7 ms·

I want to know if the photos are securely deleted. It's not enough that the mere reference to a file is gone. I want everything overwritten with zeroes, and the

I want to know if the photos are securely deleted. It's not enough that the mere reference to a file is gone. I want everything overwritten with zeroes, and the photo made properly irrecoverable.

m4tthumphrey 6y ago
Is this something you would actually expect from a media sharing/storage site?
- ben509 6y ago
  Not wanting data shared seems to contradict the mission of a site that shares data.
  - jermier 6y ago
    So what if someone sleuths around in the e-waste dept. of Instagram and steals a few hard-drives with literally Terabytes of potentially very sensitive data? That's why I would hope Instagram are encrypting data at rest with something like LUKS.
- murftown 6y ago
  Yes.
deleted 6y ago
[deleted]
rco8786 6y ago
They are definitely not. I’m honestly surprised at how many folks here on HN (a presumably tech savvy crowd) think that Instagram (or any tech co) is “writing zeros” when a user hits a delete button.
- jacquesm 6y ago
  Because they should. Incidentally, you are not doing Square any favors with these comments.
  - rco8786 6y ago
    I guess? I'm trying to inform folks about data deletion works. And I'm surprised more people here are unaware of how data is stored at large (and small) tech co's.
    - jacquesm 6y ago
      You must be aware that Square is operating a service in a regulated field (fintech) and that openly advertising their possibly illegal business practices is not to their advantage. Let's assume that everything you've said is true that could come in handy one day when a regulator is looking to determine the difference between whether this is an oversight or willful. You are making their job a lot easier and Square's situation a lot more difficult. For your sake I hope that Square plays it as much as they can by the book, and that if they don't that this will cause them to wake up to the fact that all it takes is one employee blabbing online to get them into seriously hot water. People here are on average quite aware of how data is stored, but they are not always empowered to make the call on how it should be stored. As long as that happens behind the curtain it is a problem, but not a huge problem for any particular company. You have just raised Square's profile in many ways at once, not in the least by alerting the hacker community to the fact that Square has a lot more data than they should and that their security measures are not exactly top notch. The consequences could be substantial especially when that deleted data turns up in a dataleak. When you represent your employer online be careful about what you say and write.
      - rco8786 6y ago
        I assure you nothing Square is doing is illegal or even "possibly illegal". Square takes GDPR deletion and right to be forgotten incredibly seriously. But you must understand that soft-deleting an image that the user uploaded is not in violation of any regulation in place in the USA.
smcameron 6y ago
Always encrypt the data at rest, and delete by deleting the key is likely how this would be done. This way you can also delete e.g. tape backups without actually loading the tape and re-writing the whole thing with certain portions deleted, which is not really practical.
- jacquesm 6y ago
  Yes, this is the best way to do it.
- jermier 6y ago
  Yes, and you could also queue files for deletion at a later stage by throwing away the encryption key for a large batch of files which have been queued for deletion.
ben509 6y ago
If you want security guarantees, find a service that makes them. Expect to pay more for the additional work it takes to deliver them.

I want to know if the photos are securely deleted. It's not enough that the mere reference to a file is gone. I want everything overwritten with zeroes, and the photo made properly irrecoverable.

m4tthumphrey 6y ago

Is this something you would actually expect from a media sharing/storage site?

ben509 6y ago
Not wanting data shared seems to contradict the mission of a site that shares data.
- jermier 6y ago
  So what if someone sleuths around in the e-waste dept. of Instagram and steals a few hard-drives with literally Terabytes of potentially very sensitive data? That's why I would hope Instagram are encrypting data at rest with something like LUKS.
murftown 6y ago
Yes.

deleted 6y ago

[deleted]

rco8786 6y ago

They are definitely not. I’m honestly surprised at how many folks here on HN (a presumably tech savvy crowd) think that Instagram (or any tech co) is “writing zeros” when a user hits a delete button.

jacquesm 6y ago
Because they should. Incidentally, you are not doing Square any favors with these comments.
- rco8786 6y ago
  I guess? I'm trying to inform folks about data deletion works. And I'm surprised more people here are unaware of how data is stored at large (and small) tech co's.
  - jacquesm 6y ago
    You must be aware that Square is operating a service in a regulated field (fintech) and that openly advertising their possibly illegal business practices is not to their advantage. Let's assume that everything you've said is true that could come in handy one day when a regulator is looking to determine the difference between whether this is an oversight or willful. You are making their job a lot easier and Square's situation a lot more difficult. For your sake I hope that Square plays it as much as they can by the book, and that if they don't that this will cause them to wake up to the fact that all it takes is one employee blabbing online to get them into seriously hot water. People here are on average quite aware of how data is stored, but they are not always empowered to make the call on how it should be stored. As long as that happens behind the curtain it is a problem, but not a huge problem for any particular company. You have just raised Square's profile in many ways at once, not in the least by alerting the hacker community to the fact that Square has a lot more data than they should and that their security measures are not exactly top notch. The consequences could be substantial especially when that deleted data turns up in a dataleak. When you represent your employer online be careful about what you say and write.
    - rco8786 6y ago
      I assure you nothing Square is doing is illegal or even "possibly illegal". Square takes GDPR deletion and right to be forgotten incredibly seriously. But you must understand that soft-deleting an image that the user uploaded is not in violation of any regulation in place in the USA.

smcameron 6y ago

Always encrypt the data at rest, and delete by deleting the key is likely how this would be done. This way you can also delete e.g. tape backups without actually loading the tape and re-writing the whole thing with certain portions deleted, which is not really practical.

jacquesm 6y ago
Yes, this is the best way to do it.
jermier 6y ago
Yes, and you could also queue files for deletion at a later stage by throwing away the encryption key for a large batch of files which have been queued for deletion.

ben509 6y ago

If you want security guarantees, find a service that makes them. Expect to pay more for the additional work it takes to deliver them.