From the comments, there is some confusion about why did i attach my personal email to a company account. That was not the case, let me clarify it.
I created my personal account long before Trello was acquired by Atlassian. It did not have any SSO at that point and the login was with username and password. At some point, while working on a side project and to share it with a teammate, I attached a secondary email to my account and created few boards under it. This email was my companies email @company.com
The multiple account login used to work the same way it works for github now. The boards were very clearly labeled under the email/username they were created and clearly had the ownership well defined. As soon as I left the company and my email was disabled, all the boards under that email disappeared from my account. This was expected and kept using my primary email (i always used to login with my username) and completely forgot about an attached secondary email (which anyways is now deactivated). Fast forward 5 years with tons of personal boards under this account, one morning it stopped working without any notification (yes i revised my spam to be sure about it) with all my data gone.
Wow, their response is atrocious. It's basically just "Yes, that's right, there was a second email address attached to your account and the owner of the domain for that email set up SSO, so they now own your account. Try asking them nicely for it."
I started disentangling myself from Atlassian products a few years ago but I was still using Trello. Clearly that's going to have to stop.
Instead, I have a strict separation rule for these kind of services.
No work stuff is hosted in my personal accounts, and work accounts are always created with a separate e-mail. I can just remove myself from everything work related without touching anything personal.
While I was working with a small group, we had our own domain and e-mail addresses as a perk. My relationship went sour with the lead of the project and, as a power move, she disabled my e-mail and other accounts related to that group, guessing that a lot of stuff is connected to this e-mail (since the domain was prestigious in that circles) and doing so will hurt me a lot.
Since only things related to the group/work was on that e-mail, literally nothing happened. I just broke off cleanly from the group and, a move designed to hurt me brought bliss to the parting process.
Meanwhile on Facebook you cannot create a page for a business(say you work in the marketing department) without linking your PERSONAL account to it. Absolutely fucking insane.
That's a completely different thing. One, Facebook is based around the concept of a real person being behind just about everything - when you administer a group, you can see which person posted the individual company/page posts. Two, nothing can happen to your personal account based on the actions of the company page or other people associated with it.
> One, Facebook is based around the concept of a real person being behind just about everything - when you administer a group, you can see which person posted the individual company/page posts.
So do it the same way every other website on the planet does it: have an organization and users who have roles within that organization. It's beyond aggravating the way they have them so strongly linked.
> Two, nothing can happen to your personal account based on the actions of the company page or other people associated with it.
.... I'm guessing this hasn't happened to you. Yes, they will block your personal account for "certain" infractions committed by the business manager. Nearest I can tell it depends on how you set up the business. If you set up the business FB page first, your personal account is considered primary so all blame flows to it. If you set up the business manager first, and THEN set up the page using the business manager (NOT the page creator), then it won't affect your personal account; and if you invite someone, no, that person's account won't (generally) be affected either.
Except that FB always drives you to create the business PAGE first and LATER suggests the business manager... thus increasing the likelihood of blocks. It's pathological. Especially because you can blocked for nothing other than their AI misidentifies something in an ad or a post, kills all your accounts, and then you have to beg to get them back.
Point is, that relationship shouldn't exist in the first place.
I have separate personal and work Trello accounts. After seeing your report, I checked to make sure they're still separate. They are but each have access to each others' boards.
I have yet to figure out how to deactivate that.. but since they're separate users (vs secondary email), I don't think the same will happen. But who knows? Not me.
There is no shortage of atrocious examples, like this one, that prove that people need to take digital sovereignty seriously. Our data and our interactions should not be intermediated by some digital feudalistic lord, without any recourse when something goes wrong.
Atlassian is not the only one who wrecked login by implementing SSO across all their instances.
I really don’t recommend using in-app dual logins (for example Gmail’s dual login), and stick to using separate Chrome profiles or Firefox profiles, so that none of the cookies are shared. Even with that, I’ve had surprises with my mobile phone number being the only shared information between two Google Ads accounts, and Google mixing my data, but avoiding sharing cookies is really important.
That is also what I recommend my employees. « You can use Facebook or Youtube at work, but not in the same Chrome profile. »
> It would have been better if Mozilla had added a better interface to profiles.
Profiles in Chrome and their ease of use (Cmd+Shift+M to open a new window in a different profile) is the primary reason I still use Chrome over Firefox. I have a Personal, a Work, and a Development profile. The development profile is where I install dev extensions like React Devtools, Redux Devtools, etc. because they require full access to all sites in order to function. I don’t do regular web browsing with devtools installed. These tools seem trustworthy, but why risk giving them access to everything I do on the web?
I’ve tried Firefox Containers and can’t find the same power and ease of use Chrome Profiles have.
I see your point now, I was preferring containers because I have this scenario where I want the data separation it provides without the need of reinstalling add-ons, especially on a temporal container/profile. The shared window can be nice on some particular moments where I don't need to have a lot of pages opened and are continuously changing from tab to tab.
Thinking over about you said, now I think I like things from the two worlds, maybe better interface to containers or even better UI for profiles, with options to overcome the containers (maybe should be better for the average user instead of having both).
For the time being, I prefer to have both options (don't have it now) but I think both can be improved.
Upside of Chrome profiles: Use a bright red theme for prod sysadmin profile, and blue for work. So you never type « p... » on your work profile by mistake... Don’t laugh, usage is widespread.
I do exactly this too: I have 3 distinctly different themes for the three profiles I use. A split second glance at the color of the tab bar informs me which profile I'm working with.
I'm not znpy so I don't know why they don't like containers.
But I prefer profiles myself, as I have different extensions in different profiles and I get the two completely separate instances of Firefox, while containers are just separate tabs instead.
I don't think containers are awful though, they are just less useful for my use case than profiles.
I sometimes have issues with the profiles too though. If I have both profiles running concurrently and I click a link from a different application, I get an error that "Firefox is already running" and it freezes up the window with my primary profile.
If you dig around, there is probably a value in `about:config` that lets you tell firefox to always show the profile selector first. Otherwise, add `-P` to the argument fields in your desktop shortcut.
Extensions, mostly. You have to be real careful which extensions you install because extensions run at the window level (mostly) rather than the container level and see across/through containers.
Also things like auto-fill (including password suggestions); if you like that being very specific to context, then you'd want different profiles rather than containers.
I've found I've been using a mixture of profiles and containers, myself, to balance ease of access (containers are fast to launch and can auto-launch per specific sites) versus better extension control and auto-fill/etc separation.
(ETA: As for finger-printing, both containers and profiles are equal on the most common finger-printing: cookies and localStorage. Neither protects you well from IP Address tracking, which is a growing concern, but not the approach of at least the big players like Google or Facebook, yet.)
True, but by using profiles you don't need any extra extensions, it comes built-in in both Chrome and Firefox, you can simply start it with providing the `--profile <path>` flag. Correct me if I'm wrong, but some IT environments also lock down installing extensions from addons.mozilla.org, so the profiles tip would be applicable to more people.
You can just use --profile <name> -- with only the name of the profile.
Also, you can backup/restore/move profiles independently of each other.
Also, you can have different network settings for different profiles (not sure you can do that with containers).
For example I have a profile whose network connections are such that traffic is forwarded through a socks proxy (implemented via ssh). That's basically an ultra-simple vpn. I can then (via a script) automatically launch the tunnel open firefox with the appropriate profile and then exit firefox and gracefully stopping my tunnel.
I remember it used to be a native feature but I'm fairly certain they split it out into a separate addon after a while. Or did they move it back into core?
