News for hackers. Stuff that matters.
Re:Best practices for user account, authorization and passwo... by privacypoller on Saturday February 03, 2018 @07:45PM (#16300581)
>> 8. Let your users delete their accounts

Man, if I was drinking milk I would have shot it out my nose at that one. Google and every single social network are the last actors who make it easy (or even let you for-realize-ies) delete your association. They may let you remove access to the persona they store and monetize, but they certainly don't let you "easily delete your account". THis entire post is a giant crock.

Re:Best practices for user account, authorization and passwo... by kj65557 on Saturday February 03, 2018 @08:24PM (#16300714)
(also work for google)

It is pretty easy to delete your account on many social networks. The following support deletion:

* Google (all account data)

* Facebook (all account data except messages that others have received)

* Reddit

* Instagram

* Snapchat (requires you to "deactivate" for 30 days)

One thing that is confusing is that many websites also have a "deactivate" feature. Some users may confuse the two and mistakenly think "deactivation" is the same as "deletion".

Re:Best practices for user account, authorization and passwo... by balladeer on Sunday February 04, 2018 @01:05PM (#16303898)
I have deleted all my photos on Facebook. Some of the "featured" photos I've deleted dozens of times (I've deleted twice just now leaving this comment midway) and Facebook still shows those featured photos in my profile when I log-in. Yes, it doesn't show anything to the public or my friends but I still can't get rid of those photos on Facebook. I tried to contact Fb couple of times but of course I didn't receive any response.

So no, I really don't think I should trust Fb with my account deletion. Besides for a long time that's just deactivation. A friend deactivated his account and after few months he received an email that in case he had changed his mind he should click this link and then they should go ahead with reactivation process. Well, that link was reactivation.

As for Google, here's an example - I get a brand new YouTube account when I visit YouTube and just play a video if I am logged in to my Gmail a/c in that browser session. The last time I tested it (before deciding to not ever logging into Fb, Tw, Google etc in the my main browser where I do my most of, and personal, browsing) it would create a YouTube account. No, not a single message, or pop up or anything. Just an automatic YouTube account. I must have deleted my YouTube account (or accounts) some 15 times by now.

I've never used Instagram, or Snapchat. Yes, Reddit's account deletion is actually straightforward (unless they too keep it hidden from user and don't delete it).

Re:Best practices for user account, authorization and passwo... by bzbarsky on Sunday February 04, 2018 @01:05AM (#16301592)
If you delete your account on Facebook, I would think that it doesn't delete various information it stores about your social graph and various metainformation about you. And I would think that because it maintains that information for you even if you don't have an account. See https://www.dailydot.com/news/facebook-shadow-profiles-priva... for a brief rundown. I have yet to see any proof, or indeed any claims, to the contrary by Facebook.

Similarly, you can delete your emails from Gmail and your calendar data from Google calendar, but you cannot delete the metainformation consisting of their tracking data and so forth.

Which is what privacypoller was saying: you can remove _your_ access to some of this stuff, but you can't remove all the information they are collecting about you.

Re:Best practices for user account, authorization and passwo... by jwilk on Sunday February 04, 2018 @06:11AM (#16302323)
Note that deleting your Reddit account doesn't delete your comments.

You can delete your comments manually (but of course only before deleting the account).

Re:Best practices for user account, authorization and passwo... by kyrra on Saturday February 03, 2018 @08:14PM (#16300677)
(I work for Google, opinions are my own)

https://support.google.com/accounts/answer/32046?hl=en

Google does let you delete your account. But it can take a few weeks for all the data to be really deleted (there is a recovery period, then some lag to delete everything).

Re:Best practices for user account, authorization and passwo... by TheAceOfHearts on Saturday February 03, 2018 @08:19PM (#16300692)
Doesn't Google have tons of old backups in cold storage? Are those old database records also cleaned up?
Re:Best practices for user account, authorization and passwo... by kyrra on Saturday February 03, 2018 @09:39PM (#16300975)
I can't say what or whatnot Google does. Ask customer support on that.

But do know that GDPR will require this for the EU. https://gdpr-info.eu/art-17-gdpr/

Re:Best practices for user account, authorization and passwo... by aiiane on Saturday February 03, 2018 @11:15PM (#16301300)
It takes longer for data to get purged out of backups than it does for the live data stores, but Google does clean up backups for deleted account data.
Re:Best practices for user account, authorization and passwo... by jasonkostempski on Saturday February 03, 2018 @08:48PM (#16300800)
I hope someone at HN is listening to that recommendation.