Slashdot Mirror

← Back to Stories (view on slashdot.org)

Exposing Personal Information in the Whois Database

Posted by CowboyNeal on from the a-better-way dept.

rocketjam writes "In a letter to U.S. Representatives Lamar S. Smith and Howard L. Berman, the Center for Democracy and Technology has raised the issue of privacy problems with the Whois Database. Acknowledging the database is uncontroversial for commercial registrations, the letter points that private individuals who register a domain name expose their names, home addresses, home phone numbers, and home e-mail addresses to the world. The letter warns, 'The current Whois regime is on a collision course with public sensitivities and international law. In an era of concern about identity theft and online security, it is unwise to require millions of individual registrants to place their home phone numbers, home addresses, and personal email accounts into a publicly available database that places no restrictions on the use of that data.' Additionally, the letter points out the current policy violates the privacy laws of some nations."

5 of 323 comments (clear)

  1. amen by Neophytus · · Score: 5, Insightful

    Registrars under their status of registrars are required to HAVE FULL AND PUBLIC CONTACT INFORMATION for anyone who registers. For big biz this ok but for individuals (such as me) it is a big worry.

    1. Re:amen by orangesquid · · Score: 5, Insightful

      And when the owner of a domain is running an open relay, or has a glaringly obvious security problem, or has a problem with their site (and webmaster@ bounces), the courteous thing to do, e-mailing them to inform them of the problem, can no longer be done if there is no e-mail address available.

      Or, sometimes you get people who register domains through some co-hosting service and then launch attacks against your box/network through the service. Usually, the e-mail for the domain registration will be someone in charge who can give the asshole due justice.

      It is not a frequent thing when I must resort to WHOIS to contact a site owner, but sometimes it happens and it's fairly important.

      --
      --TheOrangeSquid Is it any wonder things seem so awry? We swim in a sea of confusion and don't have to think to survive
  2. Re:let's not forget... by mblase · · Score: 5, Insightful

    Yes, but Google also gives you the option to remove your information from their searchable database -- there's a link right next to your results if you do a search for your own information. So do most other reverse-phone-lookup sites.

    Whois gives you no such option, and would probably actively resist if you even asked.

  3. Re:Reporting WHOIS abuse? by Future+Man+3000 · · Score: 5, Insightful
    Proving that a spammer took source addresses from WHOIS would be problematic. Taking a spammer to court over it wouldn't be cost-effective for the maintainers of any WHOIS server. Spammers have already shown themselves as a group to not be overly concerned about warnings, standards, or laws.

    It's an empty threat.

    --

    I never vote for anyone. I always vote against.
    -- W.C. Fields

  4. Set up TLD for individuals by flakac · · Score: 5, Insightful

    I don't agree with the author's conclusions. Any person registering a domain name in .com is explicitly saying that they are a commercial organization, hence there should be no expectation of personal privacy. The solution is to set up another TLD explicity for individuals, since .org, .net and so on are not really appropriate either. It is necessary for all .com registrations to have valid and public registration info available, without this the level of fraud would be even worse than it is today. I have no sympathy for anyone who registers a .com domain name, and is not actually representing a business.