101–110 of 274 posts
So I just clicked on that link with a private browsing window and I'm logged in as someone else in my org's account. Someone I've never met, talked to or been in the same room as. They live on the other side of the world. I suspect some sort of IP-based cache has stored their cookie or a set auth-header. Very creepy, Atlassian.
GitHub did this to me a few years ago. I still feel violated. Not by my idiot former employer. I feel violated by GitHub. I got my account back. Sort of. They detached a significant amount of my content from my account, and returned to me a gimpy lobotomized version of myself. All my old GitHub comments are credited to “ghost” now. I was somewhere in the first 12,000 GitHub accounts. My relationship with GitHub signi…
The specter of this sort of violation hangs over the shoulder of every internet user now - the loss of an account on a service like Facebook, GitHub, or Trello could be life-altering. Our digital selves are all at risk of becoming The Trial's protagonist. Do we have any protection besides moving to a new platform that's not big enough to betray its users yet?
Trello just notifided me that:
> At least one of the email addresses linked to your account belongs to an organization: [...] > This usually means it's a work email. If this organization begins using Atlassian products while this email address is linked, your account could become managed by that organization, which means you could potentially lose access. If you don't use Trello for work, just select a non-organizational email.
I use Trello myself, as well as in connection with several organizations. The idea that someone can "claim" and "manage" my account is outright ridiculous.
Even worse, in a show of incompetence, their "Confirm email" link doesn't work (times out because the server is seemingly down).
I remember asking them every month years back their hand over to Atlassian - to create / enable backup codes functoonality.
Several months ago after changing countries and phones I discovered that my backup codes didn't work.
Their "support" offered me a "solution" - to delete all my boards associated with my email so that I could create fresh ones.
Zero apologies, zero explanation as of why my perfectly double-backed up 2FA codes were not working, all blames on me the user.
There were sensitive details for approx 16 projects collected daily over the span of 5 years.
That SSO 2FA is flawed the same way across all Atlassian products.
Never again would I trust my data to Atlassian.
WeKan is open source and welcome.
From the comments, there is some confusion about why did i attach my personal email to a company account. That was not the case, let me clarify it. I created my personal account long before Trello was acquired by Atlassian. It did not have any SSO at that point and the login was with username and password. At some point, while working on a side project and to share it with a teammate, I attached a secondary email to…
Atlassian is not the only one who wrecked login by implementing SSO across all their instances. I really don’t recommend using in-app dual logins (for example Gmail’s dual login), and stick to using separate Chrome profiles or Firefox profiles, so that none of the cookies are shared. Even with that, I’ve had surprises with my mobile phone number being the only shared information between two Google Ads accounts, and G…
You don't need separate Firefox profiles for that, you can use Firefox containers.
I have a single E-mail account that I use for everything. I decided more than ~20 years ago that my E-mail is tied to my identity and not to any particular E-mail service or employer, and I started managing my E-mail myself. Trello just notifided me that: > At least one of the email addresses linked to your account belongs to an organization: [...] > This usually means it's a work email. If this organization begins u…
Now I'm no longer using Trello as I moved to tasksinabox.com 2 years ago, but I don't see why the information I have there should suddenly be transferred to a company, out of my control and without my permission, just because somewhere there is an email address with a company domain name attached.
I understand the old "lure shadow IT users in with a 'free' service, then offer IT to take back control at a price" scheme, it's a bit of a dark pattern, but then the per-existing users should have the option to opt out of the retroactive appropriation.
I do hope that once the 'confirmation' page comes up, there will be the option to remove the company email from the account, and assign a different address in its place.
So never make the mistake to mix private with work.
I don't think Atlassian is to blame here. Maybe they could have communicated this better to the owner of the account. But if you own an account it does not mean you own the content if you used it for work.
I have a single E-mail account that I use for everything. I decided more than ~20 years ago that my E-mail is tied to my identity and not to any particular E-mail service or employer, and I started managing my E-mail myself. Trello just notifided me that: > At least one of the email addresses linked to your account belongs to an organization: [...] > This usually means it's a work email. If this organization begins u…
They emailed me about this back on January 30: Subject: Your company ExampleCo will soon manage your Trello account Good news! Your Trello account is getting an upgrade. ExampleCo will now manage Trello accounts with a example.com email address, which includes yours (mjd+trello@example.com). The "Good news" part looked like marketing bullshit, but the rest of the message was menacing enough that I was able to contact…
Isn't it standard to open separate accounts for companies? My employers would've never even allowed me to use a personal account or personal email for business content. In the end, they need to be able to claim the content if an employee leaves the company. Mixing personal and company accounts or even accounts of several employers sounds dangerous to me.
I understood that these were separate accounts in separate systems, they just had the same email address attached to both because it was convenient to log into each system from separate workstations - a little bit like using a company phone for a personal telephone call. When one company (Atlassian) acquired the other (Trello), the "accounts" were merged by someone who has no taste.
> In the end, they need to be able to claim the content if an employee leaves the company.
I don't agree with this at all, and thankfully tort doesn't work this way.
> Mixing personal and company accounts or even accounts of several employers sounds dangerous to me.
Indeed. This is a big reason why I don't like to create "free" accounts, because I know unless I pay them, I cannot sue them for fucking something like this up.
This sounds like a major GDPR violation. If they do business anywhere in Europe they could face major fines if someone were to lodge a complaint with a national national data protection authority. And here is a list of national data protection authorities in Europe: https://edpb.europa.eu/about-edpb/board/members_en
I have provided GDPR consulting in the UK over the last three years.
What exactly do you think was a violation?