20 ms·
Instead of deleting account, NYT appends ‘1000’ to username and email address
- basicplus2 7y ago"instead of actually deleting it, they simply appended '1000' to both the username and the email address. anyone could thus create an email address with that suffix and request a password request to access my info."
- deleted 7y ago[deleted]
- polote 7y agonot an issue as long as there is no tld which ends with 1000 though
- bagacrap 7y ago"the number was appended to local-part, not the domain. I found out by going back to a tab where my session was still valid but the account dropdown had updated with the new name. Profile settings revealed the email."
- deleted 7y ago[deleted]
- diggan 7y agoMost likely the 1000 is appended to the local-part of the email address, not the domain, as any tool they are using for changing details most likely validates emails somehow.
- yaur 7y agoThe email address doesn’t really need to be valid though. I have an old client that appended ‘|disabled’ after the email address (and torched the password) when “deleting” accounts because they needed them in the DB for audit logging. Unless someone figures out how to register a domain ending in ‘.com|disabled’ I’m not sure how someone would be able to access those accounts.
- thanksforfish 7y agoEvery week we see multiple articles about security researchers who abuses some part of the tech stack to do something weird that shows the danger in this sort of thinking. I believe it's easy to spoof emails from the .com|disabled domain. Receiving messages, I agree, seems harder. Maybe spoof an unencrypted DNS response at the right moment? No need to actually register a domain when DNS is spoofable.[1] If you really need to use a hack like that to disable an email, consider adding some code to your email sending logic that skips such email addresses (and always use that logic). Otherwise clever hackers have a foothold to try their tricks against. [1] https://en.m.wikipedia.org/wiki/DNS_spoofing https://en.m.wikipedia.org/wiki/DNS_spoofing
- jrockway 7y agoIn-band signalling has always been error-prone. It's never worked and it never will.
- waltpad 7y agoMy guess would be that they don't want to have that email accidentally used, but they would have a check in the codepath anyway, because no-one wants to see its logs spammed with myriads DNS errors when this can be avoided. And in fact, if a DNS error shows up in the logs, devs would know that somehow their code path is not completely safe, so that change on the email is perhaps a way for them to ensure that the disabled account is indeed seen as disabled by their code in every situation. A lot of people are complaining about NYT approach, but perhaps their only fault - if one consider that not deleting for good an account is not an issue, and it seems to be a common practice in the industry - is to not use a transaction when disabling user accounts (disable email -> disable account), which is perhaps difficult with NoSQL setups?
- hobs 7y agoCompletely wrong, dont just munge someone's email and hope it wont work, we literally have domains for this kind of stuff. https://www.iana.org/domains/reserved https://www.iana.org/domains/reserved
- gruez 7y agoChances of com1000 being delegated is low.
- thanksforfish 7y agoWhy would it need to be designed? Email delivery depends on DNS, which is unencrypted and spoofable. Spoofing emails is also doable.
- loopdoend 7y agoIf the dns lookup on a com1000 domain fails, the email won’t go anywhere.
- thanksforfish 7y agoCorrect. But if a DNS response for that domain is spoofed. It will. DNS is a very old protocol that still has lots of problems and mitigations like DNSSEC are only partially deployed.
- gruez 7y agoEmail is an inherently insecure medium. If an attacker can compromise the DNS responses for your mail server, you're hosed.
- gentleman11 7y agoIt’s odious that it’s impossible to delete accounts except in rare circumstances. Ever try? All anybody does is temporarily disable them unless you go through an hour with their tech support. Dark pattern at best, holding on to your data forever to continue selling it at worst
- Traster 7y agoIt's things exactly like this that were a damn good reason the EU implemented GDPR.
- throwaway55554 7y agoNow a days it is a dark pattern. But in the days before "sell everything you can about your users" became the rule, businesses optimized for the accidental deletion by users. They could easily reinstate you and your data would still be there. It used to be considered good customer service. Times change.
- viklove 7y agoYou know HN doesn't let you delete your account, right? Even if you send them an email, apparently they're "too backed up" to handle account deletion requests.
- throwaway882321 7y agoWhy 1000? Probably arbitrary but I can't help but wonder why 1000 instead of the faster 1111 or 1234, perhaps someone using NumPad?
