3 ms·
For a user in EU it should be possible to work around such ban. First make a GDPR request to have your data deleted. After som grace period, register again. I
by usr1106 7y ago
For a user in EU it should be possible to work around such ban.
First make a GDPR request to have your data deleted.
After som grace period, register again. If they tell you that you are banned, they show that they have not deleted the data. File a complaint with data protection authorities and have them fined.
Of course the better answer is just not to do any business with shitty companies.
- eropple 7y agoThis "clever hack" isn't how the GDPR works at all. In the first place, sufficiently pseudonymous data--that is, data that cannot by itself be used to reveal a specific, non-anonymous user--need not be deleted. (Hashing a ban list based on the personal and immutable information required at signup is an example of this, though discarding that information is.) Beyond that, the GDPR includes protections for companies against "manifestly unfounded" requests; while one must use this as an affirmative defense, a request to delete the record that that user has been banned from the service is a prime example of such things. I do wish that software people sometimes bothered to extend a baseline level of competence to other people once in awhile, though. Like--do you think nobody thought of this situation?
- bryanrasmussen 7y agoI guess the hashed ban list is reasonable solution. Actually looking at Airbnb you can register three ways - via FaceBook, Google, or via Email address. Signing via Email requires Email, first name, and birth date. I suppose if someone wanted to beat the ban they could do it at least 3 times.
- eropple 7y agoWithout even looking I can bet that they require identity and email when you log in via a social provider too. The better option is likely a set of hashes of various permutations of data, though, with some set of hits prompting for further information (such as an e-mail or a full name match requiring proof of identity before allowing usage).
- bryanrasmussen 7y agoMaybe but given that probably your verification at some point will involve an email account I think you could use GPDR to remove all personal info, and then use a new email address to sign up and get through. However if they could do something like use your credit card info to identify you and have a hash of that - until you changed bank etc. At any rate I don't think it is impossible to beat the ban.
- eropple 7y agoOf course. It's rarely, if ever, impossible to make a perfect ban on an online services. You just make it sufficiently difficult. Requiring some real hard identification information if a user trips your "maybe" filter is enough effort for the 99.9% case.
- usr1106 7y agoSuch hashing does not seem straight-forward to me. If you make it very exact, it's easy to get around. Use another email address, use a prepaid phone card, insert a middle initial, spell the street address slightly different and the hash will not match. The more fuzzy you make it ("normalizing" the data before calcukating the hash), the more likely it will cause a false positive for legitimate users. It's probably only a matter of time until we read articles on HN where such an algorithm got it wrong.
- 3dprintscanner 7y agoEven better you can make a subject access request (SAR) to Airbnb and get the internal communications about the person in question.