Skip to content

Comment on Security Checklistparent

Comments

They seem to be saying you should have no online process to deal with lost passwords, forgotten userids, etc.

Which is, of course, not practical in most situations.

I thought this at first, too, but giving the author the benefit of the doubt, perhaps they meant that if someone deletes their account, you should actually delete their account, not just disable it.

I haven't seen anyone do this, but as a user, I would prefer an option for my account information to be emailed to me in a relatively readable format, so that I can keep my data / re-upload it if I ever want to undelete my account.

Sounds like a great idea, but I wouldn't word that as "Do you have an account recovery flow? Delete it immediately."

Account recovery is shorthand for forgotton passwords and userids everywhere I look.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.