4 ms·

I'm not sure what the big deal of this is. I've been using a password manager for many years now, and have no idea how many total passwords I have, nor do I car

I'm not sure what the big deal of this is. I've been using a password manager for many years now, and have no idea how many total passwords I have, nor do I care. I don't ever look at the full list (only search it), and there's really no cost to having lots. In fact, many times, I've gone to a site for what I thought was the first time, and was surprised to see I had an account already. If I had done a purge, I probably would have deleted a bunch of sites like this. My account would still be there, but inaccessible. I also use a unique email for every site (via a catch-all subdomain), and in the past couple years, also started making random usernames for any sites where I don't care about the username (eg, no social component). This helps protect me from compromised sites, because I can block the email address if I get spammed by it. I think I've only done that once in the past 15+ years, though spam filters also really make this a non issue for me the days.

berberous 8y ago
I also have hundreds and hundreds of logins and my issue is that every week now some site gets breached. A lot of them are super old and I'd prefer to have the site delete all my info, but it's too time consuming to manually do that. That /well-known/ idea is great. There should be a /well-known/permanently-delete, so that my password manager can scrub my old accounts with one click.
- gregmac 8y ago
  Cleaning accounts from your password manager and cleaning your accounts from the internet are two very different things. The article and my comment were about the former. I agree with you though, that a well-known url for delete would be good. However, there's likely to be a high correlation between sites that get breached and sites that don't follow best practices, including implementing optional URLs like that. In general, it's also easy to see why a lot of (non technical) site/product owners wouldn't want to implement that: "why do I care about making things easier for people that want to terminate doing business with me?" Until a majority of users are using a browser/plugin that warns about this ("non trustworthy site: this site does not implement well-known password change or delete account interfaces") I suspect there won't be much adoption, unfortunately. This proved to work well to get SSL widely deployed, so the question is if there can be enough momentum to do it again for these functions.
- btrettel 8y ago
  I don't think sanitizing or deleting online accounts is that time consuming. I have about 600 accounts listed in my password manager, about 300 of which are categorized as either offline or deleted. Starting late last year I went through my accounts and started either deleting the ones I have no intention of using in the future or, if deletion is not an option, sanitizing them. It doesn't take that long to sanitize 10 accounts, and takes even less time to identify whether a website is still online. I've probably sanitized or deleted around 100 accounts now, starting with the ones I guessed would have the most data on me. I've also been pleasantly surprised by how helpful most webmasters have been with removing or sanitizing PII if they won't let you delete an account. One notable exception: Airbnb. They claim online that they will delete your account if asked but refuse if you do ask. I had no intention of using Airbnb in the future, but now I'll actively discourage others from using Airbnb. https://www.airbnb.com/help/article/240/how-do-i-deactivate-or-delete-my-account https://www.airbnb.com/help/article/240/how-do-i-deactivate-...
  - scrollaway 8y ago
    I know (from your site) that you're not european, but to any EU citizens out there reading: Know your rights. You can unrequivocably request deletion of your personal data, including your account, if it's known to be stored somewhere on the internet (edit: or even off the internet. Physical records are covered!). There are rare exceptions (eg. financial data required for tax purposes, security/compliance, …), but I've never seen it be an issue. And if it is an issue, there are enforcement organizations that will help.
    - Mirioron 8y ago
      Too bad that almost all sites you'd actually want to use or have used are outside of the EU. Unless it's a big site they probably have no EU presence and there would be no way for the EU to do anything.
      - mmmmpancakes 8y ago
        I don’t know if you are right. Being hosted outside the EU doesn’t seem to exemt companies that handle EU citizens data from complying with EU privacy laws.

berberous 8y ago

I also have hundreds and hundreds of logins and my issue is that every week now some site gets breached. A lot of them are super old and I'd prefer to have the site delete all my info, but it's too time consuming to manually do that. That /well-known/ idea is great. There should be a /well-known/permanently-delete, so that my password manager can scrub my old accounts with one click.

gregmac 8y ago
Cleaning accounts from your password manager and cleaning your accounts from the internet are two very different things. The article and my comment were about the former. I agree with you though, that a well-known url for delete would be good. However, there's likely to be a high correlation between sites that get breached and sites that don't follow best practices, including implementing optional URLs like that. In general, it's also easy to see why a lot of (non technical) site/product owners wouldn't want to implement that: "why do I care about making things easier for people that want to terminate doing business with me?" Until a majority of users are using a browser/plugin that warns about this ("non trustworthy site: this site does not implement well-known password change or delete account interfaces") I suspect there won't be much adoption, unfortunately. This proved to work well to get SSL widely deployed, so the question is if there can be enough momentum to do it again for these functions.
btrettel 8y ago
I don't think sanitizing or deleting online accounts is that time consuming. I have about 600 accounts listed in my password manager, about 300 of which are categorized as either offline or deleted. Starting late last year I went through my accounts and started either deleting the ones I have no intention of using in the future or, if deletion is not an option, sanitizing them. It doesn't take that long to sanitize 10 accounts, and takes even less time to identify whether a website is still online. I've probably sanitized or deleted around 100 accounts now, starting with the ones I guessed would have the most data on me. I've also been pleasantly surprised by how helpful most webmasters have been with removing or sanitizing PII if they won't let you delete an account. One notable exception: Airbnb. They claim online that they will delete your account if asked but refuse if you do ask. I had no intention of using Airbnb in the future, but now I'll actively discourage others from using Airbnb. https://www.airbnb.com/help/article/240/how-do-i-deactivate-or-delete-my-account https://www.airbnb.com/help/article/240/how-do-i-deactivate-...
- scrollaway 8y ago
  I know (from your site) that you're not european, but to any EU citizens out there reading: Know your rights. You can unrequivocably request deletion of your personal data, including your account, if it's known to be stored somewhere on the internet (edit: or even off the internet. Physical records are covered!). There are rare exceptions (eg. financial data required for tax purposes, security/compliance, …), but I've never seen it be an issue. And if it is an issue, there are enforcement organizations that will help.
  - Mirioron 8y ago
    Too bad that almost all sites you'd actually want to use or have used are outside of the EU. Unless it's a big site they probably have no EU presence and there would be no way for the EU to do anything.
    - mmmmpancakes 8y ago
      I don’t know if you are right. Being hosted outside the EU doesn’t seem to exemt companies that handle EU citizens data from complying with EU privacy laws.