Slashdot Mirror
Google Error Leaks Website Owners' Personal Information
itwbennett writes: A Google software problem inadvertently exposed the names, addresses, email addresses and phone numbers used to register websites after people had chosen to keep the information private.
The privacy breach involves whois, a database that contains contact information for people who've bought domain names. For privacy reasons, people can elect to make information private, often by paying an extra fee. But Craig Williams, senior technical leader for Cisco's Talos research group, discovered that the privacy settings for domain names registered through the company eNom were being turned off right at the time when the domains were up for renewal, starting around mid-2013. Williams contacted Google, and in about six days the privacy settings had been restored. In a notice, Google blamed a "software defect." Cisco said in a blog post that some 282,867 domains were affected.
And why not? Why shouldn't domain owners have privacy?
Obviously this is a defect! Why in the world would Google make all that personal information available for free?
I've certainly had the same thought.
There are times I actually try to find the owner of a domain, only to find them hidden behind a proxy registration. Some owners have forgotten their info to manage their proxied domains, leaving me unable to trivially verify if the site is still theirs when helping them.
There is a risk involved with having a valid address on file for domain ownership, though. Can't ignore that. I have a private domain and my information is not protected, and I have yet to be antagonized by crazed axe murderers, but it's a risk I'm choosing to take. I can say that other than a snail mail scam letter once or twice a year, all the other email crap gets filtered with the rest of my generic email spam.
If someone wants to commercialize registering domains by proxy... well, that's free enterprise. The proxy owner might find a way to claim the domain is theirs if they want to be jerks later, but contract law might cover those situations, since the actual owner is likely to have documentation indicating the proxy arrangement.
Here's another scenario... if the original owner accidentally allows the domain to expire, can the proxy site choose to register the name itself, and only sell it back to the owner at whatever price they want to ask? The registrar itself (generally) doesn't care, but the domain proxy service now knows the name was valuable enough to someone to pay for protecting it.
Anyway. I'd still prefer to leave it public, but I can understand those that are reluctant to do the same.
Yup. They should have as much privacy as any home owner, car owner, anyone who has been party of a court case, holds a business license, contributes to political actions in the state of california and i'm sure a lot of other activities subject to public records searches.
But seeing how domain names are often treated like property, i'm not sure why it isn't expected to be treated a lot like property.
But seeing how domain names are often treated like property, i'm not sure why it isn't expected to be treated a lot like property.
Maybe I'm reading you wrong, but my understanding is you feel that a domain owner's personal information should be clearly available in WHOIS. I disagree.
If you as the owner of a domain are party to a court case involving that domain, whether due to your operation of a business using that domain or for any other cause of action, your ownership will become public record during the legal proceedings, regardless of your domain registration preferences. It's not as if WHOIS privacy protection somehow makes the registered owner truly anonymous.
Do you drive a car? If so, I presume it displays a license plate. The license plate doesn't contain your name, your address, your phone number, or any other personally identifying information (unless perhaps you've volunteered the info by registering a vanity tag). Suppose one day you do something in traffic which another driver perceives as an asshole move, and they become enraged. Like, "I want to kill that person" enraged. They can't just go home and type `whois [your tag]` and get all of your personal information. That's a good thing, right?
If you've committed a crime, the police have access to that data and are able to unmask you in order to enforce the law. But Joe Random, who has become upset at you for some reason and wishes to do you harm, isn't readily able to derive your personal information from your car's license plate. Why should your domain name be any different? If you make a post on your blog that offends someone, should that person be able to look up your full name and address and do who-knows-what?
Thanks to the War on Drugs, it's easier to buy meth than it is to buy cold medicine!