Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Trello handed over my personal account to my previous company

community.atlassian.com

Post reply on HN
Print view View original

131–140 of 274 posts

Re: Trello handed over my personal account to my previous company

#131

Post by thedufer »

mattmanser wrote: post #118
PeterStuer wrote: post #106

Earlier quoted context omitted.

Just received the same email, and had the same experience as you. Servers are not responding. Now I'm no longer using Trello as I moved to tasksinabox.com 2 years ago, but I don't see why the information I have there should suddenly be transferred to a company, out of my control and without my permission, just because somewhere there is an email address with a company domain name attached. I understand the old "lure…

Did it actually come from @trello.com? As I got the same email from @trellis.coffee and assumed it was a phishing attempt.

I'm a former Trello employee - trellis.coffee is the domain the primary dev server is hosted at. It sounds like they failed to excise your email address from the dev database (at least, that's what we did when I worked there).

Re: Trello handed over my personal account to my previous company

#132

Post by znpy »

dreyfiz wrote: post #60

GitHub did this to me a few years ago. I still feel violated. Not by my idiot former employer. I feel violated by GitHub. I got my account back. Sort of. They detached a significant amount of my content from my account, and returned to me a gimpy lobotomized version of myself. All my old GitHub comments are credited to “ghost” now. I was somewhere in the first 12,000 GitHub accounts. My relationship with GitHub signi…

I'm not sure if this is related, but I made a point of never using the social login feature, at least for personal stuff. Always signup via e-mail (my own e-mail).

The risk is just too big.

With login via email I can still be in control of that account no matter what.

Re: Trello handed over my personal account to my previous company

#133

Post by arh68 »

Do any accounts have 2 work emails tied to them, I wonder? Would they hand it to Company A, who would gain whatever IP of Company B that was still in the account? Would they arbitrate who gets what?

You know, the one thing nice about using a cloud service is that your data is just there, nice and safe. You know, usually.

Re: Trello handed over my personal account to my previous company

#134

Post by ratww »

dx034 wrote: post #91
mjd wrote: post #31

They emailed me about this back on January 30: Subject: Your company ExampleCo will soon manage your Trello account Good news! Your Trello account is getting an upgrade. ExampleCo will now manage Trello accounts with a example.com email address, which includes yours (mjd+trello@example.com). The "Good news" part looked like marketing bullshit, but the rest of the message was menacing enough that I was able to contact…

Isn't it standard to open separate accounts for companies? My employers would've never even allowed me to use a personal account or personal email for business content. In the end, they need to be able to claim the content if an employee leaves the company. Mixing personal and company accounts or even accounts of several employers sounds dangerous to me.

When I was consulting it was common for companies to add my professional e-mail to their services, because forcing me use an e-mail provided by them could be used as proof of employment, and that's something they didn't want.

They used to create an account using my professional contact email without asking, of course, and it would give me all sorts of problems with some SaaS services. Stuff similar to the ones in this post. Most of the time it was harmless (I'd lose access to another client), but it was always a headache.

The middle-of-the-road solution for me was to nicely ask them to remove it and use something like companyname@mydomain.com.

Of course the @mydomain.com solution didn't work for long as well (thanks, Salesforce), so I started using throwaway Google Accounts.

Re: Trello handed over my personal account to my previous company

#135

Post by FeepingCreature »

ZWoz wrote: post #124
snack_man wrote: post #67

Earlier quoted context omitted.

The specter of this sort of violation hangs over the shoulder of every internet user now - the loss of an account on a service like Facebook, GitHub, or Trello could be life-altering. Our digital selves are all at risk of becoming The Trial's protagonist. Do we have any protection besides moving to a new platform that's not big enough to betray its users yet?

Unix graybeards selfhost. That saying "cloud is someone else's computer." is relevant here. Now, you can ask, what self-hosting really means and that is complicated. Does rented server count? Colocation? Or only way is own premises? I have worked places, where last one is hard requirement. Generally though, I am pleased with colocation, some places even have customer provided locks on racks. But even if you have chea…

I'd say the metric should be "if you can make a backup and do something useful with that backup even if your first provider goes belly-up."

Re: Trello handed over my personal account to my previous company

#136

Post by FeepingCreature »

ratww wrote: post #134
dx034 wrote: post #91

Earlier quoted context omitted.

