Slashdot Mirror
JotForm.com Gets Shut Down SOPA-Style
itwbennett writes "In a post on the company blog, JotForm.com cofounder Aytekin Tank alerts users that 'a US government agency has temporarily suspended' the jotform.com domain. He explains that it is part of an 'ongoing investigation' of content posted to its site by a user. Although which user and what content haven't yet been disclosed, there is speculation about forms used for a phishing attack on a South African bank. JotForm hosts over two million user-generated forms, and uses software to block fraudulent accounts (65,000 so far), so you can see there's plenty of opportunity for mischief."
News@11
this involved a court order.
It works for me...
away from the authority of a shoot first ask questions later country.
This is overrating to call this SOPA-style. They were temporarily closed because it was being used to phish information from customers of several different banks.
This is more analogous to the police closing a business after a robbery to preserve evidence. They'll be back up soon enough, and are actually still operating under an alternate domain.
It was my understanding that in the United States, law enforcement (of any kind) is obligated to use the "least intrusive means" they reasonably can to effect an arrest or seizure.
In cases like this, blocking the domain name is so obviously the opposite of "least intrusive", I wonder if they have grounds to prosecute under 18 US 242. I know I would consider it, if this were done to me or my company.
Even if the owners are not guilty of negligence, which it appears they are not (65K forms removed), this sort of arbitrary, no-warrant, no-subpoena, no due-process can absolutely ruin a business.
There is no way the Feds can make up for this; CIO's will say, "Well, I guess we shouldn't use them - we might not have access to our data."
Check your premises.
All the talk of what happens when your data is in the cloud and the business is sold or shutters itself, here is another example. Not only do you have to worry about your dates security and availability for those reasons, now the feds can shut down a service you may use for god knows what important aspects of your business, but you can bet your perfectly legal and confidential business records are now available to the feds sans-warrant. Yeah, cloud computing is the end-all be-all. Think again, get the buzz words out of your head, and your head out of the 'cloud'.
Silence is a state of mime.
Copyrights, patents and all other government regulations and money counterfeiting and taxes and laws and wars that go beyond what the authorised by the people via the Constitution to the government are all tools of the totalitarianism.
Sure, YOU may believe that some of what government is pushing is good, so YOU may believe that there is a line that will not be crossed, and you will get something for nothing from the government. You think that government will stop its abuse of power once that abuse helps YOU and it will not be taken further.
Of-course you have to be a fool to believe that.
Just like in the previous SOPA story and every story - I have a perfect metaphor for this I think: government is a noose on the necks of the people.
There is another part needed to hang somebody - a noose and a chair to drop one off it.
Debt can act as that chair.
But so can regulations and laws and taxes and all of this stuff, including copyrights and patents. I am using economic hanging as a metaphor, of-course eventually there will be actual hanging (NDAA and drone strikes against anybody on the planet without a trial), again, governments do not stop abusing their power half-way. They do not stop only where it is convenient for YOU.
You can't handle the truth.
1) Upload infringing content to site.
2) Alert copyright holders (or their "AAgents") to infringing content.
3) Wait until site gets shutdown.
Seems like you could wrap a business model around this as a gun-for-hire...
We're only getting one side of the story so it's impossible to tell if there was reasonable cause for what appears to be a search of the database. Per updates from JotForm the suspension has been lifted.
...stuff like this needs to stop happening before I throw away my TB USB drives, server boxes and in-house apps and move all my stuff thereto, or rely on any services available thereon. The risk of losing access to my bread and butter because a few people I don't even know or deal with, violate copyright, or because any government decides a few people did so (right or wrong), is a risk I shouldn't have to bear. As it is, it's looking these days like there's probably a lesser risk of losing income and exposure from a fire or physical theft than from arbitrary denials of service like these.
65,000 fraudulent accounts and probably another 65,000 that they haven't identified yet. Obviously they had shitty anti-abuse controls in place or they never would have ended up with 65,000 fake accounts. If you are going to offer a free service to the Internet you have a responsibility to the rest of the community to not be a haven for abusive crap like spam/malware/phishing.
SOPA/PIPA is supposed to be used for copyright violations. What does this have to do with phishing?
Go Daddy has a history of pulling registrations without notification to domain owners. Remember seclists.org and familyalbum.com? Those domains were redirected because of third party complaints. The complaints were not even made by law enforcement. The GoDaddy TOS expressly allows them to suspend service at their discretion and they do it at the first sign of trouble.
I'm not defending GoDaddy in the least, but people doing business with them should be aware of their history and policies.
