It's just super interesting that the granular record is persistent and can be replayed years later. Pretty non-obvious to me, and something I usually pay attention to!

The event log of key strokes is the source of truth for the entire document editing system, I can't think of a reason why one can't rewrite history after a certain time, except to say that this requirement will probably impact a lot of sub-systems from storage to UI, that now have to keep working under historical revisionism. I certainly haven't bothered doing that.

It's probably one of those situations where you'd write a "Diversion Report" for the security team where you talk about limited assets at rist and a huge investment in engineering resources.

In the PDF editor I use there’s an option called “Flatten”.

Storing the change vector is essential for collaborative editing in the moment. But the UI should highlight a Flatten feature as part of explicit Saving or Sharing actions.

You definitely don't need that level of granular detail from 10 years ago. There is no use-case for reproducing every keystroke. Major edits would be fine after literally only after a major save, or a day has passed.

FYI - this is a kind of 'biometric' leakage eh.

Your typing style is probably as unique as your finger print.

It's not shockingly bad, but probably something, under thoughtful review, they should take care of.

Edit: by 'no use case' I mean, no use case for long term history. Obviously there's a good use case for 'very short term' individual keystrokes.

Also Edit: the answer to this issue is not 'Don't worry about it, it's a low risk problem'. This is the 'slow boil' SV way of thinking that is seemingly benign, but not acceptable in the long run. The answer is: don't store personal data that is unnecessary. It's that simple. It doesn't diminish the product a single bit.

Considering Google doesn't really support anonymous accounts very well, and anyway only the owner and at most collaborators can see version history, the idea that there's a practical attack here seems pretty far-fetched.

I don't think that's the right way to look at it. If there is no reason to store specific information - then don't.

This is the stance that GDPR takes.