19 ms·
What about inmutable systems? My app (using scuttlebutt) creates an 'account' but it's located as crypto keys only within the app and apple keychain. So far the
by anarchogeek 5y ago
What about inmutable systems? My app (using scuttlebutt) creates an 'account' but it's located as crypto keys only within the app and apple keychain. So far the apple reviewers refused to believe that it works like. It's open source, they've got the code... but still....
Same is true for anything crypto. The account as it were exists on many devices, but it's not something you as the app creator can manage.
I think apple protecting privacy is good, but the effect on actually private systems is complicated.
- _pmf_ 5y agoCongratulations, you turned a trivial problem into an unsolvable one for no reason at all.
- vineyardmike 5y agoCan you just delete the key and local data? Is the requirement to push that deletion to all other SSB instances? Seems like a case where in 2021 this rule is good, but blocks the creation of new business/product/tools that don't confirm with the 2020 way of thinking... which is good for apple.
- arkh 5y ago> Is the requirement to push that deletion to all other SSB instances? Well if you follow the GDPR: yes. Article 17.2 > Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
- 3np 5y agoAre you certain that an app developer for a client would qualify as a Data Controller here? As long as the relevant data never passes through their or other third-party servers and it's strictly local account setup interfacing with SSB I think they are not?
- jaywalk 5y agoIf the personal data is encrypted and you destroy the only key that can be used to decrypt it, is it still personal data? Or is it now simply some random bytes?
- cygned 5y agoWe built a system that creates backups of PII using that mechanism; throw away the key after data is supposed to be deleted. That is legal under EU GDPR.
- deleted 5y ago[deleted]
- arthur_sav 5y agoWhat's funny is that all these laws and (appstore) rules are not very well thought. It comes down to the individual to interpret and enforce a solution that may or may not be in compliance. It's like doing taxes in the US. You may or may not doing it correctly and you'll only find out if they start knocking.
- mike_d 5y agoI had this exact question for our privacy legal team and the answer I got was that deleting the keys to encrypted data is legally equivalent to deleting the data itself.
- vineyardmike 5y ago> taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data. This is just not possible for a lot of data like SSB. How would you do this if someone asked github to delete all their commits across repos?
- arkh 5y agoCommits are not personal data in the GDPR sense. > For the purposes of this Regulation: > ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
- jeroenhd 5y agoThis is why using the blockchain got user data is such a stupid idea. The immutability makes it impossible to redact or remove information, even if that information is encrypted. The same is true foor P2P services where there is no central accounting system. Deleting the account shouldn't be a problem if all the "account" info is stored on the device itself, so if your reviewers aren't completely incompetent I don't see why this would be a problem.
- nightski 5y agoHate to break it to you but banks are not deleting your account immediately when you close it. They legally can't.
- datavirtue 5y agoIt's simple. Don't offer account deletion. You comply with both in that case.
- bpodgursky 5y ago> all apps that allow for account creation must also allow users to initiate deletion of their account from within the app No, that doesn't seem true.
- wizzwizz4 5y agoWhat bank lets you create an account just from the app? … Okay, the digital-only ones, maybe. But virtually all other banks I've used make you go to a branch.
- zerkten 5y agoRevolut and many other apps allow creation of accounts from the app per local regulations. It may require SSN in the US to complete sign-up, but it's all done through the app and is immediate. The account falls under all the regular retention and reporting requirements, although these companies mitigate some classes of issues with stricter limits, not paying any interest (even though that'd be miniscule), etc.
- TrueDuality 5y agoMaybe a tombstone record in your immutable system? It is technically marking the account as deleted and the data is unrecoverable if the only encryption keys have been safely purged...
- Hermel 5y agoBlockchain wallets are an interesting case. I would argue that for example an Ethereum wallet that generates an address for you in the Ethereum system is not required to provide a way to delete that account again. Similarly, the Chrome app is not required to allow you to delete your hackernews account even though you created it using the Chrome app. Generally, if an app enables you to create an account in a system controlled by someone else, the account deletion rule shouldn’t be applicable.
- dwaite 5y agoI do not believe Apple will make a distinction based on corporate structure - if you support creating an account, you need to support deleting it. If you can't support deleting it, you can't support creating it in-app. That said, I would argue that there is no Ethereum "account" - it's just a crypto key. In that sense, use on Ethereum is similar to someone using an email address to sign up for mailing lists and to post on forums. The counter-argument is that your wallet app likely provides the interfaces to do that functionality, which makes the Ethereum blockchains a proper system under consideration.
- onion2k 5y agoGenerally, if an app enables you to create an account in a system controlled by someone else, the account deletion rule shouldn’t be applicable The post you're replying to says Apple believe it should. Unless you can persuade Apple to change their policy, it won't matter if you disagree.
- sokoloff 5y agoSafari enables me to create accounts on lots of services controlled by third parties and, for some of these, Safari does not symmetrically enable me to initiate a deletion in-app. (I’ll give you that Safari isn’t in the App Store but many other browsers are. It would viewed as anti-competitive for Apple to remove all competing browsers.)
- onion2k 5y agoSafari enables me to create accounts on lots of services controlled by third parties and, for some of these, Safari does not symmetrically enable me to initiate a deletion in-app. This might be the weakest strawman argument I've ever seen. Well done.
- Zamicol 5y agoI'm working on an application where a digest replaces the data on delete. The digest is immutable, which represents the data, not the data itself.
- vmception 5y agoChange your data model. That’s the answer. Add setters to the smart contract to change variables. It’s not that hard.
