Account creation section

[razac-elda]

New section to discuss the various aspect of creating new accounts.
The idea came from the discussion about Single sign-on #1609 and suggestions from @matchboxbananasynergy on his passwords knowledge base #1706 .

As of now I added some general ideas for the page, feel free to give me you opinion.

[github-actions]

🎊 PR Preview 9da5318 has been successfully built and deployed to https://privacyguides-privacyguides-org-preview-pr-1723.surge.sh

🕐 Build time: 105.415s

_{🤖 By surge-preview}

[razac-elda]

I have some questions:

1. The email alias section is a quick descritpion since it's already described in the recommendation page, should we leave it like this?
2. I know some services offer phone number aliases and Mozilla will also add it to Relay, it is worth mentioning? I don't have much knowledge about this type of alias.
3. I added links to some recommendations pages, would it be better to have buttons instead(md-button)?

Any suggestions are welcome.

[ph00lt0]

? I don't think this is correct. I am not talking about the correction but the Privacy Policy is a legal agreement? Also in the way that the sentences follow up it looks like Privacy Policy is some part of ToS which often isn't the case.

[razac-elda]

I thought it was part of the ToS it's just different document, Wikipedia also says so. ToS are the legal agreements and the Privacy Policy is a legal document. Perhaps someone with a legal background can clarify this point.

[ph00lt0]

Well a privacy policy legally cannot be part of the ToS. Doesn't mean that it doesn't happen but the GDPR has set strict rules on accessibility to privacy information and therefore it cannot be hidden in a ToS.

[razac-elda]

To avoid any confusion I can talk about it separately but I still think that it's part of the ToS. It is a separate document for easier access, following GDPR rules. If you have a look at some ToS privacy section you can find links to the Privacy Policy.

All the websites I checked asked you to accept the ToS and only sometimes they mentioned the PP during registration. You do not accept the PP, only the ToS. So if I accept the ToS I also accept the PP but not vice versa.

For example ProtonMail ToS says "...By agreeing to the present Terms and to be able to use the Services, you also agree to our Privacy Policy." and inside the Privacy Policy "...This privacy policy is to be read and understood as being a complement to our terms of service."

[ph00lt0]

Sorry but none of this is right. Under GDPR data processors are required to ask for consent to the data subject. I highly doubt the legality of putting it in the ToS.

[razac-elda]

I think we are both missing something here, I do agree that consent must be given.
The way it's given is different form website to website. Some ask only for ToS, some for ToS and tell you to read the PP(linked in the form or inside the ToS), others want you to accept everything(ToS, PP, cookies...). I found a few, like banks, that you need to give consent on each type of data process.

The European Commission website has a lot of guidelines on how to implement GDPR, including consent for data collection, but there is a lot to unwarp here. Maybe someone will chime in to help us understand.

To avoid getting too much off topic I think it would be a good choice to discuss ToS and PP separately in this page and advise users to read both.

[ph00lt0]

I already do understand :) but I agree with the latter.

[jonaharagon]

Typically the Terms of Service are things you are agreeing to do when using a site, and the Privacy Policy is the site agreeing to only do certain things with the data you give it. I think I agree with just discussing both of them independently of each other.

[razac-elda]

@Redre1l Thanks, I don't always get along with english grammar 😅

[netlify]

✅ Deploy Preview for privacyguides ready!

Name	Link
🔨 Latest commit	0d59716
🔍 Latest deploy log	https://app.netlify.com/sites/privacyguides/deploys/63b571bcb410ad000b67940e
😎 Deploy Preview	https://deploy-preview-1723--privacyguides.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site settings.

[ghost]

One thing that we could mention here is that the way services use email is essentially a crappy version of SSO, since if your email account is compromised you essentially can access any account that uses that email. So I wouldn't put that as a disadvantage for SSO, since email has the same problem but worse. It's actually superior in this regard IMO.

[matchboxbananasynergy]

One thing that we could mention here is that the way services use email is essentially a crappy version of SSO, since if your email account is compromised you essentially can access any account that uses that email. So I wouldn't put that as a disadvantage for SSO, since email has the same problem but worse. It's actually superior in this regard IMO.

There also a potential security advantage if you use Google's SSO for example while securing your Google account with a hardware key, for example, whereas whatever service you're using may not implement it.

[razac-elda]

@mfwmyfacewhen Thanks for your contributions.

One thing that we could mention here is that the way services use email is essentially a crappy version of SSO, since if your email account is compromised you essentially can access any account that uses that email. So I wouldn't put that as a disadvantage for SSO, since email has the same problem but worse. It's actually superior in this regard IMO.

They share this problem, but with emails it can be mitigated if you setup 2FA for your accounts. If SSO security is breached, not much can be done.

There also a potential security advantage if you use Google's SSO for example while securing your Google account with a hardware key, for example, whereas whatever service you're using may not implement it.

I like the idea to leverage on SSO providers security features if other services lacks them.

Edit: would you like to explain it yourself or should I write a rough draft?

[razac-elda]

ToS (Terms of Service)

It's best to put the abbreviation inside the brackets .

if the account is new

I don't think this is relevant. You can break ToS at any time, not just with new accounts.

[dngray]

It's best to put the abbreviation inside the brackets .

Thinking we can just remove the bracketed version afterwards, because it does have the mouse over abbreviation. It's also in the heading.

It is, because you may not necessarily break the ToS, but can still have accounts locked, due to them being new, using a VPN, or using VOIP numbers.

I don't think this is relevant. You can break ToS at any time, not just with new accounts.

These are all things often "recommended" by the privacy community for "privacy".