Partly because Mozilla is continuing to iterate/experiment on the container UI and leaving that to extensions is a way to keep that laboratory open. They seem worried the UI may be too confusing if it was on by default for a lot of users. (Like the era decades ago when -ProfileManager was on-by-default in some installs.)
Mozilla even has two official extensions, trying to explore the space of ease of use/user expectations. In addition to the main multi-container extension they offer Facebook Container which is an extension designed to be more entry level but for folks worried about privacy. (It does what it says on a tin, creates only one additional container, names it Facebook, and automatically moves all Facebook tabs and pretty much only Facebook tabs into it.)
We had the same with Amazon, we created a new Amazon account but shared the telephone number. Support sent emails to the first account concerning the second account.
I have stopped giving out phone numbers to services. I can get throwaway email addresses (eg anonaddy.me, which is great) but burner numbers incur a significant time and cost, so I just don’t use services that demand one now.
Google Accounts fall into this category these days. Possible I’ll deprecate my use of those, as I don’t use gmail or drive any longer.
I had to use GDPR to force them to delete one of my accounts because my account got stuck in the registration where I could not complete the registration and could not delete the registration either. First time I used GDPR for anything. Support did not understand the situation, I waked through them the issue with screenshots, nothing.
Serious question as someone who does not use any "cloud" services: Did you not have a backup of your data in Trello? Orthogonal to the issue of account ownership, on which I stand firmly in your favour, did you not have a backup of the data? What would happen if Trello went bust, or somehow otherwise lost your data?
GitHub did this to me a few years ago. I still feel violated. Not by my idiot former employer. I feel violated by GitHub. I got my account back. Sort of. They detached a significant amount of my content from my account, and returned to me a gimpy lobotomized version of myself.
All my old GitHub comments are credited to “ghost” now. I was somewhere in the first 12,000 GitHub accounts.
My relationship with GitHub significantly predated my dalliance with this one employer years ago. I trusted GitHub. My GitHub account was a formative part of my identity. I still can’t believe it and I still can’t forgive them. I lost some of my sparkle that day.
It's also why I oppose using social authentication with anything. While we have access to our [Facebook, Twitter, Github, Google, LinkedIn] account today, what happens if they shut it down? We have no clue of the real consequences and no appeals process. It's the worst of both worlds.
That’s one of the motivations for the “new” project Tim Berners Lee is working on, Solid. The amount of foresight people working on the web have is crazy. I read an article interviewing Lou Montulli the other day and was amazed to find out how how extensively he thought about the nefarious use of cookies when they were being designed
Funny because when those same people actually had a chance to stop alot of the privacy violating and non-open things in the web they caved to the pressure from Google, and others to make the Web less open, less private, and less free.
Tim Burners Lee was one of those people that caved with HTML5 standard, and several other standards under the W3C
The specter of this sort of violation hangs over the shoulder of every internet user now - the loss of an account on a service like Facebook, GitHub, or Trello could be life-altering. Our digital selves are all at risk of becoming The Trial's protagonist.
Do we have any protection besides moving to a new platform that's not big enough to betray its users yet?
Unix graybeards selfhost. That saying "cloud is someone else's computer." is relevant here.
Now, you can ask, what self-hosting really means and that is complicated. Does rented server count? Colocation? Or only way is own premises? I have worked places, where last one is hard requirement.
Generally though, I am pleased with colocation, some places even have customer provided locks on racks.
But even if you have cheap VPS, at least you can backup it (regularly and before troubles) and restore some other place. With SaaS, you can't always have export in nice and useful form.
The funny thing is, everyone used to self-host. A home ISP account typically came with an email address, some space to host a website, etc. Of course you could set up other facilities as well, but even without that, you had control of the storage. The Web was full of articles on how to build your first home page, which plenty of non-geek people managed to do just fine.
The biggest danger back then was probably that if you changed ISP then you'd lose access to your old email address. That's still a danger with any email hosting service, including the likes of Google that people often use instead today, and it's why I advocate everyone registering their own domain for life. Email is still the root password to your online existence in almost every case, and letting any third party have more control of it than is strictly necessary is a really, really bad idea.
I would love to see a move back in that direction, which home ISP accounts allowing access to some sort of "starter kit" home server in the same way they probably provide most customers' starter modem/router/wifi equipment already, and with more software built that was aimed at being self-hosted and accessed via your home network or remotely through a VPN.
Sadly, I think this is unlikely, because there's just too much momentum behind the massive social networks and other online services. So instead, every now and then, a large chunk of someone's online life is going to get wiped out by the kinds of poor policies we're talking about today.
No, it's not, but it's a lot closer than using some intermediary service, and it's convertible to true self-hosting if you find you need to later because the data is all under your own control and ownership throughout.
Although it's certainly annoying to lose an old account, for many services it's just a hassle.
I went through this with a Reddit account that got hacked. I was able to get the spammer shut down but had to create a new account, and really, it's okay. The people who know you will reconnect, and the others don't matter much.
It used to be that everyone got a new phone number when they moved, and we managed.
I feel like every netizen goes through this at one point of their life, where they trust an entity, get burned, and learn the lesson of never trusting another entity (100% without condition) again, keeping your data closer to yourself.
Much like in real life, where at one point you trusted some too much/naively, and after that point you're more careful, even of things/people you do trust.
A lot of people seem to develop a strange sense of loyalty to services they like (and haven't been stung by, obviously).
Try suggesting that you can run a software business without using GitHub as your single point of failure^W^W^W^Wsource control system, and a lot of young developers will just laugh and wonder what you've been smoking.
Try challenging Apple's walled garden philosophy and suggesting that their mobile devices could implement standard protocols for transferring your own data on and off them directly like almost every other mobile device in the past decade, instead of relying on their not-properly-secured iCloud system, and plenty of Apple fans will wonder why you might care.
Even the HN community falls victim to this mentality from time to time. I find people here tend to be more rational about these issues than average, but any suggestion that one of the YC success stories that has become an HN idol has done something unwise or even bad can sometimes end up brutally suppressed.
It would be better, IMHO, if people kept in mind that behind these services they have allowed themselves to depend on so much is usually just a business, even if it's a big and famous one, and that businesses generally have no obligation to anyone to continue doing anything other than to the extent that either the law requires it or there is compensation changing hands and a contractual obligation.
> Try suggesting that you can run a software business without using GitHub as your single point of failure^W^W^W^Wsource control system, and a lot of young developers will just laugh and wonder what you've been smoking.
TBH, I've never worked at a company that would host their source code at a third party service. At my first job, we wouldn't even use a web UI for the repositories (I still think that's not all that useful to begin with). At my current job, we use cgit. We use Jira (that we pay for, obviously), but as to source control --- a company hosting it on GitHub? Never seen it with my own eyes. But I work as a C++ dev, so maybe it's different here than, say, in webdev world.
Doing a fair amount of work in web dev world in recent years, we've always self-hosted one way or another, but the newbies look at you all strange like if you tell them. Then again, half of them also don't realise that Git and GitHub are different things.
> But I work as a C++ dev, so maybe it's different here than, say, in webdev world
Most likely that's the reason. I've only worked on web projects and everywhere I worked has been using GitHub for hosting the code and managing merge requests, except my first work where we used Redmine and then 6 months later migrated everything to GitHub.
I worked at a place that had virtually zero internal systems, including version control, and relied heavily on Github in particular for things like access control, beyond just source control.
