Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Instead of deleting account, NYT appends ‘1000’ to username and email address

twitter.com

Post reply on HN
Print view View original

151–160 of 167 posts

Re: Instead of deleting account, NYT appends ‘1000’ to username and email address

#151

Post by malinens »

three_seagrass wrote: post #142
jasonbarone wrote: post #132

Earlier quoted context omitted.

I've seen this same method used on multiples apps I've requested an account deletion on. It's super frustrating. Most companies either don't respond back, say they deleted it when they merely disabled it, or they updated the account name to something else.

Disabling is understandable, because as a company you need a record of transactions or interactions such as TOS agreements for legal purposes. This requires keeping the records. Changing object name data though is a terrible practice to implement this.

actually GDPR forces You to have option to delete all data and not just d8sable user

Re: Instead of deleting account, NYT appends ‘1000’ to username and email address

#152

Post by ptman »

malinens wrote: post #151
three_seagrass wrote: post #142

Earlier quoted context omitted.

Disabling is understandable, because as a company you need a record of transactions or interactions such as TOS agreements for legal purposes. This requires keeping the records. Changing object name data though is a terrible practice to implement this.

actually GDPR forces You to have option to delete all data and not just d8sable user

It's a bit more complicated than that. You have a period of time to delete the data. And you can keep enough info to know what data you've deleted, so that if you restore from backups you are able to re-delete without having to go through your backups and delete everything. Probably more that I'm forgetting.

Re: Instead of deleting account, NYT appends ‘1000’ to username and email address

#153

Post by mekster »

perl4ever wrote: post #70
DevX101 wrote: post #64

Doing real deletes on user accounts is a surprisingly challenging problem and I'd be willing to bet very few companies do real deletes where all of your data is wiped permanently from the company. For legal and financial reasons, companies often need to keep track of historical user activity. If a company states in their investor quarterly report that they had 1M active users, they better be able to prove it in an au…

I used to work where (not a service for the general public) there was an "is deleted" flag for everything, but every now and then a client would insist that data be really deleted, and depending on who it was and how they asked, we might go and do it, which was a huge hassle and would cause no end of problems down the line. On the other hand, "is deleted" flags end up causing issues when you forget to put "where not…

> would cause no end of problems down the line

That's just how badly the system is designed. Write a script to delete all relevant data and the user and it would be a simple op.

> forget to put "where not is_deleted"

Use views.

Re: Instead of deleting account, NYT appends ‘1000’ to username and email address

#154

Post by Asuchug4 »

malinens wrote: post #151
three_seagrass wrote: post #142

Earlier quoted context omitted.

Disabling is understandable, because as a company you need a record of transactions or interactions such as TOS agreements for legal purposes. This requires keeping the records. Changing object name data though is a terrible practice to implement this.

actually GDPR forces You to have option to delete all data and not just d8sable user

Depends on type of data and other laws. If you are a paying customer you can assume your data will be stay in database, until it is no longer required for audits. GDPR allows for anything that is 'absolutely totally required for providing service'.

Re: Instead of deleting account, NYT appends ‘1000’ to username and email address

#155

Post by true_religion »

mopsi wrote: post #89
6gvONxR4sf7o wrote: post #83

Earlier quoted context omitted.

It does if they take subscribers from the EU (or california) and apply this process to them. It's incredibly straightforward. If you do business in some jurisdiction, then that business is subject to the jurisdiction's laws.

Not only do they take subscribers, they actively target the European market. When I open nytimes.com, a pop-up offers 0,50€/week digital access.

Hmm, it seems I was wrong then. I had thought that they didn’t localize to any EU countries, but I guess they have more of a global market than the other papers I am more familiar with.

Re: Instead of deleting account, NYT appends ‘1000’ to username and email address

#156

Post by berkes »

mistyq wrote: post #4

How was it possible to discover it, though?

