Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple requires account deletion within apps in AppStore starting January 31

developer.apple.com

Post reply on HN
Print view View original

491–500 of 515 posts

Re: Apple requires account deletion within apps in AppStore starting January 31

#491

Post by xg15 »

barsonme wrote: post #487
xg15 wrote: post #420

Earlier quoted context omitted.

> You can protect them the same as you would a regular database. Then you'll need some central entity to manage access to the chain. If you already have a central entity, you can just use a regular database instead of a blockchain and save yourself all the energy waste.

The key aspect of a blockchain is that each block contains the hash of the previous block. That provides integrity guarantees that you don't get simply by using a central entity.

I'd say the "each block contains the hash of a previous block" property is the implementation but not the key aspect. (Unless you count a git repo as a blockchain too)

I think the key aspect is that it is a database that no single person or organisation can delete or alter - not even the developers or operators of the database themselves. The only operation possible is append.

But this property requires that the majority of nodes participating in the chain are not under your control. When the nodes are under your control, you could just order them to swap out the current chain with one you just made up. (Which is effectively how git's "history rewriting" features work) This doesn't provide any more integrity than an ordinary database.

On the other hand, if you want an append-only database and you already have a central gatekeeper that you trust (as required for access enforcement), you also can use an ordinary database and have the gatekeeper enforce the append-only property. No blockchain required.

Re: Apple requires account deletion within apps in AppStore starting January 31

#492

Post by jmull »

staunch wrote: post #343
jmull wrote: post #179

Earlier quoted context omitted.

I don't believe "only download data through an Apple proxy service" does much for user privacy/control of data. A seemingly benign request that appears to simply request information can encode a user's private, sensitive data in the request URL, e.g. I think there's no real distinction between your 2. 3. and 4. There's a place for no internet access at all. It would be good if they had a permission for that.

The entire request can be logged, displayed to advanced users (so they can report it), inspected by Apple's review teams and automated systems. Any app violating the rules, by uploading user data as GET query parameters (for example) could be detected and banned fairly easily.

> could be detected and banned fairly easily

No, it could not. Cryptography can make it as difficult as necessary.

(Not even going to touch how unacceptable it would be for Apple to require that it be able to inspect all internet traffic from a person's phone.)

Re: Apple requires account deletion within apps in AppStore starting January 31

#493

Post by tk75x »

midev wrote: post #336
asdff wrote: post #185

Earlier quoted context omitted.

I still don't get it. You cancel the account, it should be gone like it never happened. Poof. If you make a new account with the same email, it should be a new account with no relation at all to the old account since that one has been deleted and is gone forever and there would be nothing to impersonate here.

> I still don't get it. You cancel the account, it should be gone like it never happened As long as that change cascades to every single site that the user could have registered with. Otherwise, there could be hundreds or thousands of sites waiting to email confidential information to a new person.

this already happens when you move physically to a new residence. except there isn't a system for "change of email address"

Re: Apple requires account deletion within apps in AppStore starting January 31

#494

Post by igornadj »

widowlark wrote: post #67
jb1991 wrote: post #38

Earlier quoted context omitted.

This raises one notable benefit of going through Apple for all payments -- as a customer, it buffers me from dark billing patterns of any random company. Companies like 37signals don't like it and claim it hampered their relationship with customers, and that might be true in some cases, but overall it seems like a benefit for customers to have a consistency process of buying, refunding, cancelling everything they use…

it buffers you from dark billing patterns of all companies except apple

That's the "you have the choice to not use Apple" argument. Until apple becomes the only choice in the market I agree with the argument.

Re: Apple requires account deletion within apps in AppStore starting January 31

#495

Post by ceejayoz »

delfinom wrote: post #483
ceejayoz wrote: post #57

Earlier quoted context omitted.

Even better, when I had to cancel my NYT subscription, it said there weren't enough cancellation reps to connect me; "try again later". I went in via the normal support chat, said I wanted to cancel, and was immediately redirected to one. It was an outright lie.

Is apple somehow weird with canceling subscriptions on the iPhone? I can just go into the Google Play store and terminate the subscription for the NYTimes on Android in one click.