- srg0 7y agoBecause the change was done manually. Their system probably doesn't implement a function to delete account, or it is not easily discoverable in the UI, or it is known to be bugged. So the employee who did that thought that renaming an account was a good idea to make it appear "missing". A big numeric suffix is an obvious idea to avoid collisions with the existing and future accounts. But when people are asked to choose a large number, numbers around 1000 and its multiples are chosen particularly often. So 999, 1000 and 1001 are very likely numbers to be picked "randomly". I don't find the reference on that, but I suppose we all have enough anecdotal evidence. Just recall what are the common port numbers of various programs. X*1000 + Y is a very common formula, where |Y| < 100.
- isoprophlex 7y agohttps://en.m.wikipedia.org/wiki/Benford%27s_law https://en.m.wikipedia.org/wiki/Benford%27s_law Maybe this is what you're looking for?
- recursive 7y agoThat's about numbers from "real-life" distributions, so that's a different thing.
- willis936 7y agoI really doubt someone who thought the solution to being unable to delete an account is to change the account name put this much thought into what to change the account name to.
- mistyq 7y agoHow was it possible to discover it, though?
- samthecoy 7y agoFrom the twitter comments: https://twitter.com/bicycult/status/1255122953798328320 https://twitter.com/bicycult/status/1255122953798328320 They were still logged in and refreshed the page; they found out by going to their user settings.
- KeepFlying 7y agoI noticed a similar thing being done for Bird scooters a while back. I forget the suffix but they did the same and I noticed because I was still authed on my phone after requesting deletion. My token has expired since then though so for all I know they have fully deleted the account since.
- deleted 7y ago[deleted]
- ashtonkem 7y agoHaving known people who worked at Bird, I doubt it. They had a real culture of “hack it up and then move on”, going back and fixing stuff like that isn’t in their culture.
- jasonbarone 7y agoI've seen this same method used on multiples apps I've requested an account deletion on. It's super frustrating. Most companies either don't respond back, say they deleted it when they merely disabled it, or they updated the account name to something else.
- three_seagrass 7y agoDisabling is understandable, because as a company you need a record of transactions or interactions such as TOS agreements for legal purposes. This requires keeping the records. Changing object name data though is a terrible practice to implement this.
- deleted 7y ago[deleted]
- ornornor 7y agoNetflix does that too. You can’t delete your account so they just append a string like “csr_morgan” in the domain so that your account is “deleted” (you can’t login anymore, because your email address technically doesn’t have an account anymore) and you can re-register with your email later if you wish. But I’d you use the altered email and the same password, everything is still there. Pretty sure this goes against GDPR but I was totally unsuccessful at getting my account deleted.
- Nextgrid 7y ago> Pretty sure this goes against GDPR but I was totally unsuccessful at getting my account deleted. Did you report this to your local privacy regulator (the ICO in the UK for example)? Not saying they'll do anything (I guess the "4% of global turnover" fines aren't enough to motivate them) but at least there's a record of it, and if anything else, a proof of how useless the whole regulation is.
- tomjakubowski 7y agoHow did you find this out?
- ornornor 7y agoWas still logged in when they made the change, so I could see which email they changed it to.
- thewebcount 7y agoWhat happens when you re-register with the same email address and then later cancel again?
- ornornor 7y agoI dont know... I'd be curious to find out but I honestly dont have the time or motivation to figure out their broken processes.
- DonHopkins 7y ago
- tobr 7y agoNo information on how they found out? Did the service rep tell them?
- avian 7y agoOne possible way I can think of is they're hosting their own mail server and route messages for all unknown addresses to some mailbox (not that uncommon as far as I know - people do that to avoid bouncing mails with a typo in the address). With such a setup it would be possible to notice that NYT mail started coming to foo1000@... instead of foo@... after requesting account deletion. Username change could also be evident directly from the mail, or it was a trivial guess.
- heyoni 7y agoHe’s saying they append 1000 to the user and domain. /edit I was wrong. It’s the user and email. Your theory would work
- gruez 7y ago>/edit I was wrong. It’s the user and email. Your theory would work Why? My interpretation of "append 1000 to email" is that 1000 gets added to the very end, not the local part.
