Comment by patmcc

Comment by patmcc 4 days ago

2 replies

>>>It's a different bob@DankStartup.com, and in fact a completely different DankStartup.com. Google shouldn't conflate the two.

Does Google have any reliable way of knowing that?

>>>There are exactly 0 situations where the current behavior is useful. There is no reason whatsoever to have the exact same auth info for two Google accounts that happen to have the same domain.

I have a personal google workspace account with a few domains. At some point I might want to spin one off to be its own (maybe I start a company). But I'd still expect pat@mydomain.com to keep working throughout. So that's 1 situation.

tsimionescu 4 days ago

> Does Google have any reliable way of knowing that?

Yes, Google knows this is a new Google Workspace account using the same domain as the old one.

> I have a personal google workspace account with a few domains. At some point I might want to spin one off to be its own (maybe I start a company). But I'd still expect pat@mydomain.com to keep working throughout. So that's 1 situation.

That should be a separate feature of Google Workspace, where you can transfer an identity, it shouldn't be automatic. And it shouldn't even be tied to the domain name. If you decided that you prefer the domain to be pat@mybetterdomain.com, you'd still want to have access to the old Slack conversations or whatever. Conversely, if you lost access to the mydomain.com domain (say you forgot to renew it, or some legal entity sued for it because it was their trademark or whatever), I'm certain you wouldn't want the new owners to then have access to your Slack or any other data, just because they have the same domain name.

  • patmcc 3 days ago

    >>>Yes, Google knows this is a new Google Workspace account using the same domain as the old one.

    I agree it knows that, but it doesn't know:

    >>>It's a different bob@DankStartup.com, and in fact a completely different DankStartup.com. Google shouldn't conflate the two.

    How should it verify that? Should it? If you buy a domain that was used ten years ago, do you want google to say "well, we can't let you use contact@newDomain.com, someone used it previously and it may be confusing".

    >>>I'm certain you wouldn't want the new owners to then have access to your Slack or any other data, just because they have the same domain name.

    Maybe nobody should be using domain name and/or email address as authentication, but that ship has sailed in 100 different ways.