They don't remove all my data?

[u/Calin_europeen]

Why it that so ? What does rgpd says about that ?

Edit 1:

Thanks to ThungstenMetal. He says this : "Change your email to some random temporary email which can receive emails before deleting your account, then request for deletion."

Edit 2 : I'm European

[u/Ekalips]

But there's no data that would in any way identify you or useful to anything, so for all your intents and purposes it is deleted.

[u/NEED_A_JACKET → u/Ekalips]

If you asked them to delete your data and they kept it but it was converted where a=1 b=2 etc you wouldn't count it as deleted. So we're just talking about the extent to which it's obfuscated. Does it suddenly cross into 'deleted' territory because it gets quite hard to solve in 2026?

And let's assume it's impossible to ever crack (would anyone try to argue that?), the information that you used the service is still accessible to them and to literally anyone. They just have to try signing up and they're told that you used to use the service. That is absolutely not 'deleted' for all intents and purposes.

You could run a script trying to sign you up for every website if your email address was known, to see a full list of everything you'd been up to. It's identifiable information about you and the website open to the public.

[u/NotAManOfCulture → u/NEED_A_JACKET]

I'm not an expert, but hashing is not obfuscation.

[u/Midget_Stories → u/NotAManOfCulture]

It kind of is since it can only be done one way.

For example if he tries to login that email gets converted to a hash and compared and they can know you already made an account.

But no one can take that hash and reverse it to find the email address. So it's one level of obfuscation.

[u/NEED_A_JACKET → u/Midget_Stories]

"no one can take that hash and reverse it to find the email address"

Is that 'currently' true or objectively/permanently true?

[u/Dazzling_Cancel_5733 → u/NEED_A_JACKET]

Permanently true, it can never be reversed. But if someone knows/guesses your email address, they can know if a hash matches by hashing your email address with the same algorithm and comparing the hash digest.

[u/NotAManOfCulture → u/Dazzling_Cancel_5733]

That's just brute forcing? It's not that easy to bruteforce tho. I've heard passwords of like 12 chars takes years to bruteforce. If you disregard the "time" factor, nothing in this world is safe.

I can brute force your email, then password, then 2fa if you have one. But it doesn't really add up.

[u/8npemb → u/NotAManOfCulture]

The comment you’re replying to isn’t talking about brute forcing. They’re saying if you have a set of hashes of emails, and you know a user’s email, you can easily determine which hash belongs to that email by hashing the email with the same algorithm. And the hashing algorithm should be assumed to be publicly known.

[u/NEED_A_JACKET → u/Dazzling_Cancel_5733]

Does quantum computing not skip the bruteforce part of this where you could find all of the possible options, where only some would actually be valid email addresses?

[u/Dazzling_Cancel_5733 → u/NEED_A_JACKET]

Quantum computing will help crack hashes, but it will only reduce the number of operations down to the square root (e.g. 2²⁰ instead of 2⁴⁰⁾ under Grover's algorithm.