[Request] Allow account deletion

[MoritzMaxeiner]

I've looked over the matrix spec and unfortunately /account/deactivate only requires for any future login to become impossible. Synapse fulfils the spec, but does not actually delete the account, which
a) leaves the user's data on the server after the user has expressed the intention to never use this account again
b) leaves the user id taken (i.e. future registration attempts on it fail with "M_USER_IN_USE")

Either /account/deactivate should completely wipe any data belonging to that account from the homeserver, or there should be a second endpoint /account/delete that does this.

Keeping account data from people who specifically want to cease using one's service seems shady at best in terms of privacy policy and technically impractical at worst, since it accumulates data that
a) isn't required for the continued function of the service
b) takes up increasing storage space for no apparent benefit to the service

[rubo77]

If a very active user would be deleted this way you suggest, that would destroy conversations completely.

imagine this user chatted a lot with others in hundreds of rooms, others took a lot of effort to answer questions of this user,....

all those work of others would be in vain. that wouldn't be fair.

Also this would violate the Idea of the Matrix: What is said can't be unsaid.

An exception would be rooms, where everyone agrees, that they are moderated and messages are not persistent all the time.

The only possibility I can imagine to free a username for a new registration would be to remap the old posts to a new user with the same name, so the messages are unlocked from the user, that wants to be deleted.

Only a user that has never said anything could be deleted completely!

[MoritzMaxeiner]

If a very active user would be deleted this way you suggest, that would destroy conversations completely.

AFAICT it would only destroy the history of that conversation, i.e. a new client from a recipient on the same homeserver cannot sync it anymore.

imagine this user chatted a lot with others in hundreds of rooms, others took a lot of effort to answer questions of this user,....

Then the history of that conversation is gone from the user's homeserver just as his choice implied.

all those work of others would be in vain. that wouldn't be fair.

Fair to whom? It certainly is not fair to the user clearly stating that he/she wishes not to use a server anymore to keep the data the user owns around. In countries with strict privacy laws and with a history of many privacy related court cases being decided in the user's favour operating a server of this nature is grey at best in terms of legal safety, derelict at worst.

Also this would violate the Idea of the Matrix: What is said can't be unsaid.

Where did you get this idea from? It certainly is not expressed in the FAQ[1] and the spec only implies it by being vague about what /account/deactivate/ means. If this is the mission statement of Matrix, then this not being visibly stated would be another issue altogether, to be discussed separately.

[1] http://matrix.org/docs/guides/faq.html

An exception would be rooms, where everyone agrees, that they are moderated and messages are not persistent all the time.

If a user wants to cease using a service, it has to be possible for his/her usage data to be deleted by him/her.

The only possibility I can imagine to free a username for a new registration would be to remap the old posts to a new user with the same name, so the messages are unlocked from the user, that wants to be deleted.

Or just do the thing the user explicitly asked you to: Delete those posts.

Only a user that has never said anything could be deleted completely!

Only from other homeservers', since AFAICT homeserver A cannot tell another homeserver B that user C has unregistered from A and events by him/her should also be deleted from B.
That's the only exception I'd consider.

[rubo77]

You can redact all your messages already one by one before you delete your account.

Those redactions are already federated to other servers, so you can write a script that does this for you already..

But you can never be sure, that other servers obey to the redact command though.

[MoritzMaxeiner]

You can redact all your messages already one by one before you delete your account.
Also this would violate the Idea of the Matrix: What is said can't be unsaid.

These two seem to contradict each other. Either what is said can't be unsaid, or you can delete your messages. Regardless, there is currently no way to delete your account, only to deactivate it.

Those redactions are already federated to other servers, so you can write a script that does this for you already..

Good to know, as the Client-Server spec does not fully specify how redacted events are propagated. But this does not deal with account deletion.

But you can never be sure, that other servers obey to the redact command though.

Of course, you can never be certain a blackbox third party claiming to implement a spec actually fully comply with it. But this is a red herring, diverting from the issue of a user not being able to delete his or her account in this implementation.

[KopfKrieg]

@rubo77 In some countries law demands that you're able to completely remove your account.

Besides that, if I want to stop using a service, I always make sure that all of my data will be removed. Here, this is not possbile. I think this is a major flaw in the design specification.

[ara4n]

This is like requesting that you can delete your email account and somehow magically delete every email you ever sent at the same time. It's a reasonable request for a centralised service like facebook, but Matrix is not centralised. Instead, the best we can offer for now is deactivating accounts, and in future purging history from your local homeserver but this really doesn't achieve much.

[MoritzMaxeiner]

@ara4n No, this is like requesting that you can delete your email account and all the data pertaining to that account from the service provider's servers.

[ara4n]

@Calrama except that concept does not exist on Matrix, because the concept of "all the data pertaining to that account on your service provider" is not well-defined, given the whole point of Matrix is that your messages are replicated equally over all participating servers. It's not like deleting your IMAP spool from a service provider, it would be like deleting some combination of global IMAP+SMTP history both for you & everyone you've ever spoken to.

Here are the possible "solutions" here:

1. Let people irreversibly deactivate their account; removing their credentials to ever use it again. This is what we provide today.

2. Let people delete the existence of their user account off the account/profile tables on their local server (ignoring history). This opens up the risk that someone might register the same ID in future, allowing potential spoofing attacks and might even pave the way to security vulnerabilities where they could try to synchronise in old history for the old user. Fixing this would mean switching to using a different internal format for Matrix IDs (e.g. public key fingerprints), which is a possibility in the medium-long term but for now option 1 provides most of the same benefits.

