For the most part a very good thing. Wonder what that means for third-party HN client apps though, since HN accounts cannot be deleted.
Offer a submit form that sends it over to the HN admin email address (that I forget.)
Apple requires account deletion within apps in AppStore starting January 31
421–430 of 515 posts
Re: Apple requires account deletion within apps in AppStore starting January 31
#422Earlier quoted context omitted.
If all of AES, then yes. But a particular choice of algorithm parameters can become insecure much earlier. > If AES is broken in your lifetime, you're going to have _way_ bigger problems than somebody decrypting your blockchain ciphertext. I'm not so sure about that. Not a lot of encrypted data is simply lying around at rest, available for everyone to run attacks against. Most encrypted data is either ephemeral (encr…
AES being broken doesn't mean someone managed to brute force a key. It means someone found a flaw that enables them to break any key in much less time than you'd expect a brute force attack to take. In other words, if AES is broken people would be able to read that ephemeral data quickly enough for it to be useful.
I know - and the ephemeral data that attackers were able to capture would of course be at risk.
My point was that data owners have options to limit damage - e.g. immediately stopping any data transmission and not producing any future ephemeral data.
Re: Apple requires account deletion within apps in AppStore starting January 31
#423Earlier quoted context omitted.
I don't think these are corner cases. If the user is allowed according with their contract or law to delete their account they should be able to request that themselves from within the app. This is what I understand from what Apple is requiring the apps to do. It is very similar with GDPR "Right to erasure"/"right to be forgotten". For your specific cases: - if a user rented something then they should not be allowed…
> If the user is allowed according with their contract or law to delete their account they should be able to request that themselves from within the app. This is what I understand from what Apple is requiring the apps to do. But now you're exposing the huge problem. It goes from "everybody has to be able to cancel their account in the app" to having to be a contract lawyer steeped in the specifics of every business a…
This is making a mountain out of a molehill. There's nothing to suggest any pre-conditions for deleting an account have to be removed, simply that it must be possible to "initiate deletion" from within the app.
Re: Apple requires account deletion within apps in AppStore starting January 31
#424Earlier quoted context omitted.
Defining account will be interesting. One definition might be: The 'account' consists of the credentials required to add or modify data associated with a human. In that case, the person deleting their private key would suffice for deleting an account. There are plenty of things this doesn't cover, or even backfires. Just interested in what other perspectives people may have. --- Scuttlebutt actually could allow for '…
I’m writing an app that has an account on a server. A user with no account can send a POST form (through the app), requesting that we create an account for them. We do so, through an admin dashboard. It’s easy to completely delete the account through the same dashboard, and I don’t think we have any legal obligations to retain the account. I’m planning to add a “delete my account” POST form, in the logged-in app. I a…
Why not just automatically create/delete the account? What's the purpose of manually transcribing their information to an admin panel? Also, does this mean you have humans copying over and potentially looking at (even if only on accident) people's passwords?
Re: Apple requires account deletion within apps in AppStore starting January 31
#425Earlier quoted context omitted.
A large meteor would delete it just fine.
With distributed data centers it needs to be a quite sizable meteor though. The dinosaur killer asteroid may not be enough if your redundancy is on the other side of the globe.
Keep your backup tapes in a safe on the other side of the pond, as they say.
Re: Apple requires account deletion within apps in AppStore starting January 31
#426Earlier quoted context omitted.
I don't think these are corner cases. If the user is allowed according with their contract or law to delete their account they should be able to request that themselves from within the app. This is what I understand from what Apple is requiring the apps to do. It is very similar with GDPR "Right to erasure"/"right to be forgotten". For your specific cases: - if a user rented something then they should not be allowed…
> If the user is allowed according with their contract or law to delete their account they should be able to request that themselves from within the app. This is what I understand from what Apple is requiring the apps to do. But now you're exposing the huge problem. It goes from "everybody has to be able to cancel their account in the app" to having to be a contract lawyer steeped in the specifics of every business a…
I agree that things can get complicated when taking into consideration multiple countries. But I think this is the cost of doing business and caring about users. If you do business in multiple countries then that is the cost to be paid.
I also think that the default should be that users should be able to delete their accounts and companies should provide evidence why they have that button disabled or removed.
So in case of review the rule maybe could be: if the user is creating an account in your app, then. the user should have the option to delete their account from the app, unless evidence is provided why the account cannot be deleted because of legal reasons.
Re: Apple requires account deletion within apps in AppStore starting January 31
#427Earlier quoted context omitted.
It clearly states that if you create the account in the app you have to be able to delete the account within the app. In none of those cases are you creating the account within the app.
>In none of those cases are you creating the account within the app. why not?
When have you been able to do a rental agreement through an app without signing paperwork?
Re: Apple requires account deletion within apps in AppStore starting January 31
#428Earlier quoted context omitted.
This is why using the blockchain got user data is such a stupid idea. The immutability makes it impossible to redact or remove information, even if that information is encrypted. The same is true foor P2P services where there is no central accounting system. Deleting the account shouldn't be a problem if all the "account" info is stored on the device itself, so if your reviewers aren't completely incompetent I don't…
> even if that information is encrypted. Assuming that information is only visible to the owner of the key anyways, then disposing of the key effectively renders that encrypted data as garbage. Not being able to delete it only enables some unknown future attack that can decrypt any data without the key.
Likely the encryption key (per user) should be split between central and distributed (device) system. That way the operator can remove any identifiable user from the chain. Leaks of the central system won't have an immediate effect, either. Still quite a bizarre case.
Re: Apple requires account deletion within apps in AppStore starting January 31
#429Does this include Apple Developer accounts?
Re: Apple requires account deletion within apps in AppStore starting January 31
#430Earlier quoted context omitted.
I’m writing an app that has an account on a server. A user with no account can send a POST form (through the app), requesting that we create an account for them. We do so, through an admin dashboard. It’s easy to completely delete the account through the same dashboard, and I don’t think we have any legal obligations to retain the account. I’m planning to add a “delete my account” POST form, in the logged-in app. I a…
Why not just automatically create/delete the account? What's the purpose of manually transcribing their information to an admin panel? Also, does this mean you have humans copying over and potentially looking at (even if only on accident) people's passwords?
It’s an app that is aimed at a specific demographic. It’s fairly important that we do our best to avoid giving accounts to “just anybody.”
If we ever get to the kind of scale that would require us to have automatic account creation, we’ll see. We certainly have the technical means to do it. Until then, we’ll have volunteer admins creating accounts.
I know that most services do everything they can, to push for massive scale, but we’re different. It’s an NPO, serving a fairly small subset of the population, and we need to be careful not to sacrifice quality for scale (heresy, I know).
The temp passwords are auto-generated and sent to the user, and stored in the traditional one-way hash. The dashboard can reset passwords, but we pretty much let the user do what they want, once the account is set up.