- detaro 5y agoScuttlebutt isn't a blockchain and doesn't have a concept of "smart contracts"
- jedahan 5y agoDefining account will be interesting. One definition might be: The 'account' consists of the credentials required to add or modify data associated with a human. In that case, the person deleting their private key would suffice for deleting an account. There are plenty of things this doesn't cover, or even backfires. Just interested in what other perspectives people may have. --- Scuttlebutt actually could allow for 'deletion' in the sense that a 'compliant' scuttlebutt client could choose to interpret a 'delete this account' message as a filter for any messages that match said public key. Many client's UX understand that the state of messages may be incomplete due to the P2P nature, so thats kinda nice too.
- ChrisMarshallNY 5y agoI’m writing an app that has an account on a server. A user with no account can send a POST form (through the app), requesting that we create an account for them. We do so, through an admin dashboard. It’s easy to completely delete the account through the same dashboard, and I don’t think we have any legal obligations to retain the account. I’m planning to add a “delete my account” POST form, in the logged-in app. I assume this will be fine.
- cmeacham98 5y agoWhy not just automatically create/delete the account? What's the purpose of manually transcribing their information to an admin panel? Also, does this mean you have humans copying over and potentially looking at (even if only on accident) people's passwords?
- ChrisMarshallNY 5y agoIt’s an app that is aimed at a specific demographic. It’s fairly important that we do our best to avoid giving accounts to “just anybody.” If we ever get to the kind of scale that would require us to have automatic account creation, we’ll see. We certainly have the technical means to do it. Until then, we’ll have volunteer admins creating accounts. I know that most services do everything they can, to push for massive scale, but we’re different. It’s an NPO, serving a fairly small subset of the population, and we need to be careful not to sacrifice quality for scale (heresy, I know). The temp passwords are auto-generated and sent to the user, and stored in the traditional one-way hash. The dashboard can reset passwords, but we pretty much let the user do what they want, once the account is set up.
- deleted 5y ago[deleted]
- floatingatoll 5y agoYour app is incompatible with the Apple App Store. There’s a lot of arguments that people will make about whether this is justified or not, but from a plain rules standpoint, that’s not a permissible data management strategy if you want to publish an iOS app through Apple’s store.
- grishka 5y agoWhat if you're making an unofficial, unaffiliated app for someone else's service, and their API/protocol doesn't support deleting accounts?
- floatingatoll 5y agoIf your app implements account creation, then it will likely be taken down unless either your app removes create-account support or the API and your app implement delete-account support, as a user would reasonably expect that you're able to delete the accounts that you create. If you do not implement account creation, then you're unlikely to be held responsible for account deletion, as a user would reasonably understand that your app is not responsible for creation or deletion of accounts. EDIT: Elsethread, someone asked "What if I create accounts on the blockchain?", and since it's possible you'll come around to that idea next — the app would have to interact directly with the blockchain, so you'd probably get rejected for a whole array of reasons, such as but not limited to that you're storing account data on the blockchain. And I wouldn't envy you trying to explain why you shouldn't be continuously fined for GDPR violation in the EU, either.
- tazjin 5y ago> And I wouldn't envy you trying to explain why you shouldn't be continuously fined for GDPR violation in the EU, either This is kind of a bizarre thought to me. You think anyone who provides software that - without involving any services hosted by that person - should be liable for what users do with this software? If this were to hold up in court (which I'm confident it wouldn't), then open-source software would be done. Or is this a problem of terminology? In the scuttlebutt case, there is no actual "account" - just a key. Maybe one should simply replace the string "Create account" (if there is such a string) with "Generate key/identity".
- dogma1138 5y agoIt’s the same as trying adhering to RTBF/GDPR with a blockchain or any other immutable data store… Your design decisions need to match the regulatory or other commercial / situational requirements. But in your case I’m not sure what exactly is the problem other than Apple doesn’t believe you… you can still delete the account it’s just deleted locally. And you may be required to delete any server side identifiers if such exist.
- nine_k 5y agoNobody is asking you to actually delete the information. I suppose that with a proper design it should be possible to mark an account as inactive, make the associated profile data as inaccessible (if it's accessible via the web, for instance), and, most importantly, stop requiring this account when using the app. Putting PII or UGC into immutable storage is poor design, unfortunately, both users and laws want this information destroyable.
- dwaite 5y agoYou must provide a way to undo first party and third party data retention of personal data at the same level as the initial retention. If such data exists in an app under control of the user, then uninstallation is fine. If you persist that data in your own systems, you must provide a way to withdraw that consent. Same with data shared with third parties. If you create an account in first party systems, you must provide a way to delete that account. If the account is created outside the app (say via your website), thats fine, but you may get the same regulatory pressures directly (from GDPR, from California, etc) to support deletion in the same context.
- Daegalus 5y agomy guess would be to just delete all local data, instruct the user to destroy all private keys, and consider the data delete it. I think in this situation, best effort to "delete" the data is all you can do. IN this case, if all keys are deleted, the data effectively becomes meaningless bits.
- deleted 5y ago[deleted]
- KorematsuFredt 5y ago> deletion of their account from within the app. Can't the app be reset to a state as if it was just installed ?
- ixtli 5y agoI personally don’t think it’s a good idea for lay people to be using systems where they can’t delete their user data. Maybe Apples isn’t the right platform for such things.
- deleted 5y ago[deleted]
- krageon 5y agoFor "actually private" systems like this the solution should be cryptoshredding. If this is not possible (f.e. because you believe information published once should be available forever), then the app is bad and should not exist. People have a right to be forgotten.
- Fire-Dragon-DoL 5y agoWell, from your perspective, wouldn't mean you just need to discard such keys for making the account unrecoverable from your perspective?