3. Let people delete "their history" from their local server as well as their account details. In theory one could go and delete every message on the local server that the user ever sent; but any conversations which spanned other servers would be preserved on the remote servers... and the conversation would be eventually resynchronised from the other servers. So it would achieve nothing, other than a) breaking conversation history for everyone you spoke to in local-only rooms, inexplicably penalising them b) waste traffic for everyone else.

4. Let people send message redactions for every single message they ever sent. These are advisory deletions which let users request other servers delete particularly sensitive content, intended for accidentally posted passwords and photos etc. Doing this in bulk however would be incredibly obnoxious - it's the equivalent of issuing a 'email recall' for every email you ever sent. It would destroy the history of every conversation you ever had with anyone, rendering the shared view of those conversations useless. We take the view that if you talk to someone on Matrix, then the other people in your room equally own the copy of your data. Just as if I send an email to someone, the recipient has equal rights to store a copy of that email as the sender does. Finally, redactions are advisory - there is no way to enforce that servers uphold them, and so are not useful for robustly enforcing data ownership policies. Also, you may not even be a member of the room that you want to redact your messages from any more, making the hypothetical feature even less useful. We have no plans to support mass-redaction.

5. We could conceivably implement a 'bulk redact' feature which is a single message that tells servers to destroy all data that they ever saw from a given account. This suffers the same social side-effects as option 4, and could also be an incredibly dangerous feature - imagine if it was trivial for an attacker to temporarily get access to your account and then irreversibly attempt to annihilate everything that account ever emitted into Matrix.

So, this is why right now the only option supported is number 1, and possibly in future number 2. Hopefully this also explains more clearly why options 3, 4 and 5 would cause more harm than they solve.

In the end, if you want to communicate using a system which lets you destroy all every message you've ever sent, or doesn't keep that history in the first place, I'd suggest using something other than Matrix.

6. Final thought: one other solution here might be to support time-based retention schemes per rooms - i.e. configure a room to request all servers to delete content older than N days, or even after it's been read by all participants in the room. This would be advisory, but it's a feature many enterprise contexts ask for. Privacy-focused users could then choose to configure their clients to only support communication in participate in such rooms, and thus be sure that their history will magically disappear over time - and critically the people they're talking to will know and expect those semantics to occur. Perhaps this might be a sufficient solution to the folks participating in this bug?

[KopfKrieg]

This is like requesting that you can delete your email account and somehow magically delete every email you ever sent at the same time.

No. The only thing I request is that I can delete my account (e.g.: Make a login with my credentials impossible). Nowhere I wrote that I want to magically delete every message ever written by me.

This is pretty much number 1 of the solutions you posted:

Let people irreversibly deactivate their account; removing their credentials to ever use it again. This is what we provide today.

I don't know what else in stored in a user account besides username and password, but if this could be enhanced to delete all the other stored data too (e.g. linked phone number, mail addresses, in short: every personal information) it would be nearly perfect for me.

[MoritzMaxeiner]

@ara4n Thanks for explaining your position in depth, this makes it easier to refer people to.

except that concept does not exist on Matrix, because the concept of "all the data pertaining to that account on your service provider" is not well-defined, given the whole point of Matrix is that your messages are replicated equally over all participating servers.

I am aware of that, but that does not change what is required in terms of privacy laws.

In the end, if you want to communicate using a system which lets you destroy all every message you've ever sent, or doesn't keep that history in the first place, I'd suggest using something other than Matrix.

I am using something different, but not for that reason. The reason is privacy laws, as I indicated earlier.

[KopfKrieg]

@ara4n I forgot to ask, but:

Let people irreversibly deactivate their account; removing their credentials to ever use it again. This is what we provide today.

Is this only possible via the api or is this already possible via the webinterface or apps like riot? I found nowhere the option to do this.

[ara4n]

@KopfKrieg it depends on the client. on Riot/Web it's the big red 'deactivate my account' button at the very bottom of the User Settings screen:

[KopfKrieg]

Ah, perfect, thanks.

[ara4n]

except that concept does not exist on Matrix, because the concept of "all the data pertaining to that account on your service provider" is not well-defined, given the whole point of Matrix is that your messages are replicated equally over all participating servers.

I am aware of that, but that does not change what is required in terms of privacy laws.

@calrama IANAL, but as I understand it: typical data protection law requires a service provider to delete personal user data if requested by that user (and to not hold it beyond a given time threshold). In practice, we do not consider messages that a user has sent to other users as being personal user data - just as an email service provider would not consider emails sent to another user to be the exclusive personal property of the sender. Instead, these messages are the shared property of those with whom they have been shared.

I completely agree that actual personal data (as per @KopfKrieg's example) should be deletable - and we do as much of this as we can currently in solution 1, with solution 2 filling in the remaining gaps in future.

I might be able to help better on this if you explained whether any of my proposed solutions would be satisfactory for your requirements - i.e. are you petitioning for solution 2? or 5? or 6?

[MoritzMaxeiner]

@ara4n Messages a user has sent to other users may still be considered personal data with regards to you as a service provider (regardless of what the recipients do with their copy); as is the user's account name. I was petioning for exactly what I wrote in the opening post: All (personal) data pertaining to that user on that specific homeserver to be deleted (permanently); that includes the account name and all messages sent (on that specific homeserver).

With regards to your proposed solutions, AFAICT:
Solution 1 keeps the account name and history around (-> no)
Solution 2 keeps the history around (-> no)
Solution 3-5 are all implementation detail with regards to the goal of the homeserver the user deleted the account on not keeping the history around, so I cannot comment on which one to pick
Solution 6 keeps the account name and potentionally some history around (-> no)

As long as it is not possible for users to completely wipe a homeserver of all data that a German court may decide can be considered personal (data), I cannot deploy one.
If you think - and from your explanations I think that to be probable - that that is not a goal for Matrix/Synapse, then you can simply close this as Invalid.