One of their remote devs had his Github account hacked (pre 2FA) and then had access to Slack as well, and the hacker managed to socially engineer his way into a number of sensitive areas and increased access, to the point the company had all their code taken and a number of high GPU Amazon instances started to generate crypto coins to the tune of a $35,000 EC2 bill.
I'm from the old school and have never trusted third party services for anything critical to the company. I'll admit a bit of internal gloating after that incident.
But that sounds like a case where the attacker would have gained access to most relevant stuff anyway, and the difference in effect was mostly to the tune of $35k in costs (instead of spending resources on companies' own hardware)? While that's a big chunk for a start-up, it's not even one year of a developer salary.
While I am of the similar old school like you (I run my own mail server, web server, nextcloud, used to do ejabberd too...), I think it's more cost effective for smaller companies not to do it themselves, as long as they keep their own backups.
The difference is that when they self-host, they are more vulnerable to targeted attack (on average, for similar dollar investment), but if they host with SaaS providers, it's opportunistic attacks they should worry about more.
It was more that their entire code repo was downloaded, which included a number of third party access codes, nevermind the intellectual property involved.
If that stuff is only hosted internally behind a firewall, with a VPN requirement to access, it would have been fine. Instead it was all on Github.
Right, but if they hacked a particular remote employee who had access to it, they could have gotten access to the same stuff — their attack vectors might have been more limited, that is true.
> At my first job, we wouldn't even use a web UI for the repositories
It's been a long time since I used it but I used to lean on gitweb for this at places that self-hosted git repositories but didn't have any UI layer on top. I remember it being perfectly fine for my needs.
> Try suggesting that you can run a software business without using GitHub as your single point of failure^W^W^W^Wsource control system, and a lot of young developers will just laugh and wonder what you've been smoking.
To be fair, this example isn't quite as bad. It's simple enough to add a new remote to your working copies and host your repo elsewhere. It doesn't help with GitHub-specific features like comments or integrations though
Usually complaints like this have more to do with the social processes around coding than the actual task of storing and versioning source code (which as you say is portable and standard).
"I want to make a change to a shared library. Why can't I make a pull request?" "Wait, I have to use this unfamiliar interface to make comments on other people's changes and I can't leave comments on specific lines?" "You know, if you used Jenkins and Github then you could show the status of passing or failing tests right here on the code review screen..."
These social pressures are really quite strong. They affect a bunch of open source projects especially: people who want to make changes expect code to be on Github and might even mirror it there themselves (creating confusing situations for anyone trying to contribute). Even if the project does host its code on Github to allow for contributions from Github users, Github is (naturally) not very good about directing its users off of its platform to where the existing discussion and development is going on. "It's easier if you just do everything on Github" says Github, and their users by and large agree, and slowly more and more process (code review, merging patches, CI, documentation) gets sucked onto Github by the platform effect.
Indeed, only big free software silos manage to fight this push off (think Gnome, KDE, Debian, FreeBSD... and even some of those are partially pulled in like Ubuntu, which even had its own hosting platform in Launchpad.net).
I like to say that I was a free software developer before github, which means that I never really participated in it, but I frequently feel excluded when I am asked for my github profile ("sorry, there is nothing there, but I can point you at a dozen other repos...").
I am still resisting, but who knows for how long :)
I feel moved to strictly only use fake names online. Like..
I recently moaned and whined to my friend about how when i was growing up a person/entity (to my recollection) would feel.. like they received a magical gift just to send a message online.. having a web page was like.. winning the nerd superbowl.. Now it's like.. we are supposed to take a knee to any company that gets sufficient presence and significance (linkedin, etc trying to find a job).
What actions had you taken toward trying to remedy this
?
Usernames probably come from the multiuser nature of early computers, and some of the early limitations of software implementations (eg no spaces so your homedir could match your username on a fs that supports no spaces).
Aliases or nicknames are a common human choice, which allows one to be represented by a word/name of one's own choosing that portraits you in a light you want, without tying to your real identity which might have other implications (sometimes negative, of course).
I'm not sure how they started. Was it because of people feeling their 'honest' self info was being used to identify then control them via highjacking their personal accounts in honor of some ex employer?
I wonder if this is something you can sue them over. Do you legally own your content? Did they or the former employer steal something from you?
It's bizarre to see so many companies handle this in such a user-hostile way. It looks like a clear sign not to use Atlassian or Github for anything private. Makes me wonder if Gitlab might be next...
GitHub organizations should make this a non issue. I assumed that they’re mostly competent, but if literally any past job I had could pull the plug that’d be a huge problem.
I'm not sure if this is related, but I made a point of never using the social login feature, at least for personal stuff. Always signup via e-mail (my own e-mail).
The risk is just too big.
With login via email I can still be in control of that account no matter what.
If only there was a way to do that without creating multiple accounts.
At least my company doesn't host anything on public guthub (guthub for enterprises has everything) so they don't need to be connected. If you have personal and company stuff you are in trouble even if you separate them.
Subject: Your company ExampleCo will soon manage your Trello account
Good news! Your Trello account is getting an upgrade.
ExampleCo will now manage Trello accounts with a example.com email address,
which includes yours (mjd+trello@example.com).
The "Good news" part looked like marketing bullshit, but the rest of the message was menacing enough that I was able to contact them by email and get instructions about how to avoid having my personal Trello handed over to ExampleCo.
It still sucks.
The lesson I take from this is: “Software as a service” is always a security risk. Unless my data is on my server, someone else owns it and might sell it to a higher bidder.
This is one of those “fool me twice, shame on me” moments.
Isn't it standard to open separate accounts for companies? My employers would've never even allowed me to use a personal account or personal email for business content. In the end, they need to be able to claim the content if an employee leaves the company. Mixing personal and company accounts or even accounts of several employers sounds dangerous to me.
> Isn't it standard to open separate accounts for companies?
I understood that these were separate accounts in separate systems, they just had the same email address attached to both because it was convenient to log into each system from separate workstations - a little bit like using a company phone for a personal telephone call. When one company (Atlassian) acquired the other (Trello), the "accounts" were merged by someone who has no taste.
> In the end, they need to be able to claim the content if an employee leaves the company.
I don't agree with this at all, and thankfully tort doesn't work this way.
> Mixing personal and company accounts or even accounts of several employers sounds dangerous to me.
Indeed. This is a big reason why I don't like to create "free" accounts, because I know unless I pay them, I cannot sue them for fucking something like this up.
> I understood that these were separate accounts in separate systems
That's not what I'm seeing in any of the examples discussed in this thread. What I'm seeing is one account which started out as a personal account, then the person added their work email to it so they could get access to their employer's data through that account--instead of creating a separate work account under their work email.
Now their "personal" account isn't just personal any more; they have given their employer a means of controlling it, since their employer controls their work email. And then they have problems down the road. The solution to those problems is to never attach an email you don't control to an account you want to have sole control over.
When I was consulting it was common for companies to add my professional e-mail to their services, because forcing me use an e-mail provided by them could be used as proof of employment, and that's something they didn't want.
They used to create an account using my professional contact email without asking, of course, and it would give me all sorts of problems with some SaaS services. Stuff similar to the ones in this post. Most of the time it was harmless (I'd lose access to another client), but it was always a headache.
The middle-of-the-road solution for me was to nicely ask them to remove it and use something like companyname@mydomain.com.
Of course the @mydomain.com solution didn't work for long as well (thanks, Salesforce), so I started using throwaway Google Accounts.
> They used to create an account using my professional contact email without asking, of course
I don't understand how this is an issue. Just don't confirm the account. Or are there SaaS platforms where you can add users with arbitrary emails without confirmation?
