4 ms·
> Side note for Bumble — this is what we would call an “entity resolution” problem, leading to safety problems for your platform. When someone installs your app
by yreg 4y ago
> Side note for Bumble — this is what we would call an “entity resolution” problem, leading to safety problems for your platform. When someone installs your app, you need to detect whether they have already installed it previously. If they have, then their activity (including blocks and people who have already declined them) should be linked to this new account.
What is Bumble supposed to do if the user asks them to delete all the data that is connected to them? Can Bumble keep a hash of the name/phone and store it with a list of users who have blocked the user which is being erased?
- naturalauction 4y agoOne approach on iOS is to store unique identifier in the “Keychain” (or iCloud itself) which is data kept in the cloud tied to a user’s Apple ID account. Of course this is only an impediment to a determined stalker (who could create a new Apple ID). But a determined stalker could also use a fake name and get a new phone number. See https://stackoverflow.com/questions/25276393/how-to-ban-an-ios-user https://stackoverflow.com/questions/25276393/how-to-ban-an-i... for more details.
- yreg 4y agoHaha, the funny thing is that the service isn’t even storing that piece of data – the user is! So GDPR, etc. should be covered. Although, if the user finds out about the mechanism they can just delete the entry from their keychain.
- newZWhoDis 4y agoThat keychain is different from the publicly viewable one in settings
- yreg 4y agoIf that's true (and only the app who stored the item can retrieve it) I wonder who is responsible for GDPR regarding its storage. Is the app responsible? But it cannot even access the data after it is deleted. Apple? They have no idea what the data is. User? They don't even know about the data and cannot access it either. No one?
- yreg 4y agoI think you are incorrect. I've looked into my Keychain Access > iCloud on Mac and found some entries that seemlike they were created with the APIs you suggest. E.g. WizzAir has three entries: `WizzAirLogin.username`, `WizzAirLogin.password` an `WizzAirLogin.firstName`. Or Spotify stored `com.spotify.login.credentials`, `com.spotify.connect.lastStoredDataKey` and `com.spotify.connect.iplSessionHistoryDataKey`.
- gruez 4y ago>One approach on iOS is to store unique identifier in the “Keychain” (or iCloud itself) which is data kept in the cloud tied to a user’s Apple ID account Wouldn't it be obviously visible because you can see the app/file on icloud? Also, I'm pretty sure the keychain idea is banned by app store guidelines.
- mns 4y agoReplying just because we had a basic GDPR training just yesterday. You can't do that and you are right about the deletion of data to a point, but once there are legal reasons (like in this case) you don't have to comply to the request to delete the data. But I would guess it would be too complicated to manage all this, considering the size of Bumble and where the incident happened and where Bumble is located.
- Major_Grooves 4y agoexactly - under GDPR it would be fine to retain specific data for a limited period of time to prevent fraud (which is what this is, really). Also, this type of user is not making deletion requests - they are deleting and then immediately reinstalling the app to appear "fresh".
- mns 4y ago> What is Bumble supposed to do if the user asks them to delete all the data that is connected to them? I was talking about this part raised above.
- yreg 4y agoWhat is the legal reason in this case? Ban evasion on a social media app doesn't sound illegal.