Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple requires account deletion within apps in AppStore starting January 31

developer.apple.com

Post reply on HN
Print view View original

281–290 of 515 posts

Re: Apple requires account deletion within apps in AppStore starting January 31

#281

Post by ben940830298432 »

8note wrote: post #71
jb1991 wrote: post #38

Earlier quoted context omitted.

This raises one notable benefit of going through Apple for all payments -- as a customer, it buffers me from dark billing patterns of any random company. Companies like 37signals don't like it and claim it hampered their relationship with customers, and that might be true in some cases, but overall it seems like a benefit for customers to have a consistency process of buying, refunding, cancelling everything they use…

I'm not sure I see that as a benefit so much a government doing a poor job on regulations for subscription services and online payments

Do you think government could actually keep up with technology to regulate it? And if they did regulate it would it actually help people or the companies that are buying them?

Re: Apple requires account deletion within apps in AppStore starting January 31

#282

Post by jonny_eh »

SllX wrote: post #41
madars wrote: post #4

Earlier quoted context omitted.

I heard you can change your address to California, which then gives the option to cancel online (due to state law). It is absolutely ridiculous that NYT will happily take your card info online, but require you to be on hold to speak with their "customer care" to cancel. Maybe it is time to use virtual CC's a la privacy.com.

I dunno. I cancelled the other day now that I no longer care about the pandemic data and it was basically just three minutes of politely stonewalling in a chat box saying “No Thanks, please cancel my subscription.” a couple of times. I live in California and would have tried cancelling online but actually couldn’t find the option. I can’t say it was difficult to cancel though once I picked a process and initiated it.…

> […] politely stonewalling in a chat box saying “No Thanks, please cancel my subscription.” a couple of times.

> I live in California and would have tried cancelling online but actually couldn’t find the option

The chatbox is the online option.

Re: Apple requires account deletion within apps in AppStore starting January 31

#283

Post by abnercoimbre »

tlogan wrote: post #118
core-utility wrote: post #35

Earlier quoted context omitted.

That's my biggest use case for Privacy.com. I care less about the privacy aspect and more about the convenience. I've already had once instance where a single-use card I created for 1 specific vendor started getting fraudulent hits (declines) and all I had to do was delete that card.

Be careful. You are still on the hook. And in many cases companies will sell you debt to collection agencies.

Long-time Privacy.com user.

You'll typically be OK with streaming services, newspapers, and mobile / web apps.

Definitely be careful with gyms, insurance companies, and any service that sends out invoices (instead of calling it a monthly subscription.)

Re: Apple requires account deletion within apps in AppStore starting January 31

#284

Post by dopu »

madars wrote: post #4
gumby wrote: post #2

Wonder if this can be used to unsubscribe from The NY Times?

I heard you can change your address to California, which then gives the option to cancel online (due to state law). It is absolutely ridiculous that NYT will happily take your card info online, but require you to be on hold to speak with their "customer care" to cancel. Maybe it is time to use virtual CC's a la privacy.com.

I signed up to NYT using a virtual CC, knowing how much of a pain it was to unsubscribe (I'm not in California). When I was through with it, I just paused the card. And I was amazed at how many times they tried charging it before giving up and actually cancelling the account. 13 times, now that I'm looking at it. The Gray Lady isn't as well-mannered as one might think.

Re: Apple requires account deletion within apps in AppStore starting January 31

#285

Post by inopinatus »

jimmydorry wrote: post #278
inopinatus wrote: post #272

Earlier quoted context omitted.

KYC/audit regs aside, it's also because the account belongs to the bank. The money is held in trust on your behalf, but the amounts are a liability on the institution's balance sheet. This is also why an increase in the balance of your deposit account is referred to as a credit; the statement is written from the bank's perspective, not yours. What you have is partial control of these funds, via instructions to your b…

This falls astray of the new Apple requirement though, as I understand it.

You might think that at first, but the distinction can be made for data as well. The argument goes, when is your data, not really your data? How about, when it's actually my records, of your use, of my system.

If you allow such a construct, then "deleting your account" could mean, your immediate personal details (or perhaps even just your access credentials) are erased in some fashion, but nothing else.

This is how legislation like the GDPR gets motivated, of course. The Apple guidelines reference "usage data" elsewhere, and I imagine that's for similar reasons. The deletion clause itself, rather notably, doesn't.

Re: Apple requires account deletion within apps in AppStore starting January 31

#286

Post by xg15 »

barsonme wrote: post #261
xg15 wrote: post #216

Earlier quoted context omitted.

