Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Trello handed over my personal account to my previous company

community.atlassian.com

Post reply on HN
Print view View original

151–160 of 274 posts

Re: Trello handed over my personal account to my previous company

#151

Post by Silhouette »

ZWoz wrote: post #124
snack_man wrote: post #67

Earlier quoted context omitted.

The specter of this sort of violation hangs over the shoulder of every internet user now - the loss of an account on a service like Facebook, GitHub, or Trello could be life-altering. Our digital selves are all at risk of becoming The Trial's protagonist. Do we have any protection besides moving to a new platform that's not big enough to betray its users yet?

Unix graybeards selfhost. That saying "cloud is someone else's computer." is relevant here. Now, you can ask, what self-hosting really means and that is complicated. Does rented server count? Colocation? Or only way is own premises? I have worked places, where last one is hard requirement. Generally though, I am pleased with colocation, some places even have customer provided locks on racks. But even if you have chea…

The funny thing is, everyone used to self-host. A home ISP account typically came with an email address, some space to host a website, etc. Of course you could set up other facilities as well, but even without that, you had control of the storage. The Web was full of articles on how to build your first home page, which plenty of non-geek people managed to do just fine.

The biggest danger back then was probably that if you changed ISP then you'd lose access to your old email address. That's still a danger with any email hosting service, including the likes of Google that people often use instead today, and it's why I advocate everyone registering their own domain for life. Email is still the root password to your online existence in almost every case, and letting any third party have more control of it than is strictly necessary is a really, really bad idea.

I would love to see a move back in that direction, which home ISP accounts allowing access to some sort of "starter kit" home server in the same way they probably provide most customers' starter modem/router/wifi equipment already, and with more software built that was aimed at being self-hosted and accessed via your home network or remotely through a VPN.

Sadly, I think this is unlikely, because there's just too much momentum behind the massive social networks and other online services. So instead, every now and then, a large chunk of someone's online life is going to get wiped out by the kinds of poor policies we're talking about today.

Re: Trello handed over my personal account to my previous company

#152

Post by diggan »

Kaze404 wrote: post #126
diggan wrote: post #111

Earlier quoted context omitted.

True, but by using profiles you don't need any extra extensions, it comes built-in in both Chrome and Firefox, you can simply start it with providing the `--profile ` flag. Correct me if I'm wrong, but some IT environments also lock down installing extensions from addons.mozilla.org, so the profiles tip would be applicable to more people.

Firefox Containers are a native feature now.

I remember it used to be a native feature but I'm fairly certain they split it out into a separate addon after a while. Or did they move it back into core?

Re: Trello handed over my personal account to my previous company

#153

Post by diggan »

dhimes wrote: post #141
znpy wrote: post #127

Earlier quoted context omitted.

> You don't need separate Firefox profiles for that, you can use Firefox containers. Firefox Containers are awful. Only firefox profiles can give you true separation. It would have been better if Mozilla had added a better interface to profiles.

Thanks for this. I've been naively using containers. Yes, a UI for profiles would be awesome- we've been wanting that for a long time.

You can either start firefox with `-P` to the profile chooser when starting firefox, or navigate to `about:profiles` to show the UI for managing them.

Would allow greater discovery if this `about:profiles` page was exposed somewhere in preferences, but at least there is something I guess.

Re: Trello handed over my personal account to my previous company

#154

Post by usr1106 »

znpy wrote: post #127
shock wrote: post #105

Earlier quoted context omitted.

> separate Chrome profiles or Firefox profiles, so that none of the cookies are shared. You don't need separate Firefox profiles for that, you can use Firefox containers.

> You don't need separate Firefox profiles for that, you can use Firefox containers. Firefox Containers are awful. Only firefox profiles can give you true separation. It would have been better if Mozilla had added a better interface to profiles.

> Firefox Containers are awful.

Any details, how do they leak?

> Only firefox profiles can give you true separation

I don't think they would help a lot against fingerprinting. (I have no idea how commonly used fingerprinting is at the moment.)

Re: Trello handed over my personal account to my previous company

#155

Post by Silhouette »

JMTQp8lwXL wrote: post #3

In this day and age, sharing this community forum discussion here is the only way to get resolution. I'm happy helping people out and tweeting my displeasure with companies, but we need some way to scale this. We can't just help the people that get enough publicity. We think we're helping, and we are, but only a small amount of situations end up getting front paged.

The way to scale this is with actual laws.

For example, it's hard to believe that an organisation not only handing over an obviously personal account to enterprise management but then failing to fix the problem when explicitly notified isn't in flagrant breach of the GDPR in Europe. The entire account tied to a personal identity could reasonably be considered personal data, which brings obligations in terms of properly managing and safeguarding that data and in terms of allowing the user to retrieve it and erase it, among other things.

I'm not generally a fan of how the GDPR was implemented in practice, but in cases like this, the sledgehammer-nut principle might well work in favour of the little guy. Going after both the hosting service and the former employer if they fail to disconnect the personal account and retain control over it when notified seems like exactly the sort of thing the regulators ought to be doing. This is such a flagrantly inappropriate policy that some sort of punitive fines to make an example don't seem out of the question.

Re: Trello handed over my personal account to my previous company

#156

Post by geocar »

lki876 wrote: post #146
geocar wrote: post #110

Earlier quoted context omitted.

I’m not sure I agree. I have provided GDPR consulting in the UK over the last three years. What exactly do you think was a violation?