> Or are there SaaS platforms where you can add users with arbitrary emails without confirmation?
In my experience, yes!
But the problem is not so much them adding without asking, it's the fact that the SaaS companies are making random assumptions regarding who owns the email account, or who owns the domain name of those accounts, and not letting users know that before accepting. Apparently only gmail/hotmail/yahoo are safe, unfortunately.
Of course there are! And it's all part of SV culture.
A few years ago I tried to sign up to LinkedIn only to find out I already have an account. But it was not my account - it was someone else's, who has a similar name (and apparently thought my email address was his? I don't know...). I could reset the password and log in to his account. I was a bit scared when I contacted LinkedIn support, because I was worried they would accuse me of hacking. Eventually they disconnected my email from his account.
Now, I know that LinkedIn isn't a SaaS platform, but you would think that such a big company wouldn't make such rookie mistakes. Even if they launched without email confirmation, and added it later, there should be some mechanism to "fix" the old accounts.
I think it's especially common for mobile apps to accept emails without validation: I have a couple of accounts for different people with similar names on my rarely used gmail email.
I opened the account with my personal address. Then later, I added a secondary email address to it so that I could post items to my personal account by emailing them from my work email. I didn't realize that Trello would interpret this as the account now being owned by my employer and, in hindsight, I don't think I could have foreseen this.
"Use another Trello account for anything not related to [my previous company]. Grab a new, free Trello account in seconds and move your vacation board (or whatever should be elsewhere!) to that one."
My former company is not even using Trello and everything I have there is personal. I created the Trello with my personal email and only afterwards added the company email to it to access some experimental board we never ended up using.
I didn't comply and instead just removed the company email from the account. I seriously don't see why I need to create a new account and move stuff for no reason at all. Why does the organisation email trump my personal one that I actually created the account with? Should I be worried?
> Why does the organisation email trump my personal one that I actually created the account with?
Because the organization a) pays them money, and b) demands this. Enterprise offerings like SSO tend to support the legal and pseudo-legal aspect of the security theatre of enterprise space. So if you connect a company e-mail to your personal account, that account suddenly falls under whatever random policies organization's IT team implemented.
I feel pretty lucky that I've only ever used Trello with one ExampleCo -- so when I got this email, I signed in, removed myself all ExampleCo boards, and deleted my old ExampleCo email address from my account.
This process isn't too bad if you actively work at ExampleCo, but if you left it years ago and are still on some boards... yuck.
AVOID whenever possible sms-based 2fa. Use totp codes.
SMS makes your phone a single point of failure [1].
I currently use the OTP feature of keepassxc, so that I can still generate otp code but can have those codes replicated on my trusted devices. You can save the seed of the TOTP and re-install the otp on other devices too.
[1] plus you should really try and depend as little as possible on your smartphones. smartphones are the leash of the third millennium. the less you are dependant on it, the free-er you are.
Atlassian, at its core, is a software integrator. They buy stuff and add it to the heaping pile of duct tape garbage they’re schlepping. Trello is just another skull and crossbones on their long list of pillages. It was only a matter of time before the integration got some steam and the atlassian cancer began to take residence.
Sad because it’s my go to tool. It’ll hold on for a while longer but at some point they will turn it into some sort of Jira Kanban+
I have a single E-mail account that I use for everything. I decided more than ~20 years ago that my E-mail is tied to my identity and not to any particular E-mail service or employer, and I started managing my E-mail myself.
Trello just notifided me that:
> At least one of the email addresses linked to your account belongs to an organization:
[...]
> This usually means it's a work email. If this organization begins using Atlassian products while this email address is linked, your account could become managed by that organization, which means you could potentially lose access. If you don't use Trello for work, just select a non-organizational email.
I use Trello myself, as well as in connection with several organizations. The idea that someone can "claim" and "manage" my account is outright ridiculous.
Even worse, in a show of incompetence, their "Confirm email" link doesn't work (times out because the server is seemingly down).
Just received the same email, and had the same experience as you. Servers are not responding.
Now I'm no longer using Trello as I moved to tasksinabox.com 2 years ago, but I don't see why the information I have there should suddenly be transferred to a company, out of my control and without my permission, just because somewhere there is an email address with a company domain name attached.
I understand the old "lure shadow IT users in with a 'free' service, then offer IT to take back control at a price" scheme, it's a bit of a dark pattern, but then the per-existing users should have the option to opt out of the retroactive appropriation.
I do hope that once the 'confirmation' page comes up, there will be the option to remove the company email from the account, and assign a different address in its place.
I'm a former Trello employee - trellis.coffee is the domain the primary dev server is hosted at. It sounds like they failed to excise your email address from the dev database (at least, that's what we did when I worked there).
In this day and age, sharing this community forum discussion here is the only way to get resolution. I'm happy helping people out and tweeting my displeasure with companies, but we need some way to scale this. We can't just help the people that get enough publicity. We think we're helping, and we are, but only a small amount of situations end up getting front paged.
Interesting idea re: scaling. I agree this is a pattern we see time and time again with different companies on here. I wonder what a service built around this idea might look like? It’s basically outsourced customer service, isn’t it?
It seems like HN is in a sort of Goldilocks zone, where it isn’t as crowded as Twitter but gets enough attention that companies are pressured to respond. I’m not sure how replicable these characteristics would be to a platform tailored specifically to this customer service problem.
I don't think technology will be a long term solution. What I think the industry needs is tighter regulation and incentives for companies to not "move fast and break things", lest they get slapped with large fines. The issue is that I don't think the majority of politicians are informed on the social cost of, say, not serving a website over HTTPS or encrypting data at rest. Until then, this sort of thing will keep on happening because ultimately companies don't have a disincentive to do otherwise.
Companies in markets at scale are very much 80/20. That's one of the reasons government services are so expensive. If these services were fair to everyone, they would be orders of magnitude more expensive.
For example, it's hard to believe that an organisation not only handing over an obviously personal account to enterprise management but then failing to fix the problem when explicitly notified isn't in flagrant breach of the GDPR in Europe. The entire account tied to a personal identity could reasonably be considered personal data, which brings obligations in terms of properly managing and safeguarding that data and in terms of allowing the user to retrieve it and erase it, among other things.
I'm not generally a fan of how the GDPR was implemented in practice, but in cases like this, the sledgehammer-nut principle might well work in favour of the little guy. Going after both the hosting service and the former employer if they fail to disconnect the personal account and retain control over it when notified seems like exactly the sort of thing the regulators ought to be doing. This is such a flagrantly inappropriate policy that some sort of punitive fines to make an example don't seem out of the question.
In 2016 I lost access to some repos on bitbucket after a similar occurrence. I made the mistake of using my (student) university email account to register with bitbucket (it was the primary email account I used for everything at the time). At some point, my university apparently decided to use Atlassian services which completely disabled any ability I had to login to that account. I don't know if linking together all accounts under a domain is just the default behavior from Atlassian or if both this former employer and my university decided to screw people over, but either way it's a stupid situation and unsurprising at this point.
> In this case, I did not even use the company email. I was my personal gmail.
From the Atlassian community page it looks like the Trello account in question was linked to both your personal gmail account and an email account belonging to your former employer. Was that Trello account only for work items for that former employer? Or was it a mixture of both work items for that employer and personal items for you? Or was it just your personal account that happened to have your work email as an alternate email address?
If it was just a work Trello acccount with your former employer, then I'm not sure why you would need access to that Trello account now that you're no longer with that employer. Atlassian is giving you the option of disconnecting your personal gmail from that account so you can create a new one if you want a personal Trello account.
