Hacker News new | ask | show | jobs
by Z7YCx5ieof4Std 1118 days ago
And that, ladies and gentlemen, is why you should never store important things like your email/passwords/passkeys on google
3 comments

No, ladies and gentlement, that has nothing to do with that.

The post is about a "disposable" Google account created two hours prior and all it did was break Google TOS. This is totally predictable protection from account abuse. Pretty much any major consumer company will ban brand-new accounts that immediately proceed to break TOS.

I don't know what Google does with a longstanding account that breaks TOS in this way, but this is not that. Also you should be using Google Takeout to backup your account data regularly anyways -- that's what it's there for.

Let's not make excuses for Google here. A few months ago I created a Gmail account for a new business - since I hadn't registered the domain yet, I planned on using the Gmail account for a while then switching over to the real email. Over the next few days I signed up for a bunch of other stuff with the account: Instagram, Facebook, Twitter. I also registered the real, verifiable business address on Google Maps and requested a postcard verification to that address (which never arrived).

That's literally all I did with the account over a span of two or three days. Then I took a long weekend hiking trip. Came back, the account is permanently locked. No way to contact support. Just a tiny comment box where I could plead my case, which I never got a response to.

I was able to get back control of the FB, IG, Twitter accounts quite easily. It took me weeks of wrangling with Google support to get back control of the Google Maps location, and I was never able to unlock the original account. I had to do this whole messy process (as directed by them) of registering the business on Maps a second time then declaring the old one as a duplicate, then waiting two weeks for Google to process (ignore) that so I could escalate it to real human, then they fixed it but mangled the name which took another week or two to fix.

So yeah, don't use Gmail for anything you care about is my advice.

I can see why my actions on that account could falsely trigger the account to lock, that's not the issue. The issue is that there was literally no way to ever unlock the account once the false trigger happened. All they had to do was require a phone call with a real human in this case. But no, it's Google.

I will say from experience with google maps, that if you say the right combination of lawyer, legal, etc etc…not directed at them, but about another entity accidentally in control of your maps location.

They will call you from an overseas number between 8-11pm your local time, or 4am.

If you answer, they can magically fix it in moments.

If you don’t — you may get a call another time… or never… in which case, good luck.

(In short, it’s insanely hard to get anything going wrong with Google fixed. And I am so sorry you had to go through that. I’m terrified of having something like my drive deleted(shared files). But I do pay for space… so perhaps paying makes it less likely?)

Fortunately it was resolved before we actually opened to the public (barely). But at one point I was like, fuck. Google Maps is the main driver of customers to our type of business here, from my research. What if this couldn't be resolved at all and we were stuck unable to control our business on Maps? It would be a huge problem.
Breaks TOS how? (I don't know what aurora is more than it appears to be an app store)
Specifically, I don't know. But Aurora is an open source client that uses google play APIs to download and install apks. It's used by users who want to install apps from google play without having any google play services (and their unreasonably terrible privacy implications). The account is required I assume to authenticate to whatever network requests they're using.

I cannot imagine this being allowed in their TOS. The app is a reverse engineer of their APIs.

> I don't know what Google does with a longstanding account that breaks TOS in this way

Pretty much nothing. I've had my main account for... 15 years or so? I moved away from Google several years ago [0], and use the account almost exclusively for the Aurora store now. It's been fine, and has been for somewhere between months and years.

[0] If I'm wrong, or Google becomes more aggressive, then nothing major is lost. I've gone through Takeout, stopped adding photos/email/passwords/etc years ago, and completely migrated away. No need to tell me "But what if the account gets banned?", because nothing of value will be lost.

Is there a service that will import google takeout backups and produce a working account with minimal data loss?
No. It's one of the reasons Takeout is more performative than useful. A giant pile of JSON files for proprietary Google services you can't import anywhere isn't useful unless you're a developer who can write automation to import them to somewhere else.
It's certainly 100% useful for me, not "performative" at all, but that's because I use it all for standard stuff -- e-mail/contacts/calendar, files/Docs/Sheets/Slides/photos. None of that is proprietary to Google (e-mails are mbox, Docs files are converted to Word, etc.).

Sure if you want to download your Maps location history or YouTube comment history as JSON it's there too, but I don't think too many people care about importing that stuff elsewhere. Competing services are obviously free to build their own importer if they want.

But all the normally "important" content we think about like e-mails and documents and photos, it's all there just zipped up. Nothing trapped inside proprietary JSON or anything like that. And it's just peace of mind knowing that I've always got a local backup of everything.

Well, for example, what mail services will allow you to upload an MBOX file? (I'll give you one... Fastmail added support for it about six years after I left Gmail, but that wasn't until like last year.) You can't carry that export method over to most mail services, which if they support importing, require IMAP (and hence access to your current account in good standing).

Offering Takeout doesn't actually make it very easy to migrate to a competitor, is my point. Sure, you can get the data out, but very little will actually ingest Takeout in any useful way. And heck, I think last time I used Takeout, it preferred to issue things in .tar.gz archives, and good lunch to any non-HN user on figuring out what to do with those.

Well I do regular backups and they do ZIP nowadays.

And it's not Googles responsibility to make it easy for you to import to other services.

They use open formats and standards in their export. It's up to you and the other providers to mess with it. A lot of them can import directly from Gmail over API.

Mbox can easily be converted to maildir. Which can be used by thunderbird, not much, sup, etc.

I know people hate on Google but in this case it's not on them to make it easy. The fact that you can export it into open standards is all they have to do.

Finally, this is probably their way of creating a dark pattern. Especially for email. Export into an old, less used nowadays format.

