Trello handed over my personal account to my previous company • Hacker News Board

Re: Trello handed over my personal account to my previous company

#31

Post by mjd » Wed, Apr 15, 2020, 2:41 AM UTC

They emailed me about this back on January 30:

  Subject: Your company ExampleCo will soon manage your Trello account
   
  Good news! Your Trello account is getting an upgrade.
  
  ExampleCo will now manage Trello accounts with a example.com email address,
  which includes yours (mjd+trello@example.com).

The "Good news" part looked like marketing bullshit, but the rest of the message was menacing enough that I was able to contact them by email and get instructions about how to avoid having my personal Trello handed over to ExampleCo.

It still sucks.

The lesson I take from this is: “Software as a service” is always a security risk. Unless my data is on my server, someone else owns it and might sell it to a higher bidder.

This is one of those “fool me twice, shame on me” moments.

Re: Trello handed over my personal account to my previous company

#32

Post by shashanktomar » Wed, Apr 15, 2020, 2:42 AM UTC

nerdbaggy wrote: post #19

sgk284 wrote: post #13

Earlier quoted context omitted.

This is just laziness on Atlassian's part. They should simply remove access to the Trello boards associated with the SSO account. See: Github - where you can SSO into your organization's repositories but this is completely separate from your personal repositories.

Problem is they don’t know which boards are part of the SSO org since both emails are on the same account.

A board is owned by the user. In my case, my boards are clearly created by email ending in @gmail.com and not @company.com

Re: Trello handed over my personal account to my previous company

#33

Post by javagram » Wed, Apr 15, 2020, 2:42 AM UTC

Wowfunhappy wrote: post #26

gumby wrote: post #6

I think atlassian’s position is correct here, sad to say. They had to make a branch cut and i don’t think the other arm would be safe for them (company stuff leaked to a private account). Of course that stuff was already leaked, but I think the liability would fall on Atlassian if the company count delete that stuff. Don’t connect your personal stuff to your work stuff. That’s messed me up more than once — lesson lea…

The user's account contained a secondary email address from five years ago. The user probably didn't even remember it was still on their account. Should you lose your account over that?

Atlassian sent me an email earlier this year warning that all @company.com accounts were about to be converted to corporate accounts and that I had a month to opt out. (I did not opt out, because my @company.com Trello account was intended for use with my company)

This person’s warning email probably ended up in spam.

In general I’m not sure the best way Atlassian could have handled this. The recent upgrade to move @company.com accounts into having a better security posture and control by the administration of the company does make sense.

Perhaps the person’s account should have just been disabled entirely until they removed either their personal email or @company.com email from the account to choose which way they wanted to go... That might have been the best solution to both protect corporate security and also the individual.

Re: Trello handed over my personal account to my previous company

#34

Post by quanticle » Wed, Apr 15, 2020, 2:54 AM UTC

ScottFree wrote: post #28

frenchman99 wrote: post #9

Always keep separate personal and company accounts. If not for security reasons, then for privacy reasons. Mixing them usually yields little benefit anyway.

Let's take the personal out of it: what if you're a freelancer or a contractor and the email and account used (and subsequently lost access to) was your professional email and account? Something like scott@freetechnologies.com? This whole situation makes me think I should steer clear of trello and clients that use it.

If you're a freelancer or a contractor, and you're doing work for someone who uses Trello to manage projects, you should sign up with a throwaway e-mail address. That's what I do for Github. That way, if that organization then decides to wipe the account or mess around with its permissions after I've stopped working for them, it's no skin off my back.

Personal stuff is personal, work stuff is work and ne'er shall the twain meet.

Re: Trello handed over my personal account to my previous company

#35

Post by [deleted] » Wed, Apr 15, 2020, 2:56 AM UTC

quanticle wrote: post #34

ScottFree wrote: post #28

Earlier quoted context omitted.

Let's take the personal out of it: what if you're a freelancer or a contractor and the email and account used (and subsequently lost access to) was your professional email and account? Something like scott@freetechnologies.com? This whole situation makes me think I should steer clear of trello and clients that use it.