Where would we be if Wheel had hid her round rock in a cave instead of showing everyone how it rolls?
considering you openly worship a fascist who wants to become president of the united states, you should know more about totalitarianism. instead you write this message that shows a complete lack of understanding thereof.
So I can only hope that maybe this news gets them more noticed to compensate them for the losses incurred as a result of a domain registrar and/or US agency (allegedly the Secret Service) that fits somewhere between malicious or stupid (depending on which way Hanlon's Razor swings). Unfortunately, the service they provide seems to be more oriented to small businesses rather than to the geeks that would be reading this at Slashdot and other techie sources.
now we need to go OSS in diesel cars
The problem with ongoing investigations, particularly with international ongoing investigations, is that transparency can work against you in big ways. So I really think that the outrage at the US Federal Government is really kind of baseless at this point. They made a request and... Godaddy complied.
However, it's pretty goddamn clear GoDaddy doesn't give two shits about their customers. They should be ashamed of what they do.
Non impediti ratione cogitationus.
The content industry claimed that we needed SOPA/PIPA to take down these horrible sites or they'd lose millions upon billions upon trillions and zombies would rise from the grave (or some such... I tend to lose track of their doomsday scenarios if Technology X isn't stopped). We don't have SOPA and yet MegaUpload and JotForm.com were taken down just fine. This is, of course, putting aside whether or not MegaUpload or JotForm *SHOULD* have been taken down. Clearly, though, they have the capability to take sites down as they see fit so why do they need it codified in law?
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
There is an "or" in there that makes all the difference. What it actually says is:
"... or to different punishments, pains, or penalties, on account of such person being an alien, or by reason of his color, or race, than are prescribed for the punishment of citizens..."
So it actually applies to:
"... the deprivation of any rights, privileges, or immunities secured or protected by the Constitution or laws of the United States"
OR to:
"... different punishments, pains, or penalties, on account of such person being an alien, or by reason of his color, or race, than are prescribed for the punishment of citizens..."
So it's deprivation of rights OR discrimination. And while IANAL, I have looked up cases and that is how the court has consistently interpreted it.
I get to know all kinds of websites I've never heard before.
I've been thinking about this problem of unilateral takedowns lately, and it seems to me that there now needs to be a concerted effort to converge on the use of a peer-hosted, redundant net-wide filesystem with some simple equivalents to core utils such as FTP, a web browser and perhaps email dropboxes lying on top of it.
Some quick googling around and I found this very interesting project, Tahoe-FS:
http://arstechnica.com/open-source/news/2009/08/p2p-like-tahoe-filesystem-offers-secure-storage-in-the-cloud.ars
(Demo page showing the concept here): http://bigasterisk.com/tahoe-playground/
Anyone can host their own nodes, it is erasure-tolerant (files are mirrored w/encryption to 10 nodes, only 3 need be available to reconstruct your files).
If we build a browser-like app that could traverse files in this system, no one could take down content so easily anymore. It needs to be so easy to use that -everyone- will use it, like Dropbox but without the single corporate point of failure.
I know that despite everyone knowing they didn't like what it said, very few people actually read the SOPA bill.
SOPA only applies to foreign sites with foreign name registrars. For sites like this where the US Government can get the name registrar to yank the name or can contact the site owners to tell them to take it down (or else), SOPA isn't needed and indeed wouldn't apply.
SOPA was designed to let the US government block the name resolution of foreign sites when the owners of the site and the foreign name registrars refused to do this. Once that was removed, the only actions left were to block financial transactions to the sites in hopes of defunding them.
Part of the reason Godaddy was for SOPA is because as a US name registrar, they already have to comply with these orders, they likely wanted SOPA to come into effect so this wouldn't keep them at a competitive disadvantage to offshore name registrars who can refuse to comply.
http://lkml.org/lkml/2005/8/20/95
The U.S. government is extremely corrupt.
Really SOPA style? Slashdot just slowly moves its way down the list of news, its now like the Onion.
It's not just JotForms. Google is now the leading site being exploited to host phishing pages. Google has reasonable defenses against phishing for their "sites" product. However, Google doesn't seem to have those protections on their document and spreadsheet products. Here's a fake login form hosted by Google. That's been up since 2010. Here's a fake login page hosted as a Google spreadsheet. Google allows unlimited HTML in a spreadsheet, which means it can be abused in this way. We have a full list, if anyone is interested.
"formbuddy.com" and "surveymonkey.com" can also be abused in this way. Formbuddy seems to kick phishing pages off quickly. Surveymonkey, not so good at this.
If you offer free hosting, and don't have aggressive anti-phishing controls in place, you will be pwned.
Right on the money. I wish I had mod points to give you.