GDPR protects personal data, which the EU interprets very broadly. When you are working and what you are working on is included, for instance. That's basically a Trello board. Processing of such data (e.g. handing it over to a third party) without explicit consent is subject to major fines.

> GDPR protects personal data, which the EU interprets very broadly.

This isn't accurate. Individual member states can and do interpret the GDPR differently.

For a European company, the country they are "at home to" is the one that will govern them, not the state that the individual belongs to. If the company is not "at home" in the European Union (for example, because it is in the US and has no European offices and does not trade in Europe), then the rules of the individual's member state will apply.

The details matter.

> When you are working and what you are working on is included [as personal data], for instance

No: Not in the UK or Ireland (which I'm most familiar with) and probably not in any other European country.

Personal data is data that identifies a natural person, or that can be used to identify a natural person, not that is produced by a natural person.

The ICO has excellent (English-language) literature on this subject:

https://ico.org.uk/for-organisations/guide-to-data-protectio...

It may be that storing (say) your email address on every Trello card would be personal data, but then you can follow the process to have this data identified and removed by sending a letter requesting it be returned to you and destroyed. Trello would not be required to figure this out on their own - you would have to tell them how to identify your personal data.

https://ico.org.uk/for-organisations/guide-to-data-protectio...

https://ico.org.uk/for-organisations/guide-to-data-protectio...

> Processing of such data (e.g. handing it over to a third party) without explicit consent is subject to major fines

This isn't what the GDPR refers to as processing, and it is absolutely possible to process personal data without explicit consent. For example, the ICO suggests no less than five separate ways that are not explicit consent:

https://ico.org.uk/for-organisations/guide-to-data-protectio...

And again, I don't agree that "Trello cards" count as personal data. You can call the ICO (if you want) and ask them if you think otherwise; I have done this several times and they've happily sent me written clarification on any theory I might have (including on something that is similar to this):

https://ico.org.uk/global/contact-us/

Re: Trello handed over my personal account to my previous company

#157

Post by boraoztunc »

After seeing the comment from Blair at Atlassian on Community forum, I also noticed that Support Team replied with a lot more care seeing that the conversation went public. Not good.

In the first stage, they should have already made the right decision, handing over the account to its rightful owner, without any hesitation. I hate companies favoring companies over individuals. I thought this was a mindset of old school businesses, not our current tech ones, the ones that build their success on us.

I was already reviewing new tools for organizing plans, today I'm removing all my boards and closing my account on Trello, as my civil response.

"Apathy is the tyrant's greatest ally."

Re: Trello handed over my personal account to my previous company

#158

Post by Silhouette »

diggan wrote: post #112
dreyfiz wrote: post #60

GitHub did this to me a few years ago. I still feel violated. Not by my idiot former employer. I feel violated by GitHub. I got my account back. Sort of. They detached a significant amount of my content from my account, and returned to me a gimpy lobotomized version of myself. All my old GitHub comments are credited to “ghost” now. I was somewhere in the first 12,000 GitHub accounts. My relationship with GitHub signi…

> I trusted GitHub I feel like every netizen goes through this at one point of their life, where they trust an entity, get burned, and learn the lesson of never trusting another entity (100% without condition) again, keeping your data closer to yourself. Much like in real life, where at one point you trusted some too much/naively, and after that point you're more careful, even of things/people you do trust.

A lot of people seem to develop a strange sense of loyalty to services they like (and haven't been stung by, obviously).

Try suggesting that you can run a software business without using GitHub as your single point of failure^W^W^W^Wsource control system, and a lot of young developers will just laugh and wonder what you've been smoking.

Try challenging Apple's walled garden philosophy and suggesting that their mobile devices could implement standard protocols for transferring your own data on and off them directly like almost every other mobile device in the past decade, instead of relying on their not-properly-secured iCloud system, and plenty of Apple fans will wonder why you might care.

Even the HN community falls victim to this mentality from time to time. I find people here tend to be more rational about these issues than average, but any suggestion that one of the YC success stories that has become an HN idol has done something unwise or even bad can sometimes end up brutally suppressed.

It would be better, IMHO, if people kept in mind that behind these services they have allowed themselves to depend on so much is usually just a business, even if it's a big and famous one, and that businesses generally have no obligation to anyone to continue doing anything other than to the extent that either the law requires it or there is compensation changing hands and a contractual obligation.

Re: Trello handed over my personal account to my previous company

#159

Post by megavolcano »

This is why I don't use SSO for personal affairs, unless required. The convenience is not worth it to me, especially because I just use a password manager to log me in anyway. The provider will just cut you off at a moment's notice and then tell you to shove it. Besides, logging in is faster than having to be redirected to another page just to use my password manager to log in to my google account, redirect me back and then I'm in...just log in directly.

I also never, ever, for any reason, no matter what, no matter where, or who, or who I am with, or where I am going, or where I've been... ever, for any reason whatsoever link a business email account to a personal account. I use different browser profiles and keep all that stuff segregated.

Re: Trello handed over my personal account to my previous company

#160

Post by mcv »

scoot_718 wrote: post #71

If this happened in my country that would breach privacy laws. It might also constitute hacking depending on what kind of administration the company does.

I agree. This sounds a gross violation of EU data privacy laws. Not every country has those kind of data protections for their citizens, unfortunately.

I hope that all Europeans hit by this will make an issue out of this that will make Atlassian and other companies think twice before doing something like this again.

Post reply on HN