Fun times with the Internet

[owlmoose]

So if you follow my Twitter (iamkj), you probably saw that I got locked out of my Tumblr account for a couple of days. Basically, Tumblr had a password security breach in 2013, and they forced the affected accounts to change their passwords. (I'm not quite sure why a breach of three-year old data necessitates a password change today. Maybe they just now found out about it?) Mine was one of those accounts, so I attempted to reset my password, multiple times, without receiving a verification email.

It turns out the problem was on my end -- the email I use for Tumblr is connected to my personal domain name, and the registration had lapsed -- so as far as that goes, this isn't Tumblr's fault. But if I hadn't been able to get my email fixed, I would have had no recourse, because Tumblr doesn't provide any alternate method of identity verification. When I wrote to Tumblr about the problem, their only suggestion was to register a new account with a different email address and start over.

Dear Tumblr staff: this solution is not a solution at all. In fact, it is completely unacceptable. I understand taking security seriously -- I wouldn't want just anyone to be able to pretend to be me, either. But there are ways around this, ways used by many other sites. Offer a back-up method of account verification, such as a secondary email or mobile phone number. Allow your support staff to exercise their judgement and/or common sense in cases like mine and Bryan Konietzko's (read the sad story here). There are all kinds of reasons why someone might lose access to an email account. Maybe you signed up with a work email and then changed jobs; maybe you graduated from college and your school doesn't provide permanent forwarding; maybe your email host went out of business; maybe someone hacked your account and you had to close it... This is a common enough situation that there needs to be some solution beyond having to close your blog and move on.

Move on?? I've been actively curating my Tumblr blog for over 5 years. I have more than 400 followers. I'm a contributor to several side blogs, including two for which I'm the only admin (so those blogs would have been lost, too). I suppose the content would stay up, but the chance to build on it and continue participating in conversations would be lost. And if it can happen to me, it can happen to others (see above), with far more followers and influence than I. Make your site unsustainable to use in the long term, provide poor customer service, and people will move on, all right -- they'll move on to a new blogging platform.

Fix this, Tumblr. Even if it's too late for people like Bryan to regain access to their accounts, please move into the modern era and implement some sort of back-up authentication method. It's absolutely necessary.

Comments

[vicki_rae]

Absolutely alternate methed needed going forward. It's a incredible mess. I just love tumblr sending people a very perky response of nope sorry we can't help you because we care about your security. WTF? Yeah NOW they do.

[owlmoose]

Ugh, yes, the tone of the (probably) canned response was *entirely* inappropriate. And good point -- it would have been nice to acknowledge that the forced password change was because of their own screw-up.

[sarasa_cat]

Wow. Sorry. Glad you were able to regain access and Bryan Konietzko's situation is absolutely unacceptable.

Tumblr has certainly had its moments of "yup, we make at least one unprofessional decision per year" mixed in with its cowboy coding (and a few horror stories from former employees) but this episode pretty much reduces tumblr to "software by kids, for kids," rather than a site where someone can host a business or their professional identity.

:C

[owlmoose]

It really is amateur hour over there. I'd hoped that acquisition by a more mature company would help, but apparently not. Hey, you know what has back-up methods for password retrieval? Yahoo! Mail. Go figure.

[lea_hazel]

It's quite embarrassing, especially when you consider 1) how many businesses rely on social media for staying in contact with their customers, and 2) how disproportionately this affects smaller business owners.

[owlmoose]

Yep. Outdated and unrealistic policies, and the response has been really unprofessional. Sometimes I feel like Tumblr encourages its reputation as a tool for teenagers to keep our customer service expectations low.

[lea_hazel]

Oh, that's hilarious.

This strikes me in particular, because I recently had to contend with the opposite problem - a complex system designed to have double contingencies for both security and recovery. It helps to remind myself that the alternative isn't really an improvement.

[owlmoose]

The pendulum can swing too far the other way, to be sure. I think about that every time I need to create a password for some new site and run into ridiculously strong password requirements.

[lassarina]

....wow. so unacceptable. SO INCREDIBLY UNACCEPTABLE.

increasingly glad I'm staring at it from a distance.

[owlmoose]

I got an email from Tumblr today, inviting me to complete a survey on my customer service experience. SURE, TUMBLR, LET ME TELL YOU ALLLLLL ABOUT IT.