to sign in by MaxBarraclough on Saturday November 14, 2020 @07:28AM (#25091900)
Also, many registrars offer a managed email service.
Re:Don't use third party auth to sign in by sdwolfz on Saturday November 14, 2020 @06:40AM (#25091692)
Well, at least you don't lose everything. Worst case you lose access to a few emails you got in the time between begin locked out of your Google account and when you set up another email provider, and assuming you configured IMAP and use something like Thunderbird or K-9 as an email client (which I highly recommend) you should have a copy of all your email on your device (seriously don't use the Gmail app on Android, they even display ads in your email categories.

I like GMail for their spam filtering power, and I honestly believe spam to be email's biggest weakness, and the reason people don't host their own. It certainly scares me, the thought of being flooded with thousands of spam emails daily, or the chance that my own emails would be falsely marked as spam since I'm not part of the major providers or because I did not configure it correctly. Don't know how this can be solved though, email itself is too permissive, and too "tweakable".

Re:Don't use third party auth to sign in by 0-_-0 on Saturday November 14, 2020 @06:28AM (#25091616)
For that you have this:

https://takeout.google.com/

You can export all your email in a single .mbox file.

This might not work if your account is suspended, but if you set up email forwarding to an alternative address (e.g. to protonmail) that might still stay active so you can transition your addresses.

Re:Don't use third party auth to sign in by saagarjha on Saturday November 14, 2020 @06:29AM (#25091620)
I wonder if Google lets you Takeout if they’ve locked your account…
Re:Don't use third party auth to sign in by londons_explore on Saturday November 14, 2020 @06:34AM (#25091647)
They do now (although you only have 7 days to do so I think).

It also depends on the reason for the block - if for example they suspect you of having illegal content (child porn) in your Gmail, you aren't allowed to takeout it.

Re:Don't use third party auth to sign in by sneak on Saturday November 14, 2020 @06:52AM (#25091757)
That's great news. Facebook and Twitter don't (Facebook as of a few years ago, Twitter as of this year), as I learned the hard way.
Re:Don't use third party auth to sign in by occamrazor on Saturday November 14, 2020 @06:35AM (#25091658)
If you are in the EU, GDPR says they have to.
Re:Don't use third party auth to sign in by gzer0 on Saturday November 14, 2020 @06:57AM (#25091779)
The GDPR (in Article 15(4)) states that the right to obtain a copy of your personal data should not ‘adversely affect the rights or freedoms of others’. This means that when responding to an access request, the controller should consider the rights of third parties, such as their data protection rights, trade secrets, or intellectual property rights such as copyright. This could arise, for example, where your access request relates to a record containing both your personal data but also the personal data, trade secrets, or intellectual property of others.

A balancing of rights exercise would need to be conducted by the controller to balance your right of access your personal data as against the identified risk to the third party that may be brought about by the disclosure of the information. The GDPR notes that these considerations should not result simply in a refusal to provide all relevant information, but the controller should endeavour to comply with the request insofar as possible whilst also ensuring adequate protection for the rights and freedoms of others.

Re:Don't use third party auth to sign in by lucb1e on Saturday November 14, 2020 @06:42AM (#25091703)
Google doesn't let you Takeout when you don't allow Google to track your browser. It will give an error to "please use a device you regularly use" even if you can see in your account that there are no other active sessions that you could possibly make use of. I tried a few hours later with the session still open but no dice. Guess I'll have to find a human to talk to at Google in order to get my data pursuant article 15, GDPR.

I have very little hope indeed that they will let you do a takeout without finding a human to talk to when your account is locked.

For what it's worth, Facebook does let you do this. You login, get a message your account was banned for no apparent reason, and that you can download a copy of your data. Unfortunately it's broken (screenshot: https://dro.pm/a.png) but hey, there was an attempt.

Re:Don't use third party auth to sign in by ravenstine on Saturday November 14, 2020 @10:26AM (#25092810)
There's this thing called principle. It's not that we do something because we believe it's going to work. We do things out of principle because doing the right thing is the only rational alternative; because, if everyone held the same principles, then the problem would be snuffed of oxygen.
Re:Don't use third party auth to sign in by saagarjha on Saturday November 14, 2020 @06:28AM (#25091617)
Use a third-party client that grabs the emails locally.