If it was a mixture of work and personal items in the Trello account, then the obvious lesson learned for the future is to not do that.
If it was just your personal Trello account, I don't see why your previous employer would have a problem with telling Atlassian that it's not their account and that the email address in their domain can be removed.
In any case, it doesn't look to me like this situation is Trello's fault. You say in a comment on the Atlassian community page that "It is very evident from the reply that Atlassian favors corporate accounts over individuals", but I don't see that they are favoring either party here. In fact they are refusing to favor either party, by refusing to make a decision--which email the account "really" belongs to--that they should not be making. This is something the two parties involved--you and your former employer--need to work out. It's not something Trello should be deciding. They have no way of knowing which party--you or your former employer--is the "right" owner of this account.
I will try to set some context here. I created my personal account long before Trello was acquired by Atlassian. It did not have any SSO at that point and the login was with username and password. At some point, while working on a side project and to share it with a teammate, I attached a secondary email to my account and created few boards under it. This email was my companies email @company.com
The multiple account login used to work the same way it works for github now. The boards were very clearly labeled under the email/username they were created and clearly had the ownership well defined. As soon as I left the company and my email was disabled, all the boards under that email disappeared from my account. This was expected and kept using my primary email (i always used to login with my username) and completely forgot about an attached secondary email (which anyways is now deactivated). Fast forward 5 years with tons of personal boards under this account, one morning it stopped working without any notification (yes i revised my spam to be sure about it) with all my data gone.
> At some point, while working on a side project and to share it with a teammate, I attached a secondary email to my account and created few boards under it. This email was my companies email
This makes it seem like it's the third of the options I mentioned (personal account which happens to have a work email as an alternate email). But what you say a little further on (quoted below) makes it clear that it's the second: you used the same Trello account for both personal and work items. If the account had access to the company's boards, it's not just your personal account any more. It's a mixed work/personal account (which, as I and others in this thread have said, is not a good idea).
> As soon as I left the company and my email was disabled, all the boards under that email disappeared from my account.
But you apparently didn't remove that company's email from the Trello account. That's water under the bridge now, but in any case it seems like the company ought to be fine with telling Atlassian that you're no longer working for them and the email under their domain can be removed from the account.
What you seem to be wanting, though, is for Atlassian to just go ahead and erase that company's email from the account, or otherwise disconnect that account totally from the company so you can use it again, without any agreement from the company that that's ok. I don't see why Atlassian should do that.
Surely the sensible option would be for Atlassian to allow you to keep all your personal boards and only show the work-email boards if you sign in, or allow you to 'disconnect' from those?
And if this is technically difficult to do (because boards are not obviously linked to email addresses, or whatever), then that's still on them, but also solvable: allow you to remove BigCo email and just not give you access to any BigCo boards.
If you happened to have created a board yourself for BigCo, then that's still available to you. And if that's not acceptable for Atlassian, they should make boards more obviously connected to email addresses. Or something similar.
The equivalent to the current situation would be to allow you to add BigCo email to your personal Drobox account (for ease of logging in), and then remove you from the entire account when BigCo revokes your access. That's extremely unexpected!
And in fact this used to be how it worked. Work boards showed up in a separate section that was clearly defined as enterprise. So my private work boards, team boards, and template boards were there. My family and personal boards were under my username. And it worked like this for years. Sans souci
Not only did they fuck it up. It was implicitly used as a feature. If you can attach multiple email accounts to a service then of course you would attach your work email to it.
The real devious behaviour was assigning your entire account to another entity to manage and without your permission. I've had to create a new account, ask the enterprise account manager to remove my account, and move my cards to another account. I've been using the account for 9 years and created many small integrations. Why would I want to give that up? Now my workflow is broken because the Trello app only allows one login so I have to decide is it going to be work or personal that I'm viewing because I can't do both.
> the Trello app only allows one login so I have to decide is it going to be work or personal that I'm viewing because I can't do both.
If you're on Android, use Island or another app to set up a local Work account; you can now install a second instance of any app under the same profile, and log it into a different account. I'm unaware if iOS has similar.
> If you can attach multiple email accounts to a service then of course you would attach your work email to it.
Why? To me this is an obvious mistake. If you need to have sole control over your access to your account, then you should never attach an email to it that you don't control. You don't control your work email.
> Surely the sensible option would be for Atlassian to allow you to keep all your personal boards and only show the work-email boards if you sign in, or allow you to 'disconnect' from those?
To me the sensible option is to have separate accounts for work and personal, and to never mix them. That way you're never even tempted to make the mistake of attaching an email you don't control--your work email--to an account that has your own stuff in it that you need to have sole control over.
Someone at my company had a Trello account they setup with their work email and recently received an email that said the account was being migrated to an existing Atlassian account. Since her email address matched the domain operated by that Atlassian account all of her todos would be migrated to that account.
Very little information was provided about the migration. My company has multiple Atlassian accounts, so we weren’t even sure which account it was migrating to.
The whole thing was a weird janky process. Anyone with an email address should be able to register for an account and information should never be forcefully migrated or merged. In her case the only way out was to migrate to an account using a different email address.
We had one of these at work earlier this year, except a 3rd party contractor suddenly found that their Atlassian account, including all their other clients, were now listed as part of our account. Neither we nor they wanted this.
After seeing the comment from Blair at Atlassian on Community forum, I also noticed that Support Team replied with a lot more care seeing that the conversation went public. Not good.
In the first stage, they should have already made the right decision, handing over the account to its rightful owner, without any hesitation. I hate companies favoring companies over individuals. I thought this was a mindset of old school businesses, not our current tech ones, the ones that build their success on us.
I was already reviewing new tools for organizing plans, today I'm removing all my boards and closing my account on Trello, as my civil response.
> At least one of the email addresses linked to your account belongs to an organization:
> <redacted>.com
> This usually means it's a work email. If this organization begins using Atlassian products while this email address is linked, your account could become managed by that organization, which means you could potentially lose access. If you don't use Trello for work, just select a non-organizational email.
In my case the "organization" is my personal domain. I'm guessing they classify any email address that isn't with a common free email provider to be a work email address.
Always keep separate personal and company accounts. If not for security reasons, then for privacy reasons. Mixing them usually yields little benefit anyway.
Let's take the personal out of it: what if you're a freelancer or a contractor and the email and account used (and subsequently lost access to) was your professional email and account? Something like scott@freetechnologies.com?
This whole situation makes me think I should steer clear of trello and clients that use it.
If you're a freelancer or a contractor, and you're doing work for someone who uses Trello to manage projects, you should sign up with a throwaway e-mail address. That's what I do for Github. That way, if that organization then decides to wipe the account or mess around with its permissions after I've stopped working for them, it's no skin off my back.
Personal stuff is personal, work stuff is work and ne'er shall the twain meet.
I also separate Github personally and professionally as a FTE. In most countries the company where you work has full access to your work computer, which implies also to your personal github and everything related to it.
As a freelancer they don't have access to your computer so things are different.
The exact same thing happened to me. This was the Trello support team response:
"I've taken a look at your account, and ultimately, the problem is that the email address of your former employer was still attached to the Trello account. In their recent account claim, this triggered your employer to claim ownership of the Trello account, which is something Trello's terms allow Enterprises to do. Because the email address was still on the account, your employer identified it as an account that they should own, and ownership of this Trello account was transferred to your former employer, so no changes can be made to the account, and the company owns that account.
