Trello handed over my personal account to my previous company • Hacker News Board

Re: Trello handed over my personal account to my previous company

#21

Post by [deleted] » Wed, Apr 15, 2020, 2:27 AM UTC

chatmasta wrote: post #14

JMTQp8lwXL wrote: post #3

In this day and age, sharing this community forum discussion here is the only way to get resolution. I'm happy helping people out and tweeting my displeasure with companies, but we need some way to scale this. We can't just help the people that get enough publicity. We think we're helping, and we are, but only a small amount of situations end up getting front paged.

Interesting idea re: scaling. I agree this is a pattern we see time and time again with different companies on here. I wonder what a service built around this idea might look like? It’s basically outsourced customer service, isn’t it? It seems like HN is in a sort of Goldilocks zone, where it isn’t as crowded as Twitter but gets enough attention that companies are pressured to respond. I’m not sure how replicable the…

[deleted]

Re: Trello handed over my personal account to my previous company

#22

Post by nerdbaggy » Wed, Apr 15, 2020, 2:28 AM UTC

shashanktomar wrote: post #16

nerdbaggy wrote: post #5

Sounds kinda like the users fault, having a corporate and personal email on the same account. Atlassian probably could put a warning though about the issues that could arise.

I am the user in this case. I understand Atlassian's position in this case but this is so hard to track over such a long period of time. I left this workplace almost 5 years back and the account worked fine. Then it suddenly stopped working without any notification from their side.

They should of sent an e-mail I agree

Re: Trello handed over my personal account to my previous company

#23

Post by hashkb » Wed, Apr 15, 2020, 2:28 AM UTC

shashanktomar wrote: post #16

nerdbaggy wrote: post #5

Sounds kinda like the users fault, having a corporate and personal email on the same account. Atlassian probably could put a warning though about the issues that could arise.

I am the user in this case. I understand Atlassian's position in this case but this is so hard to track over such a long period of time. I left this workplace almost 5 years back and the account worked fine. Then it suddenly stopped working without any notification from their side.

Every year, audit yourself for things like this. I compulsively check my own security... security is a frame of mind. Delete unused oauth apps, dead emails. Flipside - offboard people quicky and completely when they leave your team.

Re: Trello handed over my personal account to my previous company

#24

Post by hashkb » Wed, Apr 15, 2020, 2:29 AM UTC

jaimex2 wrote: post #4

hashkb wrote: post #2

This sucks but isn't Atlassians fault. The lesson is of course to never connect an account you don't own to anything you can't afford to lose.

Curious how this isn't Atlassians fault. Can you elaborate?

User should have removed work account from valuable personal account immediately after leaving job.

Re: Trello handed over my personal account to my previous company

#25

Post by hashkb » Wed, Apr 15, 2020, 2:30 AM UTC

shashanktomar wrote: post #7

hashkb wrote: post #2

This sucks but isn't Atlassians fault. The lesson is of course to never connect an account you don't own to anything you can't afford to lose.

I understand Atlassian's part here. But Atlassian did this on purpose. They clearly understand the implication and the ownership of accounts, but they deliberately ignored individual users over big corporate accounts. And in my case, they didn't even have the courtesy to notify me in any way. I just stopped working one day leaving all my data unbale to use.

You actually were lucky that this didn't bite you until now. Not fair to blame your old job for waiting this long to force mfa.

Edit: you can't say what they did deliberately or not. They're doing what makes the most sense for their business. Almost no support team I know would give you access to this account.

Re: Trello handed over my personal account to my previous company

#26

Post by Wowfunhappy » Wed, Apr 15, 2020, 2:31 AM UTC

gumby wrote: post #6

I think atlassian’s position is correct here, sad to say. They had to make a branch cut and i don’t think the other arm would be safe for them (company stuff leaked to a private account). Of course that stuff was already leaked, but I think the liability would fall on Atlassian if the company count delete that stuff. Don’t connect your personal stuff to your work stuff. That’s messed me up more than once — lesson lea…

The user's account contained a secondary email address from five years ago. The user probably didn't even remember it was still on their account.

Should you lose your account over that?

Re: Trello handed over my personal account to my previous company

#27

Post by dvhh » Wed, Apr 15, 2020, 2:34 AM UTC

jaimex2 wrote: post #4

hashkb wrote: post #2

This sucks but isn't Atlassians fault. The lesson is of course to never connect an account you don't own to anything you can't afford to lose.

Curious how this isn't Atlassians fault. Can you elaborate?

Going on a stretch here, but assuming that the user also use the company email for SSO, means that company (paying client) trade secret were potentially in some of the trello board the user was using.

Considering that it would be an invasion of privacy and confidentiality for Atlassian to access the content of the board to assess which one is corporate and which one is personal, Atlassian to the safer approach to satisfy a paying client.

Consider that as a free user, with no advertising to monetize you, one could guess that Trello used you for advetising (Unless you are a paying user for your personal account, that could change the story).

Of course I am not big fan of the approach, because the user probably linked personnal and work account for convenience, and that trello probably didn't make it easy to make the switch between work and personal.

On the other hand, how do you prove that an email address is a personal one ?

Re: Trello handed over my personal account to my previous company

#28

Post by ScottFree » Wed, Apr 15, 2020, 2:35 AM UTC

frenchman99 wrote: post #9

Always keep separate personal and company accounts. If not for security reasons, then for privacy reasons. Mixing them usually yields little benefit anyway.

Let's take the personal out of it: what if you're a freelancer or a contractor and the email and account used (and subsequently lost access to) was your professional email and account? Something like scott@freetechnologies.com?

This whole situation makes me think I should steer clear of trello and clients that use it.

Re: Trello handed over my personal account to my previous company

#29

Post by awinter-py » Wed, Apr 15, 2020, 2:36 AM UTC

oauth is net negative IMO

Convenience is cool, the fact that one or more third parties has control of your account on the saas service is less cool

also not so hot that it's used for login and information sharing. I had an experience where I read the oauth permissions carefully on a first login, and then on a subsequent login the app included contacts in the permission set. I noticed it too late. Super shady & I'll never use oauth personally again.

Re: Trello handed over my personal account to my previous company

#30

Post by shashanktomar » Wed, Apr 15, 2020, 2:40 AM UTC

dvhh wrote: post #27

jaimex2 wrote: post #4

Earlier quoted context omitted.

Curious how this isn't Atlassians fault. Can you elaborate?

Going on a stretch here, but assuming that the user also use the company email for SSO, means that company (paying client) trade secret were potentially in some of the trello board the user was using. Considering that it would be an invasion of privacy and confidentiality for Atlassian to access the content of the board to assess which one is corporate and which one is personal, Atlassian to the safer approach to sat…

I am the user in this case. When I linked the accounts almost 6-7 years ago, Trello was not part of Atlassian and there was no SSO in place. At some point, they introduced it, but still, the regular way of login was working. There was no notification from there side that it will stop working abruptly. The company email address in this case what @comany.com and the personal one was @gmail.com. This is how they handed over all the accounts ending with @company.com to my previous company.