You can import your mbox emails into lots of email serves via a desktop client. Depending on the client you might have to import into a second location, select all and then drag over to your live account. IMAP will sync up your imported email.
> I think last time I used Takeout, it preferred to issue things in .tar.gz archives

What is the intersection of people who decided to use Google takeout but are incapable of figuring out how to extract a tarball?

> t preferred to issue things in .tar.gz archives, and good lunch to any non-HN user on figuring out what to do with those.

The built-in Archive Utility on macOS handles .tar.gz just fine, as does 7-Zip on Windows.

This is why I will never pay for YouTube Premium. Imagine having a recurring charge that you can’t terminate because your account was deleted for some unrelated service, and you have no phone number or office to contact.

Limit your interactions with Google to only the services you most need, and you will probably be safe. It’s too dangerous to go all-in on Google, because you could lose your entire digital footprint from an AI bot with no recourse other than HN and Twitter.

Do you not have a bank? Why would you be unable to terminate a recurring charge on any payment method you actually own?
Banks don’t always let you cancel a credit card charge if you’ve authorized it but then can’t get ahold of the charging entity. It happened to me. I couldn’t get my credit card company (Wells Fargo in this case) to stop a recurring charge but they did let me cancel my credit card account and move my banking accounts away to another bank.

That said, I do pay for YouTube Premium.

Ah, I'm not an American and that's very wild to me. I have never had trouble getting my bank to honour an order to stop payments, although it takes a few business days to process
The charge is tied to the continued existence of your gmail, gdocs, third party login with google account, gcp, and anything else you trusted google with.
In the scenario given your account has been deleted - if you still have access to other Google services, then you can just use the web interface to cancel the problematic subscription?
If you stop them from debiting your bank account, wouldn't they just send your account to collections?
I don't know how US collections works since I don't live there, but none of the financial systems I've ever interacted with give merchants any entitlement to future money for a service they are no longer providing
Just use privacy.com to make burner cards with a fixed amount as a fail-safe for this
> Imagine having a recurring charge that you can’t terminate because your account was deleted for some unrelated service

Has this actually happened - does Youtube Premium still charge for accounts that have been terminated? Or is this just FUD?

This happened to me. The only way to contact customer service is after you log in, so the only thing you can do to cancel is to cancel your credit card or report the charge as fraud... which says a lot about the service.
If it was happening, what would be your recourse? Call customer service?
It's an unproved hypothetical situation. What would be your recourse if your uncle started reporting false debts to your name whilst you were travelling around Italy?

In the past I have contacted YouTube Red support in the past when I didn't cancel my subscription after I moved counties and they easily refunded a few months of charges. Unsure how that would play out if your account was cancelled. I would probably just contact my bank to get the charges blocked + reversed.

Call your credit card company. They can block a merchant, perform a chargeback, and/or issue a new credit card number. I don’t know the rules for a debit card, but you’ll at least be able to get a new debit card number.
A chargeback? Lol
You can always block your card. Takes a few days to get a new one and might be a bit of a hassle to update PayPal and other services where you have it stored. Not ideal but I don't think anyone should lose sleep over it.
I don't know if this advice is for yhe only, or it's for companies that won't go after you for small fees.

Otherwise there's always recourses for a company to recover the fees that were due and couldn't charge through your credit card. You'd then have to dispute a court order to recover it from your employer for instance. You can of course battle it then, but it's a lot more hassle than to have the charge disputed in the first place (the dispute goes back to the company, who has to prove their point)

> You'd then have to dispute a court order to recover it from your employer

That's not how any of this works. A company doesn't just send someone over to the courthouse to speak to the manager and get a court order to garnish some random person's wages over $20 in declined subscription charges. Lol.

I actually experienced this first hand on a random invoice that got lost after moving to another town.

As a company you file an official claim that goes through a court, usually the other party won't show up, and you're awarded a judgement in your favor. That judgment allows you to request recovery of the funds in many ways, including asking the person employer to pay you first before paying them, repossessing their godds, houses whatever the court allows you to do of there's no other option.

E.g. in NZ: https://communitylaw.org.nz/community-law-manual/chapter-26-...

> lol

For people baffled by all of this, many countries will have stronger laws to protect lenders and service providers than just telling them "tough luck" when you refuse to pay for received goods/services.

Also there's several apps on various platforms that are more private and free
I don't think your hypothetical scenario is possible.
It very much is. I haven't personally been affected by Google charging any account after being suspended, but I have been affected by Facebook suspending my account while not pausing running ads on Instagram and Facebook, leading to charges still being made after I had no way of turning them off.

We're at least two people this has happened to :) https://news.ycombinator.com/item?id=35836221

All of those anecdotes are about Facebook though. Does Google have this bug? The two software stacks are completely different.
Also, do not use your main Google account to violate Google's Terms of Service.
You are assuming a lot if you think Google won't action "related" or "nearby" Google accounts.
Not that I would be surprised but are there any real examples of this? I've considered setting up separate accounts for things such as email to reduce the risk of losing it in a random ban.
There's been many stories of entire companies being banned from Google services due to their affiliation with a freelancer who broke Google's rules years ago for a different client.
Those are accounts that are explicitly linked, though. We're talking about burner accounts, i.e. accounts where you try as hard as possible to create no link between them and your "regular" account.
There's been many stories of entire companies being banned from Google services due to their affiliation with a freelancer who used the company account to brake Google's rules years ago for a different client.

FTFY

Google "google bans entire company". Plenty of examples.
Isn’t a Google Apps organization a different scenario?