It sounds like you have personal content in this account that you want access to? Given the account ownership, that's not something that we can do on our end, unfortunately. If the company consented, they could remove your account from all company teams, and then we could remove the Enterprise association, but that's something you'd need to explore with them, if they'd be willing to do that."
This is scary. I’m trying to understand - I have several Trello accounts, one that I use for my own personal work and some consulting clients, and several other accounts with @client.com emails. Does this mean that if I have my personal account added as a secondary email anywhere on a client owned board, they can take control of my personal account including other clients’ IP? If so that’s terrifying and we need to find alternatives ASAP.
Elsewhere you wrote that the opposite scenario happened to you. You tainted your personal account with a work email. This person is worried about tainting their personal email with a work account.
It's evident from their reply that they do not care about a primary or a secondary email. In my case the company email was secondary, in this case it is primary.
OT, but I had this with Azure. My MS account was tied to the AD of a previous customer. Can not access Azure dashboard or services at all. 5 years later and still not resolved, despite numerous e-mails, phone calls, with several people (they even insisted I install a .exe file in order to be able to do screensharing. It took some persistance to make them accept that I shouldn't have to install Windows and install a binary just to be able to restore my account. That was about 6 months ago.
If this is how Microsoft support works for real, no wonder the scammers getting people to install malware are successful).
A reasonably well-known blogging site handed my account to a would-be porn star while I wasn't looking. That link is now way more interesting. And while it was linked to my LinkedIn. Yikes.
Seems like unpopular opinion given comments on this thread, but here it is anyway.
Using my employer's email addresses for services I want to control doesn't sound right. Of course, LinkedIn is a different story but for SaaS platforms like Trello, my employer should be the rightful owner of the data I store in there if I used it for work.
Imagine the other scenario, if that Trello account's control didn't move to the employer, the employee would still be keeping the content he created FOR the employer long after his employment has ended. I don't think that is cool.
Your data is your data, likewise, your employer's data is theirs. If you don't want any hassle, keep these two lives different.
You created a Side Project but used your company's email ID to share it with your teammate at work.
Does that side project belong to you or to your company? If it belonged to you, why would you use office email ID for collaborating on it? and if it belonged to the company, why would you manage it on a personal Trello account?
Sorry to sound harsh, but unless I am missing something, to begin with, looks bad judgement on your part.
If this happened in my country that would breach privacy laws. It might also constitute hacking depending on what kind of administration the company does.
I agree. This sounds a gross violation of EU data privacy laws. Not every country has those kind of data protections for their citizens, unfortunately.
I hope that all Europeans hit by this will make an issue out of this that will make Atlassian and other companies think twice before doing something like this again.
All their customers present and potential are seeing them do exactly the wrong thing ethically in order to
take a side against an individual in favour of an employer.
Big gold star from corporate. Individual developers, rob them, that is fine. The customer is right. The user is not the customer.
The other way around. Taking a firm's IP and denying access to it while giving it to a former employee who did not own it. Words like theft would be bandied about freely.
Oh for the days of the rule of law and equality before it, huh?
If a CISO looks at this, she might think "great, so anyone entering a commercial relationship with Atlassian can now eventually take control of the boards of some of my employees ?".
The question that I have is... Will the control panel show the multiple addresses and can you delete one off. I just checked both accounts (personal and company) and they seem separate. In everything I do I always keep my work account separate from my personal accounts. I use separate browsers, never check personal email on company PC or network.
What happens if I associate my Trello account with my personal gmail address and two different corporate emails? (from different corporations). Who wins between CorpA and CorpB?
Unbelievable. I've been waiting for the other shoe to drop since the Atlassian acquisition, now strongly reconsidering my Trello usage. What's an easy platform to migrate my data to?
Does anyone have a good suggestion for ergonomic and functional ticket systems you can self host? Preferably with some board management? This is personally my key take away from this.
I have seen 'secure storage' companies pitch to our management that 5,000 users with @example.com emails already use the personal version of the service offered by the company. Now, I'm wondering if we bought the 'enterprise' version of the service if the same thing would happen to these users. If so, it seems the users ought to be given a choice to convert to the enterprise version or change emails beforehand so they can keep their own personal service intact.
I'm not blaming you by any stretch but this just further reinforces my view that everyone should be self-hosting wherever they can.
You simply can't trust any corporation to do the right thing and GAF about people's right to privacy or access to their own information.
I think whoever solves the problem of making it easy to offer web application services while allowing users to own, protect and backup their own data will be rewarded.
Do any accounts have 2 work emails tied to them, I wonder? Would they hand it to Company A, who would gain whatever IP of Company B that was still in the account? Would they arbitrate who gets what?
You know, the one thing nice about using a cloud service is that your data is just there, nice and safe. You know, usually.
I contacted Atlassian support via my personal email account and they informed me that somehow my subscription is tied to my personal account, but I need to use my former work email to login.
I can't do that, so I've lost access to all my personal boards and apparently to my Gold Subscription too.
This is why I don't use SSO for personal affairs, unless required. The convenience is not worth it to me, especially because I just use a password manager to log me in anyway. The provider will just cut you off at a moment's notice and then tell you to shove it. Besides, logging in is faster than having to be redirected to another page just to use my password manager to log in to my google account, redirect me back and then I'm in...just log in directly.
I also never, ever, for any reason, no matter what, no matter where, or who, or who I am with, or where I am going, or where I've been... ever, for any reason whatsoever link a business email account to a personal account. I use different browser profiles and keep all that stuff segregated.
Heads up: Notion works surprisingly well for trello boards, and they have import functionality straight from Trello. The only thing that didn’t import afaik is card tags/labels that didn’t have a name so I had to reimport after adding names to tags/labels.
This sounds like a major GDPR violation. If they do business anywhere in Europe they could face major fines if someone were to lodge a complaint with a national national data protection authority.
If the boards contained personally identifiable information and then that data was transferred so that other people could access it, wouldn't that be considered a data breach?
I guess people affected by this could submit a subject access request to get their data back.
> If the boards contained personally identifiable information and then that data was transferred so that other people could access it, wouldn't that be considered a data breach?
I believe so, however this doesn't constitute legal advice (etc, etc)
GDPR protects personal data, which the EU interprets very broadly. When you are working and what you are working on is included, for instance. That's basically a Trello board. Processing of such data (e.g. handing it over to a third party) without explicit consent is subject to major fines.
> GDPR protects personal data, which the EU interprets very broadly.
This isn't accurate. Individual member states can and do interpret the GDPR differently.
For a European company, the country they are "at home to" is the one that will govern them, not the state that the individual belongs to. If the company is not "at home" in the European Union (for example, because it is in the US and has no European offices and does not trade in Europe), then the rules of the individual's member state will apply.
The details matter.
> When you are working and what you are working on is included [as personal data], for instance
No: Not in the UK or Ireland (which I'm most familiar with) and probably not in any other European country.
Personal data is data that identifies a natural person, or that can be used to identify a natural person, not that is produced by a natural person.
The ICO has excellent (English-language) literature on this subject:
It may be that storing (say) your email address on every Trello card would be personal data, but then you can follow the process to have this data identified and removed by sending a letter requesting it be returned to you and destroyed. Trello would not be required to figure this out on their own - you would have to tell them how to identify your personal data.
> Processing of such data (e.g. handing it over to a third party) without explicit consent is subject to major fines
This isn't what the GDPR refers to as processing, and it is absolutely possible to process personal data without explicit consent. For example, the ICO suggests no less than five separate ways that are not explicit consent:
And again, I don't agree that "Trello cards" count as personal data. You can call the ICO (if you want) and ask them if you think otherwise; I have done this several times and they've happily sent me written clarification on any theory I might have (including on something that is similar to this):
Personal data is data that identifies a natural person, or that can be used to identify a natural person, not that is produced by a natural person.
