Thanks for pointing out this issue, Ben.
I am curious why you did not mention whether there is an option to simply delete your Google Apps account before letting the domain expire?
Do not let your domain expire with Google Apps
11–20 of 70 posts
Re: Do not let your domain expire with Google Apps
#12Making sure to renew your domain name is a good solution if you actually want to keep your domain. But what if you are done with that domain, and purposely let it expire? Is there a way to delete your Google Apps account entirely before letting the domain name expire, so the next person to register that domain can start from scratch with Google Apps, as if that domain had never been used before?
Re: Do not let your domain expire with Google Apps
#13You have likely broken the law by accessing that Amazon account which was not yours, and now you blog about it. It might be a good idea to talk to a lawyer. not a legal advice
Good idea to talk to a lawyer? I'd wait until you're actually sued before wasting your time and money worrying about something so stupid. Most people aren't going to sue you if explain what you did (and why) and it's obvious you had genuine intentions.
Re: Do not let your domain expire with Google Apps
#14Any thoughts on how Google could prevent this? Seems important they provide a way to reclaim domains.
When a domain is being reclaimed by someone signed into a different Google Account than the previous admins, check if the domain's whois creation date has changed, and if so, make it mandatory to wipe out the data previously associated with the domain before continuing.
In addition, password resets via email requested at domains having the whois creation date after the account creation date should probably be disabled.
Re: Do not let your domain expire with Google Apps
#15Any thoughts on how Google could prevent this? Seems important they provide a way to reclaim domains.
Require a phone number and send SMS for accessing domains which have previously expired.
Re: Do not let your domain expire with Google Apps
#16Any thoughts on how Google could prevent this? Seems important they provide a way to reclaim domains.
Require a phone number and send SMS for accessing domains which have previously expired.
That won't work for existing customers since requiring a phone number must be done when initially signing up.
In addition, expired domains purchased by someone else won't be usable with Google Apps.
Re: Do not let your domain expire with Google Apps
#17It sounds like Google have changed their policies on this. Just a few months ago I was caught on the other side of this issue. Basically I bought a domain and wasn't able to get Google Apps set up because someone else had used it in the past. Here's the full story: http://www.onlineaspect.com/2010/11/12/issues_with_google_ap...
Thanks JoshFraser, I have appended a note to the blog post to check your comment on here. Although the Google Apps team may have altered their policies according to my blog post which I contacted them about 2 months ago. This issue is still a serious matter. I would have still been able to access the person's Amazon account using a wildcard email address. Although it does lessen the blow if a social engineer takes a hold of your domain as they might not be able to get into your GMAIL, but the real lesson here is you shouldn't let your domains expire with any form of identity or online accounts still attached to them.
It's also a cautionary tale of what you leave up on the cloud when you abandon your email account. I could have potentially found a lot more damaging information from gaining access to this persons email.
Re: Do not let your domain expire with Google Apps
#18A few weeks ago I tried to register Google Apps on a domain I purchased, and found that it'd already been registered by someone else. I sent an email to the support team explaining that there was a previous account and that I was the new owner, and upon proving that the domain was now mine they deleted the old account and had me start anew.
Obviously, while the email-support method is safe, the automated system for unlocking admin access based on "proof of ownership" is pretty scary! Seems like this could be solved by requiring you to prove ownership and then releasing new auth info to a linked email account on a different domain. That helps to establish both present ownership and a chain of ownership back to the last time you had authorized access and were able to adjust the "emergency email account" setting. It's not perfect, but it's a heck of a lot better.
It also seems to me like someone wanting to abuse this right now could do so pretty easily: you can confirm that a domain is available and that it has had a google Apps account set up in the past before you spend a dime, so you can just set a computer to trawling known Google Apps domain names (e.g., by looking at traffic on large mailing lists) to find ones whose registration has expired.
Re: Do not let your domain expire with Google Apps
#19You did not completely censor the last screenshot.
Re: Do not let your domain expire with Google Apps
#20Any thoughts on how Google could prevent this? Seems important they provide a way to reclaim domains.
I think that the trust model for Google Apps account recovery is wrong. The domain name is a separate asset from the Apps account and the data in it.
The owner of the domain name should be able to create a brand-new Google Apps account for it. Recovering access to an account should be done through another channel (secondary email address, SMS, postal mail).