Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How is GDPR affecting your business?

news.ycombinator.com

Post reply on HN
Print view View original

61–66 of 66 posts

Re: Ask HN: How is GDPR affecting your business?

#61

Post by geofft »

rqs wrote: post #57
geofft wrote: post #56

Earlier quoted context omitted.

> I'm asking it because I was developing an online forum application that will publicly display your posting IP and registered email address, and sync posts with other sites. Please don't do this. Apart from my own rational self-interest, I'm saying this as a subscriber to various free-software mailing lists, which occasionally get requests from someone to remove archives of support emails they sent 10 years ago. It'…

The thing is that due to the synchronization, users post could be synchronized to another site which they are not registered to. Thus, a mechanism must be setup to allow users to manage their content on other sites. The mechanism that I currently planed was to use email verification (if (User's email === poster's email): They're the owner of the post), which requires all sync sites knows the email address (as an univ…

How does this handle people changing their emails? Can you do the same thing with a cryptographic signing key or something, instead? It seems like this could be implemented in a way where I prove control over the signing key (by signing a challenge, for instance), but I don't have to reveal anything about my identity besides "I have access to this key" if I don't want to.

(If you're worried about not just servers changing but clients changing, and needing to get the key over, there are protocols for efficiently and securely transferring information between client computers, using a very short password that doesn't need to be kept private after the transaction. magic-wormhole implements this sort of thing.)

This may or may not apply to your site, but, in general I don't want other users of a website to be able to PM/email me unless I specifically authorize them to. Requiring that my email is public does not provide me this control. You can do what HN (which doesn't implement PMs) does and let people have an optional public profile, where they can list a way they want to be contacted by other users if they want.

Re: Ask HN: How is GDPR affecting your business?

#62

Post by stunt »

Working for an e-commerce company in Europe.

We didn't have much trouble. Someone was assigned last year from our security team to teach and consult other teams within the company to keep their products compliance.

Even before going for GDPR everything about user data was very strict so don't remember if we (at least my team) did anything new.

We always had data anonymization pretty much everywhere, no production access even to our deployment team, no third party company is allowed to store information or even cookies from our users, a clear and short page for our users to tell them which companies have access to some of their data (ex. delivery company). We always have been obligated to report a data breach to the government and users if it happens.

It is a very long list, and goes down to stuff like even HR recruiter is not allowed to keep applicant information after X amount of time.

All of that also means sometimes we are unable to do something fancy with users data to improve our products. Or use some third party services because the third party company doesn't look reliable or they want to access user data.

Re: Ask HN: How is GDPR affecting your business?

#63

Post by KirinDave »

kenhwang wrote: post #48
KirinDave wrote: post #43

Earlier quoted context omitted.

Can you please tell me who you work for so I can avoid using you? I don't actually want to be profitable for you if I'm not paying for the service.

Fortune 500 in the Oscars/Emmys winning business. We have European partners and distributors for our stuff that Europeans are supposed to be using anyway. "This content is not available in your region" will probably become a lot more common. We'd prefer you pay for our content too.

It's weird how that isn't enough then, isn't it? There is some secondary data moneiltizaton.

Re: Ask HN: How is GDPR affecting your business?

#64

Post by larsen161-2 »

KirinDave wrote: post #41
drspacemonkey wrote: post #8

Earlier quoted context omitted.

We're in fintech. And we're not in Europe, but we're about to start a big project targeted towards European users.

If you're not in Europe there's no obligation. I can appreciate the attitude even if I don't like it. Fintech is a REALLY difficult business to make money in. Especially with so many larger financial institutions coming in and buying any naive existential threat they see ( coughs suggestively )

No being based in Europe does not exclude a business from GDPR.

"even if a US-based business has no employees or offices within the boundaries of the EU, the GDPR may still apply.

Under Article 3 of the GDPR, your company is subject to the new law if it processes personal data of an individual residing in the EU when the data is accessed. This is the case where the processing relates to the offering of good or services or the monitoring of behavior that takes place in the EU." - https://www.lexology.com/library/detail.aspx?g=3a02f14c-828b...

Re: Ask HN: How is GDPR affecting your business?

#65

Post by rqs »

geofft wrote: post #61
rqs wrote: post #57

Earlier quoted context omitted.

The thing is that due to the synchronization, users post could be synchronized to another site which they are not registered to. Thus, a mechanism must be setup to allow users to manage their content on other sites. The mechanism that I currently planed was to use email verification (if (User's email === poster's email): They're the owner of the post), which requires all sync sites knows the email address (as an univ…

How does this handle people changing their emails? Can you do the same thing with a cryptographic signing key or something, instead? It seems like this could be implemented in a way where I prove control over the signing key (by signing a challenge, for instance), but I don't have to reveal anything about my identity besides "I have access to this key" if I don't want to. (If you're worried about not just servers cha…

> How does this handle people changing their emails?

It can, as long as the email change request can be synced as well. It may have some security problem need to be resolved, but I think it can be worked out.

> Can you do the same thing with a cryptographic signing key or something, instead?

It's actually an better idea. If I can implement something like PGP (With maybe WebAuth), then user only needs to submit their public key. When authentication is needed, server will sends challenge (Message encrypted by user's public key), then user decrypts it with their private key, send the decrypted message back to server for verification.

However, I'm still figuring out the whole WebAuth thing, so no decision is made yet.

> This may or may not apply to your site, but, in general I don't want other users of a website to be able to PM/email me unless I specifically authorize them to.

I actually like to encouraging user to make contact by themselves with their emails, because service email is decentralized and controlled by users (At least they have better control of it than a website). Also, user may left a website but still using their email.

However, I know in real world, people don't like to be bothered, so make their email public could be a problem. I guess I need to rethink it a little.

Re: Ask HN: How is GDPR affecting your business?

#66

Post by orschiro »

hoborama wrote: post #10

I work for one of the biggest (non-tech) companies in the world, and in many countries we've been storing user data in spreadsheets all over the place and often without consent. So it's been pretty frantic.

You may find Sheetgo > Scan Sheets interesting to give a try: https://app.sheetgo.com/scan-sheets
Post reply on HN