- heavenlyblue 7y agoJust have a friend working at NYT who tells you how NYT actually manages account deletions while having a pint; then try to delete your account and check whether the emails come to a new email. Write an article about it.
- lubblig 7y agoFrom the Twitter replies: "the number was appended to local-part, not the domain. I found out by going back to a tab where my session was still valid but the account dropdown had updated with the new name. Profile settings revealed the email." https://twitter.com/bicycult/status/1255122953798328320 https://twitter.com/bicycult/status/1255122953798328320
- draw_down 7y agoObviously not a great practice, but I don’t think .com1000 TLD will be coming along anytime soon.
- OutsmartDan 7y agoNYT is notoriously the worst at customer service and account handling. I tried to get a previous invoice from them previously and after 1 week of calling customer support and being passed around, I still wasn't able to get it.
- paulcole 7y agoStill love the story of the Pinboard guy’s approach to invoices. If you ask for an invoice, he sends you a blank one and tells you to just fill it out however you want.
- the-dude 7y agoIn The Netherlands there are legal requirements for invoices.
- paulcole 7y agoHe said in his tweet about this that when he does it to Europeans (specifically Germans, I think) they just get even madder. I mean great if there are legal requirements for invoices, but who enforces them, how likely is enforcement, and what’s the end result for a US-based company with no physical presence in The Netherlands?
- petercooper 7y agoThe real issue is with the local (European) company when they claim the expense against profits and the tax inspector turns their nose up at the invoice/receipt. Being in the UK, we tend to work on a system where things are taken in context and you can defend such decisions. Maybe other tax regimes are more restrictive, but the British way is always that you can have a debate with authorities and usually they will see sense in your reasoning if you're not trying to defraud them.
- paulcole 7y agoThat all sounds like the local company's problem right? If they want to claim the expense they can find a competing company who issues an invoice.
- jbverschoor 7y agoMany companies do this
- yepthatsreality 7y agoYes especially in New York. I once asked the Curb cab app to delete my account. They replied with an email that they did and I checked the app. My session was still valid and I could see my account details. All they changed my email address domain to @aol.com and 555’d my phone number.
- deleted 7y ago[deleted]
- inopinatus 7y agoI’d bet (a small amount of) money they have no ability to delete accounts at all, and it goes all the way down to foreign key constraints introduced by a well-meaning but inexperienced developer that unnecessarily couple the accounts table to many other records.
- emodendroket 7y agoIn that case it seems simpler to introduce an IsDeleted flag than to have a convention that 1000 goes on the end of the name.
- Bjartr 7y agoSomeone wanted to get this done without waiting on the DBA team so they rolled some implicit schema instead.
- neovive 7y agoThis reminds me of a good use case for the Laravel Soft Deletes: https://laravel.com/docs/7.x/eloquent#soft-deleting https://laravel.com/docs/7.x/eloquent#soft-deleting.
- marcofatica 7y agolove this feature so much
- 0xCMP 7y agoSure, but that just covers up the lie better. Maybe a flag "ToBeDeleted" and any stilled logged in sessions see account is scheduled for deletion.
- nunez 7y agoI'm learning about database design, and I'm learning that this might not be that easy if the relationships between users and other data on the site are ill-defined. There may be multiple tables in their design that will require knowledge of that flag, and it might legitimately be way easier to just add junk to the end of the user account than it is to introduce a new flag.
- petercooper 7y agoNote that "anonymization" has been legally found (DSB-D123.270/0009) to be acceptable to meet GDPR "erasure" requirements. However, this requires irrevocable overwriting of PII rather than just slapping 1000 on the end ;-) If they'd changed the username and email address to some random string, however, they would most likely be compliant.
- isoskeles 7y agoWouldn't they also need to replace saved billing details, like address and full name, to anonymized garbage?
- mschuster91 7y agoIn Germany not; these are required by law (§147 AO, https://www.gesetze-im-internet.de/ao_1977/__147.html https://www.gesetze-im-internet.de/ao_1977/__147.html) to be kept for ten years. The legal base for allowing this national rule in European law is Art. 6, 1c GDPR.
- MaxBarraclough 7y agoI think something similar happens in the UK. It's generally believed here that laws telling you to retain data take precedence over the GDPR telling you to delete it. (I am very much not a lawyer, as you can doubtless tell.)