Isn't it standard to open separate accounts for companies? My employers would've never even allowed me to use a personal account or personal email for business content. In the end, they need to be able to claim the content if an employee leaves the company. Mixing personal and company accounts or even accounts of several employers sounds dangerous to me.

When I was consulting it was common for companies to add my professional e-mail to their services, because forcing me use an e-mail provided by them could be used as proof of employment, and that's something they didn't want. They used to create an account using my professional contact email without asking, of course, and it would give me all sorts of problems with some SaaS services. Stuff similar to the ones in thi…

> They used to create an account using my professional contact email without asking, of course

I don't understand how this is an issue. Just don't confirm the account. Or are there SaaS platforms where you can add users with arbitrary emails without confirmation?

Re: Trello handed over my personal account to my previous company

#137

Post by znpy »

0k wrote: post #104

Beware the Atlassian's SSO "2 factor authentication" (2fa). I remember asking them every month years back their hand over to Atlassian - to create / enable backup codes functoonality. Several months ago after changing countries and phones I discovered that my backup codes didn't work. Their "support" offered me a "solution" - to delete all my boards associated with my email so that I could create fresh ones. Zero apo…

THIS.

AVOID whenever possible sms-based 2fa. Use totp codes.

SMS makes your phone a single point of failure [1].

I currently use the OTP feature of keepassxc, so that I can still generate otp code but can have those codes replicated on my trusted devices. You can save the seed of the TOTP and re-install the otp on other devices too.

[1] plus you should really try and depend as little as possible on your smartphones. smartphones are the leash of the third millennium. the less you are dependant on it, the free-er you are.

Re: Trello handed over my personal account to my previous company

#138

Post by PeterStuer »

mattmanser wrote: post #118
PeterStuer wrote: post #106

Earlier quoted context omitted.

Just received the same email, and had the same experience as you. Servers are not responding. Now I'm no longer using Trello as I moved to tasksinabox.com 2 years ago, but I don't see why the information I have there should suddenly be transferred to a company, out of my control and without my permission, just because somewhere there is an email address with a company domain name attached. I understand the old "lure…

Did it actually come from @trello.com? As I got the same email from @trellis.coffee and assumed it was a phishing attempt.

It did indeed come from and links to the trellis.coffee domain.

Re: Trello handed over my personal account to my previous company

#139

Post by ratww »

FeepingCreature wrote: post #136
ratww wrote: post #134

Earlier quoted context omitted.

When I was consulting it was common for companies to add my professional e-mail to their services, because forcing me use an e-mail provided by them could be used as proof of employment, and that's something they didn't want. They used to create an account using my professional contact email without asking, of course, and it would give me all sorts of problems with some SaaS services. Stuff similar to the ones in thi…

> They used to create an account using my professional contact email without asking, of course I don't understand how this is an issue. Just don't confirm the account. Or are there SaaS platforms where you can add users with arbitrary emails without confirmation?

> Or are there SaaS platforms where you can add users with arbitrary emails without confirmation?

In my experience, yes!

But the problem is not so much them adding without asking, it's the fact that the SaaS companies are making random assumptions regarding who owns the email account, or who owns the domain name of those accounts, and not letting users know that before accepting. Apparently only gmail/hotmail/yahoo are safe, unfortunately.

Re: Trello handed over my personal account to my previous company

#140

Post by znpy »

thedufer wrote: post #131
mattmanser wrote: post #118

Earlier quoted context omitted.

Did it actually come from @trello.com? As I got the same email from @trellis.coffee and assumed it was a phishing attempt.

I'm a former Trello employee - trellis.coffee is the domain the primary dev server is hosted at. It sounds like they failed to excise your email address from the dev database (at least, that's what we did when I worked there).

Dude you might have leaked private information. Not much really, but still... The dns record show the private addressing of the dev server:

    znpy@eomdb:~$ nslookup trellis.coffee
    Server:  127.0.0.53
    Address: 127.0.0.53#53
    
    Non-authoritative answer:
    Name: trellis.coffee
    Address: 10.253.0.237
    Name: trellis.coffee
    Address: 10.253.3.171
also: dig -t any trellis.coffee
Post reply on HN