Slashdot Mirror
Exposing Personal Information in the Whois Database
rocketjam writes "In a letter to U.S. Representatives Lamar S. Smith and Howard L. Berman, the Center for Democracy and Technology has raised the issue of privacy problems with the Whois Database. Acknowledging the database is uncontroversial for commercial registrations, the letter points that private individuals who register a domain name expose their names, home addresses, home phone numbers, and home e-mail addresses to the world. The letter warns, 'The current Whois regime is on a collision course with public sensitivities and international law. In an era of concern about identity theft and online security, it is unwise to require millions of individual registrants to place their home phone numbers, home addresses, and personal email accounts into a publicly available database that places no restrictions on the use of that data.' Additionally, the letter points out the current policy violates the privacy laws of some nations."
Registrars under their status of registrars are required to HAVE FULL AND PUBLIC CONTACT INFORMATION for anyone who registers. For big biz this ok but for individuals (such as me) it is a big worry.
I'd deem this an issue.
However, how many Heywood Jablowmie's are there in the WHOIS database?
that Google has this information from phone books as well (just google for a phone number or address), and there are many reverse phone books online. I think they should focus on solving identity theft in ways that if someone's info is already available (as it is everywhere) it can't be utilized well.
It used to be helpful for looking up abuse information, but that almost always goes ignored nowadays too. Now it's just useful for finding virus writers.
I never vote for anyone. I always vote against.
-- W.C. Fields
It's an empty threat.
I never vote for anyone. I always vote against.
-- W.C. Fields
Well it's better than being confronted by asl every time you logon to a chat room.
And even if it weren't, by the time the spammer who harvested your email got a slap on the wrists, your email would be on so many other spam lists you'd never get it off.
Late yesterday, privacy activists raised the National Privacy Threat level to Purple, citing the public availability of a "Phone Book" which disclosed personal information for hundreds of thousands of individuals, including full name, home address and home phone number.
(end sarcastic rant)
YAWN! Call me when WHOIS data includes SSN. As it is, this info is already widely available for the vast majority of the population.
--
Something like this, where contact information is available if you violate best Internet practices (such as by spamming) and people can get in touch with you if they need to let you know that your server has been taken over by a Russian junior high student, but if you are a good netizen you can get by without being hassled.
I never vote for anyone. I always vote against.
-- W.C. Fields
How is it a big worry?
For some of us, it used to be that the real contact information (at least email address) was needed since Internic did all of its renewals and changes via that email address.
Of course, I could go and change it, but the point is, there are many valid contacts in that database for spammers to use.
Is it a big worry? Nah, probably not, but it is a concern.
Sorry, I don't buy it.
A domain name is a publicly accessible object, and a responsibility. As a society, we expect that for certain activities, people be publicly registered (running a company is an obvious example) - reasonable privacy is a right, but anonymity - which is what we are really talking about here - is not.
I can only think of a very small minority of legitimate Internet activities that both require a domain name and for which privacy is likely to be a concern; in those cases there are plenty of registration agents who will act as a proxy for registration and take on the responsibilities associated with being the owner of a domain.
This is also a practical problem, in terms of making it hard to contact domain owners.
I have several domains and I use a separate email address for my whois records (separate from my home and business addresses). But I don't monitor emails to that address because it has become completely filled with spam. I just delete all mail to that address.
But that, of course, means that any legitimate attempts to contact the domain owner are lost as well. I could try and filter it (either manually or with software) but the ratio of legitimate email to spam on domain registry emails is thousands to one, so it's really not worth my time.
So, aside from any privacy concerns, the public availability of email addresses on whois records in effect renders them useless as contact information.
How can you prove that you own the domain (if needed) if the contact information is invalid?
What would you do if your registrar goes bust?
All of this information doesn't need to be exposed in the WHOIS database though.
1. If its such a problem, how come spammers always manged to hide?
2. In Denmark for instance, you can specify you wanted an "unlisted" address, and the whois server doesn't release your information.
If Google really cared they would fix Android Chrome to reflow text, instead of discriminating
I don't agree with the author's conclusions. Any person registering a domain name in .com is explicitly saying that they are a commercial organization, hence there should be no expectation of personal privacy. The solution is to set up another TLD explicity for individuals, since .org, .net and so on are not really appropriate either. It is necessary for all .com registrations to have valid and public registration info available, without this the level of fraud would be even worse than it is today. I have no sympathy for anyone who registers a .com domain name, and is not actually representing a business.
Of the 6 major reverse phone number / online phone books, about 4 of them are co-operative about removing info. The other 2 take weeks / months / years to remove an entry, if they bother to do it at all.
For example, I tried to correct a bad entry for my mother-in-law for all 6 of the biggest ones starting 2 months ago. She moved, and went to an unlisted number in another state. I sent multiple e-mails to the ones who have YET to delete this bogus entry, based upon her husband's name (He died 30 years ago).
The biggest and worst offender? Yahoo. I also had trouble with correcting bogus information from the one of the credit services they own part of. They had "tagged" my home address as a business address. Apparently, I got some trade journels at home during that period and that meant that it was a business address. Therefore, I finally had to take it to a federal complaint to get them to change that "tagged" entry so that I could get report, so I could work on the other problems.
What started it? My Dad spent 5 months living with us while building his new house. They changed the entry for my home to my Dad and my wife's name.
So, the moral? None of the information tracked by so-called organizations working for us is worth anything, and in fact may come back to hurt you.
I also used to get calls for someone else with my name, but for the wrong area code. I guess he was a deadbeat and lived 30-40 miles away. When they split the area code, all his banks would look him up on the internet to find him and call me. Another reason I went to an unlisted number.
I see many posts with support for removing the personal information. I have seven or so domain names registered under my name with my real email address and information, even though it's my second email account to which I expect SPAM. Trust me, I do get spam to that email inbox due to the whois database.
