[guims767]

Support asked me to authorize their access by replying "OK" to an email of them. I asked to know more about this and they said that only trained engineer will access my data, and that they would wait for me to reply OK to their email before to do so...

[enz]

So, the team is being pretty transparent and explicitly wait for your approval. So, I guess it’s a good point, right?

[ishitatsuyuki]

I think the point is that the permission management is manual, not systematical.

[guims767]

At least it'd be good to have an automated email when someone from support access your data with what data was accessed, when and by whom and for what purpose (i.e. related to your support request).

[regecks]

That's interesting. When I needed help with some emails in 2016, the support staff asked me to move the emails into a folder called "forwebmaster" so that they could look at it.

[brongondwana]

Any folder called precisely "forwebmaster" gets the content automatically deobfuscated when support view the account. There's probably an interesting blog post in how that's achieved in the JMAP middleware using a reverse index on each blob to allow you to download any attachment that's referenced by those messages as well... but I digress.

The forwebmaster method (legacy names 'r' us) is very useful for debugging issues like display problems with various types of message (often this is an issue with poorly encoded messages where the character set name is invalid or the encoding is broken, and we fix them by adding another hack to our server to detect and repair that particular type of error). We don't explicitly ask for consent to look at forwebmaster, because the process of creating that folder and putting messages in there is an active request for them to be examined.

For more complex issues which require more visibility into the contents of an account, support agents can request full access. For this they need to provide a reason, and that reason describes how they obtained consent or other reasonable grounds for examining this particular account - e.g. evidence of abuse where the determination needs to be made whether to temporarily lock the account as stolen or close it as entirely fraudulent.

[guims767]

thanks for the detailed explanation. Do you think it'd be feasible to add this to Fastmail's help page about Security?

[brongondwana]

Seems plausible - the support team is in the middle of a revamp of a bunch of the help pages - I'll pop them a ticket.

[jolmg]

I don't remember that happening to me back when I had an issue where the dates of all my emails got screwed up (that was kind of my fault, btw). Due to the nature of the problem (and probably most problems that require support), it was obvious they'd need access to help me, though.

[brongondwana]

I think I remember this one :) I've certainly had a few of that sort come to me, particularly back when I was hacking on the backend server more of the time.