diff --git a/3.0-RELEASE-NOTES.md b/3.0-RELEASE-NOTES.md
index 7c287c3e..b9aa90a4 100644
--- a/3.0-RELEASE-NOTES.md
+++ b/3.0-RELEASE-NOTES.md
@@ -73,3 +73,29 @@ PersistedModel.handleChangeError. This method can be customized on a per-model b
 provide different error handling.
 
 Please see [related code change](https://github.com/strongloop/loopback/pull/2308) here.
+
+
+## remove unused user properties
+The following properties are removed from the built-in User model in 3.0:
+- credentials
+- challenges
+- status
+- created
+- lastUpdated
+
+Developers that are relying on these properties, can redefine them in `user.json` or equivalent model.json as follow:
+```json
+{
+  "name": "MyUser",
+  "base": "User",
+  "properties": {
+    "credentials": { "type": "object" },
+    "challenges": { "type": "object" },
+    "status": "string",
+    "created": "date",
+    "lastUpdated": "date"
+  }
+}
+```
+
+Please see [Related code change](https://github.com/strongloop/loopback/pull/2299) here.
diff --git a/common/models/user.js b/common/models/user.js
index c2d36315..c1911ee8 100644
--- a/common/models/user.js
+++ b/common/models/user.js
@@ -53,9 +53,6 @@ var debug = require('debug')('loopback:user');
  * @property {Boolean} emailVerified Set when a user's email has been verified via `confirm()`.
  * @property {String} verificationToken Set when `verify()` is called.
  * @property {String} realm The namespace the user belongs to. See [Partitioning users with realms](https://docs.strongloop.com/display/public/LB/Partitioning+users+with+realms) for details.
- * @property {Date} created The property is not used by LoopBack, you are free to use it for your own purposes.
- * @property {Date} lastUpdated The property is not used by LoopBack, you are free to use it for your own purposes.
- * @property {String} status The property is not used by LoopBack, you are free to use it for your own purposes.
  * @property {Object} settings Extends the `Model.settings` object.
  * @property {Boolean} settings.emailVerificationRequired Require the email verification
  * process before allowing a login.
diff --git a/common/models/user.json b/common/models/user.json
index 16545ab4..582a09cb 100644
--- a/common/models/user.json
+++ b/common/models/user.json
@@ -11,23 +11,12 @@
       "type": "string",
       "required": true
     },
-    "credentials": {
-      "type": "object",
-      "deprecated": true
-    },
-    "challenges": {
-      "type": "object",
-      "deprecated": true
-    },
     "email": {
       "type": "string",
       "required": true
     },
     "emailVerified": "boolean",
-    "verificationToken": "string",
-    "status": "string",
-    "created": "date",
-    "lastUpdated": "date"
+    "verificationToken": "string"
   },
   "options": {
     "caseSensitiveEmail": true
diff --git a/test/user.test.js b/test/user.test.js
index 80c663d8..b928409c 100644
--- a/test/user.test.js
+++ b/test/user.test.js
@@ -110,23 +110,6 @@ describe('User', function() {
       });
     });
 
-    it('credentials/challenges are object types', function(done) {
-      User.create({ email: 'f1@b.com', password: 'bar1',
-        credentials: { cert: 'xxxxx', key: '111' },
-        challenges: { x: 'X', a: 1 },
-      }, function(err, user) {
-        assert(!err);
-        User.findById(user.id, function(err, user) {
-          assert(user.id);
-          assert(user.email);
-          assert.deepEqual(user.credentials, { cert: 'xxxxx', key: '111' });
-          assert.deepEqual(user.challenges, { x: 'X', a: 1 });
-
-          done();
-        });
-      });
-    });
-
     it('Email is required', function(done) {
       User.create({ password: '123' }, function(err) {
         assert(err);