However, I work for a company where it is sometimes necessary to track down owners of domains and report them to the appropriate authorities. Even though a lot of people fake the information, the whois database has come in handy more often than not.
Another good thing, for myself atleast, is that I have gotten offers on some domain names I used to own. I am guessing they got the email address from the whois database, as I hadn't used the domain in question at all. I managed to sell it for quite a bit more than I bought it (it was a four digit sum, but still way more than I paid for it).
I am slightly split on this issue. I don't want my personal information in there (and faking is not an option for me, I want to stick to the rules), but I want to see other peoples information. Guess there is a tradeoff somewhere along the line.
Anyways, just wanted to point out that the WHOIS database can be extremly useful and/or helpful sometimes.
Er, you have a P.O. Box ... why not use it for DNS?
Uhh No changing this would cause problems for those who actually USE this information.
There is nothing to say you need to put clues to your gender into the domain info. Put in a fake name if you want.. use your work email address.. use a PO BOX and a pager as long as you can be contacted without too much trouble it's all good.
Anyone who thinks this info needs to be removed from the public needs to have their head examined.
Actually. That's a good question. ;) If the WHOIS database violates privacy concerns, then how can the phonebook be seen as any different? You have to pay to be unlisted (in the US, not sure about elsewhere).
We have always taken the view that private individuals have a right to secrecy, and that those individuals should make an effort if they want some data published. The USA has taken the opposite stance; people have a right to reveal information, while keeping it secret should take effort.
In an age where data processing is always manual, the USA had it right; stopping gossip is hard, and there's lots of work involved in revealing information. Further, the more you wish to reveal about someone, the more work you have to perform. Automated data processing has pushed the cost of this work down to the point where it is easy to reveal lots of potentially harmful information in one go.
Basically, it's wrong to look at the Americans as catching up on this one; they took a fundamentally opposed view to us, and it's still not clear who's got the better system (although I prefer the European one).
I appear to have a blog. Odd.
If we used DNS domains like they were designed to be used, this could be an easy-to-correct problem.
.com must clearly be a commercial entity with no problem in giving out their business address, contact number, etc.
.net is a service provider, and should have all sufficient information to contact that provider for connectivity or abuse issues.
.org is a non-profit organization, and should post any contact information that they'd otherwise be required to post as part of their charter.
.com, they need to expect to be treated like a commercial entity.
Any entity registering in
Any entity registering in
Any entity registering in
We have a '.name' now (which personally I think should have been '.nom'), for personal users. I think it's perfectly reasonable to expect that individuals will not want to put any contact information there. I also think it's perfectly reasonable for an ISP's contact information to be exposed in its place, though.
Basically, just apply privacy requirements to the intent of the domain name. If regular Joes want to register a
Subdomains under a country code would need to be addressed by the countries in question.
Need the WHOIS info, and here's why...
A few months ago, I purchased quite a bit of money in CD's from an Internet site. It's a business, but it's a proprietorship run by one person. I never received the CD's and the guy stopped returning my emails. I had paid him via PayPal, and the ridiculously short PayPal complaint/insurance period had run out, so I couldn't get my funds back.
The guy has no contact information other than an email on his site. (And don't play me for idiot...This is a big music site and I've successfully purchased there before.)
So...I wanted to send him to a collection agency. Several warnings to him went unheeded, so I went about trying to track down his personal information.
And I ended up on netsol. It referred me to GKG.net, another registration company. I went on the WHOIS and the guy had NO information whatsoever. Every field said nothing.
So I emailed GKG.net and told them that when collection proceedings began, we would be asking them for this guy's info. They emailed me back that it's their policy to have updated and correct information in the WHOIS database. They emailed the guy and gave him 48 hours to provide it, with the threat that his site would be shut down.
A day later, all of his information was up. I had a name/phone/address. I sent him to a collection agency based on the only place I was somewhat easily able to obtain information.
Damn good reason to keep WHOIS info open. If people don't want to give out their home addresses, then they should rent a P.O. box for $20/year. If they don't want their names public, then I can only imagine either a) unwarranted paranoia or b) that the person shouldn't have on the web whatever it is that they have on there.
WHOIS helped, and the guy went to a collection agency.
-SD
And so if your server is compromised and becomes a spam-spewer, DDOS zombie, cracker relay, or other public menace, its going to be hard contacting you because of the bogus information and a potentially dormant yahoo account.
The internet is part of the public sphere. Courts in the USA (and everywhere else AFAIK) have held that when you leave your house and enter the public sphere (or in this case operate a sever connected to the internet), you volunatarily give up some of your privacy.
Most people here are missing the point of privacy in a personal domain. Lots of people use their own domains for putting up pictures of themselves and their children to share with friends and family. The world is full of sickos who would use the whois information to find out where they live and then proceed to prey on the innocent.
I've used whois as a phonebook often as most of the people I know have a domian. Even way back when slashdot was just starting an CmdrTaco was asking around for a free place to host the images I was able to call him becasue his number was on whois. We were able to get slashdot.wolfenet.com up and running and slashdot was able to continue existance and grow to the point where they were giving out 5 digit user numbers.
I'm strongly in the camp that domain contact information, at least the technical contact, should be public. I've dealt with abuse issues for ISPs too long the think any other way could work. If there is a technical or abuse issue with a domain a network admin needs to be able to contact the person responsible. At least contacts for DNS servers need to be required.
-- I have a private email server in my basement.
Whatever happened to the public domain? I am for privacy for the most part, but not total anonymity. in certain areas, total anonymity is wonderful, such as on /., but in others, such as in business, one needs to have a name and real info to be legit. The registration of web domains is a business, and should therefore have all the disclosure of identity rules apply.