Apple makes it easy. I was subscribed directly with the NYT on their site, not the iOS app.

Re: Apple requires account deletion within apps in AppStore starting January 31

#496

Post by oauea »

simonklitj wrote: post #490
oauea wrote: post #489

Earlier quoted context omitted.

How? There must be some restrictions or this would be HUGE news and Epic would rejoice. edit: the apps expire after 1 week and need to be constantly reinstalled. This is abusing an exploit in apple's walled garden that will surely be "fixed".

They’re not abusing an exploit. You might be able to argue that they’re abusing a policy. The fact is that you are allowed to sign apps with a free dev account, the cert will just expire after a week. AltStore’s been around since 2019, so they’ve had ample time to “fix” it. Edit: they do not need to be reinstalled. With AltStore the cert update is automatic and wireless (your computer handles it and sends the updated…

Yeah, I don't think I'm going to be able to explain all that to my users. Some of them don't even have a computer.

Re: Apple requires account deletion within apps in AppStore starting January 31

#497

Post by inopinatus »

dahfizz wrote: post #475
inopinatus wrote: post #272

Earlier quoted context omitted.

KYC/audit regs aside, it's also because the account belongs to the bank. The money is held in trust on your behalf, but the amounts are a liability on the institution's balance sheet. This is also why an increase in the balance of your deposit account is referred to as a credit; the statement is written from the bank's perspective, not yours. What you have is partial control of these funds, via instructions to your b…

Couldn't you make that same argument for any online service? "I own the database and servers, its my account that I operate on the user's behalf. Therefore they cannot delete the account".

You can make that argument, and many do, and some courts may even be suckered into falling for it when push comes to shove. In a more jurisprudent analysis, however, it relies on a false parity between consumer and company in negotiating power.

Legislation like the GDPR is motivated in part to nullify such arguments.

Re: Apple requires account deletion within apps in AppStore starting January 31

#498

Post by mehrdada »

oauea wrote: post #496
simonklitj wrote: post #490

Earlier quoted context omitted.

They’re not abusing an exploit. You might be able to argue that they’re abusing a policy. The fact is that you are allowed to sign apps with a free dev account, the cert will just expire after a week. AltStore’s been around since 2019, so they’ve had ample time to “fix” it. Edit: they do not need to be reinstalled. With AltStore the cert update is automatic and wireless (your computer handles it and sends the updated…

Yeah, I don't think I'm going to be able to explain all that to my users. Some of them don't even have a computer.

You are changing the goalposts here. You don’t just want sideloading. You also want an easy way to do that at scale. However that’s not an obviously beneficial trade-off for the average user.

The point is as the device owner you have the ability to run code on your own device outside App Store without paying Apple. To be able to effectively distribute such code to the average iOS user who may not understand how to deploy unsigned app and the potential implications of it is a different story and one that you could argue is designed to protect the layperson against themselves (contrast this with users running random .exe from emails on Windows).

Re: Apple requires account deletion within apps in AppStore starting January 31

#499

Post by Fire-Dragon-DoL »

anarchogeek wrote: post #27

What about inmutable systems? My app (using scuttlebutt) creates an 'account' but it's located as crypto keys only within the app and apple keychain. So far the apple reviewers refused to believe that it works like. It's open source, they've got the code... but still.... Same is true for anything crypto. The account as it were exists on many devices, but it's not something you as the app creator can manage. I think a…

Well, from your perspective, wouldn't mean you just need to discard such keys for making the account unrecoverable from your perspective?

Re: Apple requires account deletion within apps in AppStore starting January 31

#500

Post by tekknik »

rattlesnakedave wrote: post #370
tekknik wrote: post #356

Earlier quoted context omitted.

Congrats, now those docs are stored in a database. Good luck getting them deleted.

Yes, banks store your information in databases. Not sure what you’re driving at.

They certainly don't scan and save images of your identifying documents when you go into the branch. They may store your DL and SSN number. This is a lot less than you volunteering up your identifying documents to a public webserver.
Post reply on HN