Apple requires account deletion within apps in AppStore starting January 31 • Hacker News Board

Re: Apple requires account deletion within apps in AppStore starting January 31

#511

Post by curryst » Sat, Oct 09, 2021, 4:55 AM UTC

midev wrote: post #331

dwaite wrote: post #290

Earlier quoted context omitted.

This should continue to work as long as you use systems that do not fall to pieces under quantum attacks. AES is considered "resistant" in that quantum does an effective square-rooting of the brute forcing effort (or if you prefer, halving of the binary key length). So, do not use anything under AES 256. Asymmetric algorithms fall apart though, which is why NIST has had a multi-year effort to select new standardized…

There are no known quantum attacks, so it's pretty pointless for most people to consider it in their threat models. If you're a nation state that needs to protect information for 30+ years, then it's worth considering. For everyone on HN, it's not.

There are select bits of info we should protect, but can't. If you're in the US, your SSN is one of those.

It never ceases to make me chuckle that it says that it's not a form of ID on front, and yet everyone considers it a form of ID. Even state governments. It's usually listed under one of the documents they accept to prove ID.

Re: Apple requires account deletion within apps in AppStore starting January 31

#512

Post by yohannparis » Sat, Oct 09, 2021, 11:10 AM UTC

gumby wrote: post #18

yohannparis wrote: post #8

Earlier quoted context omitted.

This is mostly an internet meme, I subscribed and cancelled from the NYT many times without an issue with their online chat.

Are you in California?

No, in Canada

Re: Apple requires account deletion within apps in AppStore starting January 31

#513

Post by m0dest » Sat, Oct 09, 2021, 1:12 PM UTC

AnthonyMouse wrote: post #481

jrek wrote: post #423

Earlier quoted context omitted.

This is making a mountain out of a molehill. There's nothing to suggest any pre-conditions for deleting an account have to be removed, simply that it must be possible to "initiate deletion" from within the app.

Then you're defeating the purpose of the requirement, because the scummy scam service will let you "initiate" deletion but to actually carry it out you still have to call them and wait on hold for sixteen years or come show your ID in person at their offices in Northern Alaska.

Frankly, this would still be a good start compared to the norm today: You can't even find information about account deletion from most mobile apps, let alone initiate the process.

Re: Apple requires account deletion within apps in AppStore starting January 31

#514

Post by vurpo » Wed, Oct 13, 2021, 8:06 AM UTC

barsonme wrote: post #487

xg15 wrote: post #420

Earlier quoted context omitted.

> You can protect them the same as you would a regular database. Then you'll need some central entity to manage access to the chain. If you already have a central entity, you can just use a regular database instead of a blockchain and save yourself all the energy waste.

The key aspect of a blockchain is that each block contains the hash of the previous block. That provides integrity guarantees that you don't get simply by using a central entity.

That part is very easy to implement without all the extra cruft that a blockchain also brings with it. Git manages to do that same thing without burning a ton of coal every time you make a commit.

Re: Apple requires account deletion within apps in AppStore starting January 31

#515

Post by ManBlanket » Fri, Oct 15, 2021, 5:48 PM UTC

debaserab2 wrote: post #222

ManBlanket wrote: post #214

This policy seems purposefully vague. "Explain its data retention/deletion policies and describe how a user can revoke consent and/or request deletion of the user’s data." My first question before looking into it was, "What an auth tenant or some other service that stores user data?" or, "what about like a banking or healthcare app that is just a portal for another system?" And, "What does deleted even mean? IsDelete…

When did "deleted" become a vague term? Deleted means removing as much PII as you reasonably have authority to do so. It means purging all that data from all databases with a guarantee that you will be removed completely from all snapshots in a reasonable amount of time. This should be the default, normal understanding of what it means to delete your account. It doesn't mean set a flag in a database so when your comp…

I know you wrote this 8 days ago and I dunno if you'll even see my response but deleted has always been a vague term. There are a ton of reasons not to hard-delete data before you arrive at data mining. I know a lot of concerns regarding GDPR and data mining would contend for the hard delete, but a couple people gave you good examples. I just wanted to share one I am looking at right now. Our users have the ability to perform an action over a large set of their own data. Sometimes they do things like deleting relations they didn't realize would have a larger impact. Luckily the code in question doesn't hard-delete the entities, because I just got a ticket today asking if a huge list of IDs could be restored.

I think looking at deletion as the solution to privacy concerns is the wrong way to go about it. Really, the problem is app developers think, "possession is 9/10ths of the law" when it comes to data, when in reality their relationship with the user never captured use of that data for purposes not related to the application. Just because you give your data to the bank when you make an account doesn't mean you consent to them selling it on the dark web. The same concept applies but it is much harder to police and you can even say you're going to misuse the data in the EULAs that nobody reads. In my opinion using user data for purposes unrelated to the application should straight up require explicit consent from every user, lest the seller and recipient be subjected to a fine.