I once received an automated email to 'deleted@example.com'. Where example.com is my domain. I employ catchall, so that I can generate a new mail for each service. I contacted them and they apologised. The CTO personally explained that this was legacy they lost track of and thanked me for pointing out.

You catch a lot, with catchall: dataleaks, hacks, sneaky data sales etc. When suddenly you recieve, say, marketing mail for shirts on 'jeansonline@example.com' something fishy is going down.

Re: Instead of deleting account, NYT appends ‘1000’ to username and email address

#157

Post by three_seagrass »

malinens wrote: post #151
three_seagrass wrote: post #142

Earlier quoted context omitted.

Disabling is understandable, because as a company you need a record of transactions or interactions such as TOS agreements for legal purposes. This requires keeping the records. Changing object name data though is a terrible practice to implement this.

actually GDPR forces You to have option to delete all data and not just d8sable user

You can keep contact info even after a GDPR deletion request, so long as you're not using it for business purposes.

Otherwise imagine how easy it would be to violate the deletion request if you're running a business and can't remember the names of the people you had deletion requests for. Their data could come up again through normal channels and you'd treat them no differently than another sales contact, thus violating GDPR.

Re: Instead of deleting account, NYT appends ‘1000’ to username and email address

#158

Post by cyberowl »

DevX101 wrote: post #64

Doing real deletes on user accounts is a surprisingly challenging problem and I'd be willing to bet very few companies do real deletes where all of your data is wiped permanently from the company. For legal and financial reasons, companies often need to keep track of historical user activity. If a company states in their investor quarterly report that they had 1M active users, they better be able to prove it in an au…

Are soft deletes even legal in the context of privacy laws like GDPR? If I’m writing in to delete my data, I don’t really give a crap how hard it is. I want that permanently wiped, so that even if you wanted to you can’t find it again.

How that messes up your technical implementation is your problem

Re: Instead of deleting account, NYT appends ‘1000’ to username and email address

#159

Post by HenryBemis »

berkes wrote: post #156
mistyq wrote: post #4

How was it possible to discover it, though?

I once received an automated email to 'deleted@example.com'. Where example.com is my domain. I employ catchall, so that I can generate a new mail for each service. I contacted them and they apologised. The CTO personally explained that this was legacy they lost track of and thanked me for pointing out. You catch a lot, with catchall: dataleaks, hacks, sneaky data sales etc. When suddenly you recieve, say, marketing m…

I have been doing the same since 2001, the amount of crap the net catches is unfathomable. Apparently there is a company somewhere on this planet with the same name as my last name "bemis.com" while my domain is "bemis.net" and I sometimes get invoices, CVs, PowerPoint presentations, emails from their external auditors.. I am waiting for the day they will ask me to buy my domain (which I use long before their company was created)(oh and it is my last name.. so good luck with that).

Having done enough security audits, "this was legacy" is a BS excuse. I will go ahead and assume that NYT have an audit department. And that audit dept runs throug the full audit universe every 4-5 years. Someone would have captured that a long time ago (1st, 2nd, 3rd lines)(external auditors)(any sales pitch: "we have 438264728 subscribers")

I call BS. They got busted and now they most likely change this from 1000 to 2000 and call it a day..

Ps: bemis is not my real last name.. but I am using a super cool name over here!!

Re: Instead of deleting account, NYT appends ‘1000’ to username and email address

#160

Post by speleding »

Asuchug4 wrote: post #154
malinens wrote: post #151

Earlier quoted context omitted.

actually GDPR forces You to have option to delete all data and not just d8sable user

Depends on type of data and other laws. If you are a paying customer you can assume your data will be stay in database, until it is no longer required for audits. GDPR allows for anything that is 'absolutely totally required for providing service'.

In most countries you are required to keep payment records for tax purposes for 5 years or more. As this is a business necessity this trumps the GDPR. And since most business involves some kind of payment it's likely most businesses will not actually fully delete the information they have on file for you.
Post reply on HN