If you're a freelancer or a contractor, and you're doing work for someone who uses Trello to manage projects, you should sign up with a throwaway e-mail address. That's what I do for Github. That way, if that organization then decides to wipe the account or mess around with its permissions after I've stopped working for them, it's no skin off my back. Personal stuff is personal , work stuff is work and ne'er shall th…

[deleted]

Re: Trello handed over my personal account to my previous company

#36

Post by mindB » Wed, Apr 15, 2020, 2:56 AM UTC

In 2016 I lost access to some repos on bitbucket after a similar occurrence. I made the mistake of using my (student) university email account to register with bitbucket (it was the primary email account I used for everything at the time). At some point, my university apparently decided to use Atlassian services which completely disabled any ability I had to login to that account. I don't know if linking together all accounts under a domain is just the default behavior from Atlassian or if both this former employer and my university decided to screw people over, but either way it's a stupid situation and unsurprising at this point.

Re: Trello handed over my personal account to my previous company

#37

Post by JiNCMG » Wed, Apr 15, 2020, 3:02 AM UTC

The question that I have is... Will the control panel show the multiple addresses and can you delete one off. I just checked both accounts (personal and company) and they seem separate. In everything I do I always keep my work account separate from my personal accounts. I use separate browsers, never check personal email on company PC or network.

Re: Trello handed over my personal account to my previous company

#38

Post by dvhh » Wed, Apr 15, 2020, 3:10 AM UTC

shashanktomar wrote: post #30

dvhh wrote: post #27

Earlier quoted context omitted.

Going on a stretch here, but assuming that the user also use the company email for SSO, means that company (paying client) trade secret were potentially in some of the trello board the user was using. Considering that it would be an invasion of privacy and confidentiality for Atlassian to access the content of the board to assess which one is corporate and which one is personal, Atlassian to the safer approach to sat…

I am the user in this case. When I linked the accounts almost 6-7 years ago, Trello was not part of Atlassian and there was no SSO in place. At some point, they introduced it, but still, the regular way of login was working. There was no notification from there side that it will stop working abruptly. The company email address in this case what @comany.com and the personal one was @gmail.com. This is how they handed…

I understood you were the user, and that what Atlassian was way too cold and lazy on their part.

but again, to play devil's advocate, Gmail do offer professional account part of the G Suite. Without knowing your work history, it would be difficult to know if the Gmail address is also not a "professional one".

On another hand do you think notification would have solved the issue ? And wouldn't a more malicious employee just delete all the boards if they did not part with their previous company on good term.

Obviously I don't know everything from the story. And my assertions are very far from the truth. I am trying to understand what would motivate such a decision (beside the obvious Atlassian is a heartless money-grabbing company that rot everything it touches)

Re: Trello handed over my personal account to my previous company

#39

Post by [deleted] » Wed, Apr 15, 2020, 3:15 AM UTC

mjd wrote: post #31

They emailed me about this back on January 30: Subject: Your company ExampleCo will soon manage your Trello account Good news! Your Trello account is getting an upgrade. ExampleCo will now manage Trello accounts with a example.com email address, which includes yours (mjd+trello@example.com). The "Good news" part looked like marketing bullshit, but the rest of the message was menacing enough that I was able to contact…

[deleted]

Re: Trello handed over my personal account to my previous company

#40

Post by wyattpeak » Wed, Apr 15, 2020, 3:17 AM UTC

hashkb wrote: post #25

shashanktomar wrote: post #7

Earlier quoted context omitted.

I understand Atlassian's part here. But Atlassian did this on purpose. They clearly understand the implication and the ownership of accounts, but they deliberately ignored individual users over big corporate accounts. And in my case, they didn't even have the courtesy to notify me in any way. I just stopped working one day leaving all my data unbale to use.

You actually were lucky that this didn't bite you until now. Not fair to blame your old job for waiting this long to force mfa. Edit: you can't say what they did deliberately or not. They're doing what makes the most sense for their business. Almost no support team I know would give you access to this account.

"They're doing what makes sense for their business" is a weak argument against an accusation of unethicality. Owning slaves is very good for business.