Hacker News Reader

Comment by epicide | Hacker News Reader

They mention they use the seven day period "to verify that the request was made by you". I am very curious as to what that includes.

View on HN

If it’s the same they do in the EU: 2FA, notification by email, 7 day cooloff period and download link via mail.

Probably. The particular wording makes it sound like there might be more to the 7 day thing than just a cooloff period. Not sure what that would even be, really.

The way my supermarket did it is mail an archive by email and the decryption key as signature required in snail mail to my stored physical address.

Wait .. your supermarket did that? That’s .. pretty impressive, but now I want to know what exactly your supermarket had on you (assuming you had some sort of loyalty card they tracked you with).

Purchase history for two years and classification of what I buy. Yes, loyalty scheme.

Anything other than that? Sounds super interesting, glad to see a place get it right :).

That's really cool honestly. Which supermarket was this?

BILLA in Austria, part of REWE.

My bank hasn’t heard of encryption and thinks security questions + SMS 2FA are cutting edge. What the hell supermarket is this?

Closest thing is UPS mailing me a PIN to authenticate the address for the My Choice portal.

Fourth-ing the other commentors; what supermarket is this and are they interested in expanding into personal banking?

BILLA Austria, part of REWE.

What did you buy?

7 days to make sure that this isn't part of the Import flow of a competing app :D

If nothing else, that’s plenty of time for the real user to see the email notification and complain.

Sure but if a malicious user is going to request access to someone's iCloud, they can probably also access their emails and delete this one.

Reminds me of how when I sign into my Gmail from another computer, it sends me an email saying "alert! someone signed in from this computer!" which I could immediately delete if I was a hacker. Seems useless to me.

Many (I'd guess most, but I have nothing but anecdotal experience to base it on) people have a non-Apple-hosted email account tied to their Apple ID. Sure, in some cases if someone's iCloud account is compromised, their non-Apple email account is compromised, too, but in plenty they aren't.

Useless in most cases but at one point I did have emails set to come up on my iPhone's lock screen and such an email would have popped up immediately.

That's why you setup and alternate email in your google account. It also sends the same alert to your alternate.

On top of what was already mentioned, this could also help with unexpected vulnerabilities. Like say a vulnerability is discovered where you can request someone else’s data - as long as they notice the vulnerability within 7 days, they can shut things down before there’s a data breach.

Reply on news.ycombinator.com