Obviously, while the email-support method is safe, the automated system for unlocking admin access based on "proof of ownership" is pretty scary! Seems like this could be solved by requiring you to prove ownership and then releasing new auth info to a linked email account on a different domain. That helps to establish both present ownership and a chain of ownership back to the last time you had authorized access and were able to adjust the "emergency email account" setting. It's not perfect, but it's a heck of a lot better.
It also seems to me like someone wanting to abuse this right now could do so pretty easily: you can confirm that a domain is available and that it has had a google Apps account set up in the past before you spend a dime, so you can just set a computer to trawling known Google Apps domain names (e.g., by looking at traffic on large mailing lists) to find ones whose registration has expired.
It's also a cautionary tale of what you leave up on the cloud when you abandon your email account. I could have potentially found a lot more damaging information from gaining access to this persons email.
> This issue is still a serious matter. I would have still been able
> to access the person's Amazon account using a wildcard email
> address.
not a legal advice
There does not seem to be any alarming distress in the situation. It has been over 2 months since the incident, I made sure that the person(s) involved was fully aware and of the blog post. No issue was raised about me writing it up and posting it. I also waited for a period of time to hear back from the Google Security Team. I believe I have taken the correct response here.
The practical outcome is that the Crown or People can choose to independently charge you of a crime, regardless of what the actual 'victim' wants.
Be careful.
Of course, IANAL, TINLA.
If you ever find yourself logged into someone else's account log out and, if you absolutely have to reproduce it, reproduce the attack against an account you have legitimate control over. (e.g. Register dummydomain.co, set up a Google apps account tied to it, transfer the domain, regain access to the Google apps account using nothing but the DNS settings to the transfered dummy domain. If this succeeds, you know you can compromise any account linked to a Google Apps email account on an expired domain -- you don't need to commit a federal crime to demonstrate this.)
I assume the previous owner probably has some mechanism for deleting the accounts that are currently on Google Apps. If that's so, then it seems reasonable that it's their responsibility to do so.
(An attacker could buy the domain name and set up a page at your OpenID URL which would delegate the OpenID to something under their control.)
This is probably related to why google isn't able to move an apps account to a new domain (our real domain is just an alias to our google apps account on previous company name's domain).
For example, if you have foo.com as your Google Apps domain, and you have foo.us as an extra domain that was aliased but then expired, does that expose the foo.com Google Apps account?
The owner of the domain name should be able to create a brand-new Google Apps account for it. Recovering access to an account should be done through another channel (secondary email address, SMS, postal mail).
In addition, password resets via email requested at domains having the whois creation date after the account creation date should probably be disabled.
Seems like if you are trying to reclaim a domain then requiring the user to verify access to their "backup" email address could be a simple step that would help a lot.
In addition, expired domains purchased by someone else won't be usable with Google Apps.
I am curious why you did not mention whether there is an option to simply delete your Google Apps account before letting the domain expire?
That said, a warning message on login would be nice. They could check the whois records on initial registration to see when the domain is due to expire, and verify that (in case it has been extended) before giving a warning.
There is an easy way to detect a domain expiring that would stop accidental access to data like this by new domain owners. IIRC on signup for Google's apps you add a TXT record to the domain to prove that you control it - if a domain is expired and renewed by someone else then this TXT record will be gone. Again there is no need to check on every login, just when the domain is due to have expired. Of course this does not protect against intentional access, as the TXT record could be remembered and re-entered by the attacker if they are registering the name specifically to get access to the data on accounts like Google apps.