Assuming this will take a few hundred years. Browsers have to frequently deprecate cryptosystems that have become insecure. That's not possible with data frozen inside the blockchain. Also, we're at a point where quantom computers are just starting to become practically usable. So yes, I think the point of a "cryptographic breakthrough" that will crack some configurations is quite likely.

If AES is broken in your lifetime, you're going to have _way_ bigger problems than somebody decrypting your blockchain ciphertext. And if you're not encrypting data with AES (or one of a handful of other algorithms), then you should be worried _now_.

If all of AES, then yes. But a particular choice of algorithm parameters can become insecure much earlier.

> If AES is broken in your lifetime, you're going to have _way_ bigger problems than somebody decrypting your blockchain ciphertext.

I'm not so sure about that. Not a lot of encrypted data is simply lying around at rest, available for everyone to run attacks against. Most encrypted data is either ephemeral (encrypted data connections) or secured by additional measures (e.g. to even get the raw bytes of an encrypted partition, you need access to the machine, appropriate permissions, etc) That gives the data owners various opportunities to react and mitigate the risks: Stop processes that send sensitive data, unmount sensitive partitions, detete data, etc.

You can't do a lot to protect data on the blockchain - it's literally out there for everyone to access.

Re: Apple requires account deletion within apps in AppStore starting January 31

#287

Post by dwaite »

anarchogeek wrote: post #27

What about inmutable systems? My app (using scuttlebutt) creates an 'account' but it's located as crypto keys only within the app and apple keychain. So far the apple reviewers refused to believe that it works like. It's open source, they've got the code... but still.... Same is true for anything crypto. The account as it were exists on many devices, but it's not something you as the app creator can manage. I think a…

You must provide a way to undo first party and third party data retention of personal data at the same level as the initial retention.

If such data exists in an app under control of the user, then uninstallation is fine.

If you persist that data in your own systems, you must provide a way to withdraw that consent. Same with data shared with third parties.

If you create an account in first party systems, you must provide a way to delete that account.

If the account is created outside the app (say via your website), thats fine, but you may get the same regulatory pressures directly (from GDPR, from California, etc) to support deletion in the same context.

Re: Apple requires account deletion within apps in AppStore starting January 31

#288

Post by mehrdada »

oauea wrote: post #259
dwaite wrote: post #147

Earlier quoted context omitted.

What would the alternative be - the method of installation is the App Store, and Apple's compliance was removing the public and private presence from the App Store within that country.

Just allow sideloading. It's not hard to not block that. But apple is hell-bent on collecting every cent they can, so of course all app installations must go through their walled garden where they can take their 30%. Anti-consumer behavior at its finest.

Sideloading is allowed with a free developer account.

Re: Apple requires account deletion within apps in AppStore starting January 31

#289

Post by dwaite »

barsonme wrote: post #261
xg15 wrote: post #216

Earlier quoted context omitted.

Assuming this will take a few hundred years. Browsers have to frequently deprecate cryptosystems that have become insecure. That's not possible with data frozen inside the blockchain. Also, we're at a point where quantom computers are just starting to become practically usable. So yes, I think the point of a "cryptographic breakthrough" that will crack some configurations is quite likely.

If AES is broken in your lifetime, you're going to have _way_ bigger problems than somebody decrypting your blockchain ciphertext. And if you're not encrypting data with AES (or one of a handful of other algorithms), then you should be worried _now_.

Bitcoin blockchain does not use AES, wallets do.

Elliptic curve signatures of the blocks are _significantly_ more fragile to quantum attacks than AES.

Re: Apple requires account deletion within apps in AppStore starting January 31

#290

Post by dwaite »

barneysversion wrote: post #208
jeroenhd wrote: post #40

Earlier quoted context omitted.

This is why using the blockchain got user data is such a stupid idea. The immutability makes it impossible to redact or remove information, even if that information is encrypted. The same is true foor P2P services where there is no central accounting system. Deleting the account shouldn't be a problem if all the "account" info is stored on the device itself, so if your reviewers aren't completely incompetent I don't…

Key management is how many comply with GDPR today. They encrypt the PII and associate it with the user. Then, when someone requests their info to be "deleted", they zero out the encryption key.

This should continue to work as long as you use systems that do not fall to pieces under quantum attacks.

AES is considered "resistant" in that quantum does an effective square-rooting of the brute forcing effort (or if you prefer, halving of the binary key length). So, do not use anything under AES 256.

Asymmetric algorithms fall apart though, which is why NIST has had a multi-year effort to select new standardized asymmetric algorithms.

Post reply on HN