The Lost Cause may seem romantic, but anyone who doubts that the Civil War was really about slavery needs to read the declaration of secession:
Am I the only one thinking that temporarily migrating from the suspended .com to a .net domain is probably the most stupid thing they could do? Seriously, switching from one controlled TLD to another on the same "jurisdiction"...
It's not uncommon for sites to get hacked (one every 3.5 seconds is the current rate), and in some cases this is so they can host a phishing form (which is why the US government took down JotForm.com).
Given this draconian approach to removing some phishing forms, and given that's it's tough to completely stop hackers, it's clear that this could happen to any site, or to cloud services that host your content under a shared domain (maybe even Tumblr or Pinterest).
The only protection is not to host sites with US-based registrars.
I would hope that EU-based registrars for .com etc should be safer from this sort of action - can anyone confirm? Failing that you could go for a country domain.
Cause last time I checked, it didn't. What the hell is this?
All this can go on Freenet and SOPA / PIPA / CHUPA PINGA style legislation can go pack sand. Freenet isn't susceptible to some of the legal attacks so far presented, hence why there is nasty shit there always. But as a medium for free exchange of information, it is bar none, due to that inability to be censored! Sad that more don't hook up. But SOPA / PIPA and the shutdown of file sharing sites will insure that Freenet gets more users.
http://freenetproject.org/
http://en.wikipedia.org/wiki/Freenet
WARNING: Offensive content will also be found on Freenet. You'll know which, as they don't hide themselves. Don't browse to those sites...
It might look like cruel move, but in these times fast reaction like this is the only way to protect the artists. Of course, these filthy pirates are now crying all kinds of bullshit like that they didn't host files but forms, but we all know that the site was used mainly for piracy.
Surfin' in the CSA (Corporate States of America)! Yay!
The passage I quoted is actually from a 1852 document, "Declaration of the Immediate Causes Which Induce and Justify the Secession of South Carolina from the Federal Union." I think it's representative, but I was wrong to describe it as the declaration of secession and I believe it's important to correct the error.
Jotform's webforms made it easy for script kiddies to launch their 'own' phishing attacks. Whether or not jotform was involved with many of the actual dollars lost to phishing, they were extremely visible because any annoying person could use jotform to cut and paste together an attack.
SOPA es muy estupido!!!!
Consider John Brown and similar activities. He was out to kill whites in the area, did not scruple about which ones. (His activities in Kansas got a family who appeared to have been trying to get away from slavery, just moved to the wrong side of town.) The slave population was a powder keg and anyone who looked or sounded inclined to sympathize with the abolitionist filibustering expeditions was getting to appear careless with matches. Have a look at some of the primary literature of the period (letters, news...). Meanwhile in the North the use of the Federal Govt. to come and arrest blacks as "runaway slaves" looked at least as unreasonable as the current behavior of the US Govt. treating people as "terrorists" at the drop of a hat. In this case though it was blamed on the Slave Power (as Twain called it). Terrorism on both sides. People get worked up to fight when they find their persons threatened, not over just economic injustice. (Proof: the factory workers in the Northern mills didn't start to get decent treatment for several more decades, and that took organized labor.)
Take note of this: "...the Secret Service still isn't talking, returning a bland and meaningless statement to press requests: 'We are aware of the incident and we're reviewing it internally to make sure all the proper procedures and protocols were followed.' "
When the company contacted the Secret Service, asking why their site was down, "the agent told me she is busy and she asked for my phone number, and told me they will get back to me within this week".
To date they still have no explanation and no court order concerning the take-down of their site. Even if there were a court order, there is zero reason not to contact the business and provide them a chance to cushion the effects for their legitimate customers. This sort of behavior is irresponsible. Clearly, court orders, due process and formal procedures are for wimps, not the elite *drum roll* Secret Service.
I hope JotForm can afford to file a court case over this. This sort of thing can do immense damage to a company's reputation, and someone in the Secret Service needs a slap upside the head.
In any case, as others have observed, any serious Internet company needs to avoid all TLDs controlled in the USA. Sure, register a .com address, but use it to forward to your real site, hosted under a different TLD - and make it clear to users that the non-.com TLD is the correct one.
Unrelated to the Internet, but nonetheless relevant: About 10 years ago I was with a small European company that was marketing a new ERP system to small companies. Our attorney told us flat-out: do not sell to anyone in the USA. The legal system is so screwed that it just isn't worth the risk - the laws are impossible, the customers sue at the drop of the hat, etc, etc. To underscore this, any sort of legal or liability insurance we looked at specifically excluded coverage for business transacted with US customers. It appears that things have only gotten worse...
Enjoy life! This is not a dress rehearsal.