News for hackers. Stuff that matters.
Re:Yahoo Triples Estimate of Breached Accounts to 3B by rightos on Tuesday October 03, 2017 @07:46PM (#15397194)
Sure, but you don't need first name, last name, phone number, birth date or gender. All of which are asked on the signup and of which only Gender is specified as optional: https://login.yahoo.com/account/create

On my small business we ask only for an email address, password and confirm password. Everything else is excessive.

Tax obligations can be another problem which may require an address, but often have a simpler way to resolve them by simply picking the appropriate country and state off a list or even with just a checkbox for "are you in X jurisdiction which I am required to tax?". I believe Tarsnap handles it that way.

Re:Yahoo Triples Estimate of Breached Accounts to 3B by cperciva on Wednesday October 04, 2017 @12:34AM (#15398281)
Tax obligations can be another problem which may require an address, but often have a simpler way to resolve them by simply picking the appropriate country and state off a list or even with just a checkbox for "are you in X jurisdiction which I am required to tax?". I believe Tarsnap handles it that way.

Tarsnap has a "are you Canadian" checkbox. Unfortunately if you are Canadian I have to collect your name and address because I have to provide[0] invoices/receipts which contain this information.

Mind you, there's no requirement that you give me truthful information. If you claim to be John Smith living at 123 Main Street, you'll get an invoice which says that at the top of it. You won't be able to use it to claim a tax rebate; but if you're not running a business it's not useful for that purpose anyway.

[0] IIRC I technically don't have to provide those such invoices to everybody; merely to anyone who asks for one. But collecting the information up front and emailing PDFs to all the Canadians is much easier than handling individual requests later.

Re:Yahoo Triples Estimate of Breached Accounts to 3B by cbr on Tuesday October 03, 2017 @09:29PM (#15397640)
You need to collect date of birth for COPPA compliance
Re:Yahoo Triples Estimate of Breached Accounts to 3B by IncRnd on Wednesday October 04, 2017 @12:30AM (#15398260)
Where in COPPA does it say the DOB needs to be collected? I don't think that statement is true as you word it.
Re:Yahoo Triples Estimate of Breached Accounts to 3B by ben_w on Wednesday October 04, 2017 @03:05AM (#15398768)
My memory of implementing COPPA compliance a decade ago was that DOB was an implicit requirement, the explicit requirement being “confirm they’re over 13; a checkbox isn’t good enough because they’ll clearly just lie.” (paraphrased, not quoted).
Re:Yahoo Triples Estimate of Breached Accounts to 3B by IncRnd on Wednesday October 04, 2017 @03:40AM (#15398882)
Thank you for explaining that for me.

That's what I had thought. However, users will lie about a DOB if they will lie about an age.

Re:Yahoo Triples Estimate of Breached Accounts to 3B by bmm6o on Wednesday October 04, 2017 @07:48PM (#15405781)
Does that mean you have to retain it beyond the initial check?
Re:Yahoo Triples Estimate of Breached Accounts to 3B by ben_w on Monday October 09, 2017 @03:31AM (#15432095)
No idea. UK games company, so UK data protection act also applied, which I think actually forbids retaining any more than strictly necessary.
Re:Yahoo Triples Estimate of Breached Accounts to 3B by noway421 on Tuesday October 03, 2017 @07:53PM (#15397237)
First and last name at least needed for meet the email protocol. Emails shouldn't be addressed to handles/nicknames
Re:Yahoo Triples Estimate of Breached Accounts to 3B by rightos on Tuesday October 03, 2017 @07:58PM (#15397270)
"username <[email protected]>" is perfectly valid in SMTP last I checked.

If it's a user experience thing, fine, but at least make it an optional field.

Re:Yahoo Triples Estimate of Breached Accounts to 3B by BearGoesChirp on Wednesday October 04, 2017 @01:30PM (#15402243)
How would you handle all the people with identical names? Even if you used DoB, there is a chance for a duplicate.
Re:Yahoo Triples Estimate of Breached Accounts to 3B by stevekemp on Wednesday October 04, 2017 @06:54AM (#15399545)
The irony of that comment being made from an account with a username that doesn't clearly identify a person..
Re:Yahoo Triples Estimate of Breached Accounts to 3B by zentiggr on Wednesday October 04, 2017 @09:06AM (#15400159)
Deliberate sarcasm?