- matthewheath 7y agoYes. For example, HMRC requires that you keep various business records for 6 years (or longer, circumstance-specific) after the end of the company's financial year. Generally, the rule is "Delete the data unless there's a law that requires you not to" — and the UK's implementation of the GDPR (the Data Protection Act 2018) makes various explicit exemptions for this.
- jkaplowitz 7y agoBut they'd need to get rid of it in the 11th year, right? And even before then, they'd need to delete some of the earliest records for someone who has subscribed for more than 10 years. Lots of compliance traps remain.
- Fjolsvith 7y agoNot suprising from the Times. They don't like to publish retractions.
- welcome_dragon 7y agoBazinga
- bahna 7y agoXBox live used to have a similar thing, may have changed since GDPR. When I asked for my account to be deleted they sent me instructions that said basically unfriend everyone i know and change my name to deleted - this was after several days of them looking into it for me :/
- DevX101 7y agoDoing real deletes on user accounts is a surprisingly challenging problem and I'd be willing to bet very few companies do real deletes where all of your data is wiped permanently from the company. For legal and financial reasons, companies often need to keep track of historical user activity. If a company states in their investor quarterly report that they had 1M active users, they better be able to prove it in an audit. And in a naive relational database implementation, deleting a user would cascade and delete activity associated with that user. The easiest way around this is to do soft deletes where the data stays in the db, but the flag deactivates the user's account. Looks like the NYT just did a poor implementation of a soft-delete.
- antsar 7y ago> poor implementation Well that's an understatement. NYT has the tech resources to do this a million better ways. > investor quarterly report [...] active users Speaking of "active user" counts, it's convenient that "jsmith1000" is plausibly an active user, whereas "jsmith(state:deleted)" is not. Hm.
- mesozoic 7y agoPretty sure that breaches GDPR and maybe CCPA. Maybe they can get away with anonomyzing the data but that doesn't sound like what is being done.
- true_religion 7y agoSure, but a local paper like the New York Times is hardly subject to the laws of the EU, so GDPR doesn’t apply.
- wtfishackernews 7y agoIf their website is accessible from the EU then they are subject to GDPR.
- 6gvONxR4sf7o 7y agoIt does if they take subscribers from the EU (or california) and apply this process to them. It's incredibly straightforward. If you do business in some jurisdiction, then that business is subject to the jurisdiction's laws.
- hinkley 7y agoIs it also possible that since they have a subscription model, they have to build their system around people leaving and coming back? I mean imagine if HBO had deleted accounts during GoT and Westworld instead is suspending them. How many people had a 9 month subscription per year for years at a time?
- 5cott0 7y agoGives a different meaning to The Privacy Project.
- a_t48 7y agoWhat happens if I create an account at both foo@gmail.com and foo1000@gmail.com (or even foo+@gmail.com and foo+1000@gmail.com), and then delete the first one?
- dylz 7y ago1001 /s
- suizi 7y agoHow ironic considering they were pointing their fingers at "Big Tech" for not being "GDPR compliant".
- sp332 7y agoHah, Uber did this to me once. Someone signed up with my email and somehow the verification failed. So they started sending me details about someone else's trips! When I complained, instead of deactivating the account or trying to contact the user to find out their actual email, they changed the address on the account to the same thing but with "void" prepended. I have a gmail account and was pretty sure that email didn't exist... Sure enough, I tried registering the new email address with Google and got nothing but Uber spam. Oh well at least they're not sending me trip details anymore.
- ShakataGaNai 7y agoA lot of companies do this. My buddy found out that he had two EA accounts, so he asked nicely for them to merge them into one and they "did". Well what they actually did was grant the games to the new account and "delete" the old account. Of course "delete" meant rename it from username@custom.tld to usernameDELETED@custom.tld. He owns the entire domain (and has catchall) so he got the notification of the changed email to the new email address. Now he has two EA accounts with all the games on both!
- type0 7y ago> Now he has two EA accounts with all the games on both! oh what a great service
- ericol 7y agoThey are not alone in this practice. I still receive emails from sitepoint to my email (As recently as March 10th), and the user name finishes in _DELETED (Not kidding).