Hacker News Reader

Comment by jedahan | Hacker News Reader

Defining account will be interesting. One definition might be:

The 'account' consists of the credentials required to add or modify data associated with a human.

In that case, the person deleting their private key would suffice for deleting an account.

There are plenty of things this doesn't cover, or even backfires. Just interested in what other perspectives people may have.

---

Scuttlebutt actually could allow for 'deletion' in the sense that a 'compliant' scuttlebutt client could choose to interpret a 'delete this account' message as a filter for any messages that match said public key. Many client's UX understand that the state of messages may be incomplete due to the P2P nature, so thats kinda nice too.

View on HN

I’m writing an app that has an account on a server. A user with no account can send a POST form (through the app), requesting that we create an account for them. We do so, through an admin dashboard. It’s easy to completely delete the account through the same dashboard, and I don’t think we have any legal obligations to retain the account.

I’m planning to add a “delete my account” POST form, in the logged-in app.

I assume this will be fine.

Why not just automatically create/delete the account? What's the purpose of manually transcribing their information to an admin panel? Also, does this mean you have humans copying over and potentially looking at (even if only on accident) people's passwords?

It’s an app that is aimed at a specific demographic. It’s fairly important that we do our best to avoid giving accounts to “just anybody.”

If we ever get to the kind of scale that would require us to have automatic account creation, we’ll see. We certainly have the technical means to do it. Until then, we’ll have volunteer admins creating accounts.

I know that most services do everything they can, to push for massive scale, but we’re different. It’s an NPO, serving a fairly small subset of the population, and we need to be careful not to sacrifice quality for scale (heresy, I know).

The temp passwords are auto-generated and sent to the user, and stored in the traditional one-way hash. The dashboard can reset passwords, but we pretty much let the user do what they want, once the account is set up.

An account is quite literally an account of all the data added by a user.

Reply on news.ycombinator.com