What do you think the new subject access rights, notably the right to data portability, are intended to achieve, if you interpret the definition of personal data so narrowly?
The GDPR actually defines personal data as "any information relating to an identified or identifiable natural person (‘data subject’)...", which is significantly different to what you wrote.
It seems to be widely understood, including acknowledgement in various statements by EU officials, that these provisions were aimed squarely at businesses like social networks to avoid them locking users in by holding the user's data hostage. That seems to be exactly the scenario we're talking about here.
> What do you think the new subject access rights, notably the right to data portability, are intended to achieve, if you interpret the definition of personal data so narrowly?
I am not going to speculate.
> The GDPR actually defines personal data as "any information relating to an identified or identifiable natural person (‘data subject’)...", which is significantly different to what you wrote.
I can't speculate on what you think qualifies as "significantly different". I copied and pasted my definition from the ICO's website, which I also linked to. You can disagree with them, but I suspect strongly, even in the current Brexit climate, that the EU courts would agree with the ICO's interpretation over yours.
You might find the part that follows the "..." useful though. It's in Article 4 § 1, if you're unaware.
> It seems to be widely understood, including acknowledgement in various statements by EU officials, that these provisions were aimed squarely at businesses like social networks to avoid them locking users in by holding the user's data hostage. That seems to be exactly the scenario we're talking about here.
That may be part of your confusion. "We" weren't talking about anything to do with social networks, but whether a GDPR regulator is going to levy a heavy fine to Trello for this behaviour.
I'm well aware of what the GDPR actually says, thanks. I was the one quoting it.
My point is that what it actually says, unlike the definition of personal data you gave, clearly goes beyond just the identifying information.
Moreover, there was also clear intent, reflected in the provisions of the GDPR itself and in statements by officials involved in writing and interpreting it at EU level, for the safeguards on data portability and erasure to cover exactly the sort of data we are talking about with a service like Trello.
I'm not aware of any action so far that has actually tested this, but if a national regulator chose not to penalise flagrant non-compliance with both the letter and the spirit of the GDPR such as we see in this case in response to a genuine complaint, it simply wouldn't be doing its job, since it would essentially be unilaterally deciding that entire articles of the GDPR are pointless.
This certainly isn't beyond the bounds of possibility. Indeed, the vague nature of the GDPR in many respects and the reliance on subjective interpretation by all the different national regulators was one of the big criticisms that I and others made at the time it was introduced. But if that happened here and the regulators chose not to enforce in a situation like this, it really would turn the GDPR into a bit of a joke.
I hear stories like this all the time - I'm all for "cloud" in certain areas, but, there are an increasing amount of companies that either don't care or have short sighted policies.
I really think the future needs to look more at "master" accounts with Azure/AWS and similar services, make it much easier to delegate access to third parties so that the third party contains the core logic/application but the data resides fully with your own account.
Data ownership is so important and overlooked by so many people who want an easy life and want to forget physical servers to look after.
I am far from a lawyer, so would someone with a better understanding of the law explain to me why this wouldn't potentially violate laws around trade secrets?
If someone uses a 'personal' email for setting up their business' trello account (including what could be categorized as trade secrets); and at some point in the future, they added a different companies domain to their account as a secondary login; and then Trello hands everything over to that other company; how isn't that a violation of trade secrets?
In most countries whatever job related work you do is owned by your job (even when you do it at home in your own time).
So never make the mistake to mix private with work.
I don't think Atlassian is to blame here. Maybe they could have communicated this better to the owner of the account. But if you own an account it does not mean you own the content if you used it for work.
Atlassian is absolutely to blame. You still own the account and any personal data on it. It's not their to give away to someone else.
If a company thinks they own something on that account, they should address that with the owner of the account. In court, if necessary. But companies just seizing your data like that should be illegal, and companies should not enable it. They certainly shouldn't proactively give your data to someone else.
Note that Youtube is also guilty of similar things, allowing companies to claim ownership of independent users' original works. There need to be stronger laws to crack down on such abuses.
I've had a similar thing happen. I got the cheap tier for myself. (first.last@gmail). About the same time, I had a work email (first.last@example).
For some reason, they listed my cheap tier license under the work email. I still have no idea how this happened except for maybe laziness by some Atlassian support person.
Trello has been advertising a lot on some podcasts that I listen to and I was considering using them. Sorry about the problems you are having - good luck with getting them resolved and thank you for posting this as I just crossed Trello off the consideration list :-(
You're a special kind of person if you are concerned about the privacy of your account and also enable your company's SSO on your account. I don't disagree that the conclusion of the story is that it sucks, but the moment you meld your private stuff with your company stuff you're asking for it.
I generally have little sympathy toward people expecting privacy on assets provided by the company, wether that be hardware or software. If you read your private email on a corporate asset, or enable sign-on with a corporate credential, all data can and should be inspected by your corporation. The fact that companies don't MitM _everything_ is what's surprising.
Convenience is cool, the fact that one or more third parties has control of your account on the saas service is less cool
also not so hot that it's used for login and information sharing. I had an experience where I read the oauth permissions carefully on a first login, and then on a subsequent login the app included contacts in the permission set. I noticed it too late. Super shady & I'll never use oauth personally again.
What about sending Atlassian a cease and desist order, citing copyright law? They are not hosting your personal copyrighted content with your permission any more and have given access of it to unauthorized parties. I think you should consider seeing an IP lawyer. Since they are not being reasonable and are forcing you to legal measures, simply restoring your account is insufficient, you will want a settlement. Each violation of your copyrighted material might be good for $250,000 in fines.
Sounds kinda like the users fault, having a corporate and personal email on the same account. Atlassian probably could put a warning though about the issues that could arise.
I am the user in this case. I understand Atlassian's position in this case but this is so hard to track over such a long period of time. I left this workplace almost 5 years back and the account worked fine. Then it suddenly stopped working without any notification from their side.
> this is so hard to track over such a long period of time.
But you created the problem in the first place by adding your work email to an account that had your personal boards in it. By doing that you gave your employer a means of controlling that account. You basically planted a time bomb that could go off at some unpredictable time in the future. And it went off.
Your reasoning feels truly bizarre. He added that work email as a SECONDARY mail. As soon as it stopped working, he could no longer access the boards associated with that particular mail, only his personal ones that were NOT associated with it. His personal boards continued NOT being associated with that work email for years afterwards, and he never in any way indicated, asked for, or allowed that they should be.
HE didn't “plant a time bomb”; Atlassian ripped him off, plain and simple.
(Oh, sure, you could argue that he “planted a time bomb” by giving Atlassian the means — that email address — to rip him off... But please don't. That would be like arguing that a rape victim “planted a time bomb” be dressing too provocatively.)
Attaching a secondary email to an account does not grant ownership of content or IP owned by the account holder to an entity associated with the secondary email. At best it provides evidence that the account holder has [or had] a relationship with the email domain owner.
Depending on the jurisdiction, if one suffers money damages as a result of the unapproved transfer Trello or its business clients may be exposed to liability. Also, I imagine there may be privacy or consumer protection laws that could apply too even in the absence of money damages.
May be you can say that "Trello handed over the only account you had to the previous company".
While I understand, the pain - I sympathize: please note that no permissions management system (or identity and authentication is so perfect that every case can be handled perfectly). As others say, you should have verified spent a bit of time to cleanup - because at the end - you lose time/money/whatever.
In the worst case, any company or even govt can just say sorry or some credits.
Even if the company is to blame 99 % you need to take 1 % responsibility.
Every year, audit yourself for things like this. I compulsively check my own security... security is a frame of mind. Delete unused oauth apps, dead emails. Flipside - offboard people quicky and completely when they leave your team.
I understand Atlassian's part here. But Atlassian did this on purpose. They clearly understand the implication and the ownership of accounts, but they deliberately ignored individual users over big corporate accounts. And in my case, they didn't even have the courtesy to notify me in any way. I just stopped working one day leaving all my data unbale to use.
> They clearly understand the implication and the ownership of accounts
Clearly understand what "implication"? From what I can see, all Atlassian knows is that there is an account with two email addresses attached to it. They have no way of knowing which email belongs to the "right" owner of the account. That's something the two parties involved--the two owners of the two emails--need to work out between them, and then give Atlassian a common response.
Last time I used Trello they had a relatively extensive concept of organizations and board ownership, while they might not have an idea about which email is the fictitious canonical owner of the account this still falls on Atlassian.
They created this system that allowed AcmeCorp to change a setting and subsequently lock an ex employee out of non-organisation data. They know which of this accounts content is related to the organisation, they allow using a single identity for both private and corporate use cases at the same time. That's a use case their user facing interface actively encouraged. When I left the last company using Trello that distinction was pretty clear cut when I removed ties to the organisation.
The linked thread reads like deliberate design decisions that turned out to be user hostile in favour of AcmeCorp. You don't have to assign a correct owner. Their data model seems pretty clear cut on which parts of an account are owned by which identity. If they develop a system that allows me to login via a private and a corporate email, have a data model that allows them to determine data ownership for the two, and yet decide to give one of those identities leverage over the other - it's okay to at least blame them partially. There's three parties involved here, none of them did everything correctly but only one had negative impact from this.
> they allow using a single identity for both private and corporate use cases at the same time. That's a use case their user facing interface actively encouraged.
This seems to me to be the root of the problem, because to me this is obviously a bad idea and should be actively discouraged, if not prohibited altogether. If Atlassian, or some predecessor owner of Trello, did actively encourage this, then I agree they bear some culpability.
I guess that's one of those decisions that made sense at the time. iirc the organisation part was an afterthought after people started using it for these use cases, they now seem to have account switching in their app that would cater to the more modern use case.
In theory I actually prefer this data model, one identity (because that's the physical reality) and a sane perspective model on who owns what data this identity has access to. But sadly nobody seems to have time to get that right in a mixed B2C/B2B product.
You actually were lucky that this didn't bite you until now. Not fair to blame your old job for waiting this long to force mfa.
Edit: you can't say what they did deliberately or not. They're doing what makes the most sense for their business. Almost no support team I know would give you access to this account.
Why would they allow an account with multiple email addresses to login with the non SSO one? In your case you aren’t malicious but there could be used maliciously
- add your person email
- get fired and login with that email and now have all the data
I would argue that the "right" course of action is to immediately require human intervention when an SSO email is added to an account (or an existing account with an email address, such as a startup "going big league", becomes SSO managed), so that account ownership issues are resolved at that point in time by the parties with ownership interest, not Atlassian having to do so.
The ownership of data is attached to the email. As soon as i left my workplace, none of the data created under my company account was visible to me. On top of that, they launched SSO support lately. It was not SSO when I connected my accounts years back.
Going on a stretch here, but assuming that the user also use the company email for SSO, means that company (paying client) trade secret were potentially in some of the trello board the user was using.
Considering that it would be an invasion of privacy and confidentiality for Atlassian to access the content of the board to assess which one is corporate and which one is personal, Atlassian to the safer approach to satisfy a paying client.
Consider that as a free user, with no advertising to monetize you, one could guess that Trello used you for advetising (Unless you are a paying user for your personal account, that could change the story).
Of course I am not big fan of the approach, because the user probably linked personnal and work account for convenience, and that trello probably didn't make it easy to make the switch between work and personal.
On the other hand, how do you prove that an email address is a personal one ?
I am the user in this case.
When I linked the accounts almost 6-7 years ago, Trello was not part of Atlassian and there was no SSO in place. At some point, they introduced it, but still, the regular way of login was working. There was no notification from there side that it will stop working abruptly.
The company email address in this case what @comany.com and the personal one was @gmail.com. This is how they handed over all the accounts ending with @company.com to my previous company.
When you did this, was the Trello account used for just your work with that employer? Or for both work and your personal stuff? Or just your personal stuff?
[Edit: I see from your response elsewhere in this discussion that it's the second of the options above. I'll respond further in that subthread.]
I understood you were the user, and that what Atlassian was way too cold and lazy on their part.
but again, to play devil's advocate, Gmail do offer professional account part of the G Suite. Without knowing your work history, it would be difficult to know if the Gmail address is also not a "professional one".
On another hand do you think notification would have solved the issue ? And wouldn't a more malicious employee just delete all the boards if they did not part with their previous company on good term.
Obviously I don't know everything from the story. And my assertions are very far from the truth. I am trying to understand what would motivate such a decision (beside the obvious Atlassian is a heartless money-grabbing company that rot everything it touches)
The ownership of the board is by account. In this case, all the company accounts were anyways invisible to me as my login email was personal gmail account and I only had the permissions to delete board owned under my account.
Sure. But he forgot. That's not a reason to give the company, with which he is no longer affiliated and to whose boards he hasn't had access for years, ownership of his personal account and all its boards.
I think atlassian’s position is correct here, sad to say. They had to make a branch cut and i don’t think the other arm would be safe for them (company stuff leaked to a private account). Of course that stuff was already leaked, but I think the liability would fall on Atlassian if the company count delete that stuff.
Don’t connect your personal stuff to your work stuff. That’s messed me up more than once — lesson learned, painfully.
Atlassian sent me an email earlier this year warning that all @company.com accounts were about to be converted to corporate accounts and that I had a month to opt out. (I did not opt out, because my @company.com Trello account was intended for use with my company)
This person’s warning email probably ended up in spam.
In general I’m not sure the best way Atlassian could have handled this. The recent upgrade to move @company.com accounts into having a better security posture and control by the administration of the company does make sense.
Perhaps the person’s account should have just been disabled entirely until they removed either their personal email or @company.com email from the account to choose which way they wanted to go... That might have been the best solution to both protect corporate security and also the individual.
IMO they should handle secondary emails differently to primary emails.
Some sort of in your face warming when you login to trello before the migration may be appropriate.
Just to be fair/clear, I meant "secondary email" in terms of how the user treated it, ie they weren't actively using it log in and presumably didn't know it was still there.
As far as I'm aware, Trello didn't actually have one email marked as more important in any way. Although they absolutely should have.
I still think Atlassian should have been able to predict this situation, and should not have considered it acceptable.
Once you attach an email you don't control to the account--like your work email that your employer controls--then it isn't "your" account any more. You have given someone else a means of controlling it. The solution is to not do that.
The multiple account login used to work the same way it works for github now. The boards were very clearly labeled under the email/username they were created and clearly had the ownership well defined. As soon as I left the company and my email was disabled, all the boards under that email disappeared from my account. This was expected and kept using my primary email (i always used to login with my username) and completely forgot about an attached secondary email (which anyways is now deactivated). Fast forward 5 years with tons of personal boards under this account, one morning it stopped working without any notification (yes i revised my spam to be sure about it) with all my data gone.