Exposing Personal Information in the Whois Database 323
rocketjam writes "In a letter to U.S. Representatives Lamar S. Smith and Howard L. Berman, the Center for Democracy and Technology has raised the issue of privacy problems with the Whois Database. Acknowledging the database is uncontroversial for commercial registrations, the letter points that private individuals who register a domain name expose their names, home addresses, home phone numbers, and home e-mail addresses to the world. The letter warns, 'The current Whois regime is on a collision course with public sensitivities and international law. In an era of concern about identity theft and online security, it is unwise to require millions of individual registrants to place their home phone numbers, home addresses, and personal email accounts into a publicly available database that places no restrictions on the use of that data.' Additionally, the letter points out the current policy violates the privacy laws of some nations."
amen (Score:5, Insightful)
If there were strong checking (Score:2, Insightful)
However, how many Heywood Jablowmie's are there in the WHOIS database?
let's not forget... (Score:5, Insightful)
It is kind of irritating. (Score:2, Insightful)
It used to be helpful for looking up abuse information, but that almost always goes ignored nowadays too. Now it's just useful for finding virus writers.
Re:let's not forget... (Score:5, Insightful)
Whois gives you no such option, and would probably actively resist if you even asked.
Re:If there were strong checking (Score:3, Insightful)
also doesn't take a whole lot of common sense when your filling out a form for an online comic strip registration and its asking you for your home address and phone number. I mean unless your buying something why would you give this info out? people that give out personal info simply because some form is asking for it.. dummies, period
Re:Reporting WHOIS abuse? (Score:5, Insightful)
It's an empty threat.
Re:How else... (Score:2, Insightful)
And even if it weren't... (Score:2, Insightful)
And even if it weren't, by the time the spammer who harvested your email got a slap on the wrists, your email would be on so many other spam lists you'd never get it off.
And in other news, (Score:5, Insightful)
(end sarcastic rant)
YAWN! Call me when WHOIS data includes SSN. As it is, this info is already widely available for the vast majority of the population.
--
Re:Call me big brother... (Score:4, Insightful)
Remember when... (Score:4, Insightful)
For some of us, it used to be that the real contact information (at least email address) was needed since Internic did all of its renewals and changes via that email address.
Of course, I could go and change it, but the point is, there are many valid contacts in that database for spammers to use.
Is it a big worry? Nah, probably not, but it is a concern.
Privacy (Score:3, Insightful)
A domain name is a publicly accessible object, and a responsibility. As a society, we expect that for certain activities, people be publicly registered (running a company is an obvious example) - reasonable privacy is a right, but anonymity - which is what we are really talking about here - is not.
I can only think of a very small minority of legitimate Internet activities that both require a domain name and for which privacy is likely to be a concern; in those cases there are plenty of registration agents who will act as a proxy for registration and take on the responsibilities associated with being the owner of a domain.
Practical Contact Problem (Score:5, Insightful)
I have several domains and I use a separate email address for my whois records (separate from my home and business addresses). But I don't monitor emails to that address because it has become completely filled with spam. I just delete all mail to that address.
But that, of course, means that any legitimate attempts to contact the domain owner are lost as well. I could try and filter it (either manually or with software) but the ratio of legitimate email to spam on domain registry emails is thousands to one, so it's really not worth my time.
So, aside from any privacy concerns, the public availability of email addresses on whois records in effect renders them useless as contact information.
Correct contact information is required (Score:3, Insightful)
What would you do if your registrar goes bust?
All of this information doesn't need to be exposed in the WHOIS database though.
Two things: (Score:3, Insightful)
2. In Denmark for instance, you can specify you wanted an "unlisted" address, and the whois server doesn't release your information.
Re:If there were strong checking (Score:2, Insightful)
Heywood must not care much to keep his domain. I recently received a letter from NetSol asking me to verify the information in my registration and reminding that incomplete or bogus records could result in the registration being invalidated.
Also, I think someone else mentioned this, but it might be hard to defend yourself against a hijack case if you don't have accurate records in your registration "paper" trail.
Set up TLD for individuals (Score:5, Insightful)
Re:If there were strong checking (Score:2, Insightful)
If you've ever seen the movie Maverick, where Mel Gibson is talking to the Indian chief, the Chief states that the next place he's going to move is going to be a real dump so the white man won't kick him off of it. That's the way to pick domain names
After all, aren't we all just little Indians?
Re:amen (Score:5, Insightful)
Or, sometimes you get people who register domains through some co-hosting service and then launch attacks against your box/network through the service. Usually, the e-mail for the domain registration will be someone in charge who can give the asshole due justice.
It is not a frequent thing when I must resort to WHOIS to contact a site owner, but sometimes it happens and it's fairly important.
Guess again(+) (Score:2, Insightful)
For example, I tried to correct a bad entry for my mother-in-law for all 6 of the biggest ones starting 2 months ago. She moved, and went to an unlisted number in another state. I sent multiple e-mails to the ones who have YET to delete this bogus entry, based upon her husband's name (He died 30 years ago).
The biggest and worst offender? Yahoo. I also had trouble with correcting bogus information from the one of the credit services they own part of. They had "tagged" my home address as a business address. Apparently, I got some trade journels at home during that period and that meant that it was a business address. Therefore, I finally had to take it to a federal complaint to get them to change that "tagged" entry so that I could get report, so I could work on the other problems.
What started it? My Dad spent 5 months living with us while building his new house. They changed the entry for my home to my Dad and my wife's name.
So, the moral? None of the information tracked by so-called organizations working for us is worth anything, and in fact may come back to hurt you.
I also used to get calls for someone else with my name, but for the wrong area code. I guess he was a deadbeat and lived 30-40 miles away. When they split the area code, all his banks would look him up on the internet to find him and call me. Another reason I went to an unlisted number.
Can be useful... (Score:5, Insightful)
However, I work for a company where it is sometimes necessary to track down owners of domains and report them to the appropriate authorities. Even though a lot of people fake the information, the whois database has come in handy more often than not.
Another good thing, for myself atleast, is that I have gotten offers on some domain names I used to own. I am guessing they got the email address from the whois database, as I hadn't used the domain in question at all. I managed to sell it for quite a bit more than I bought it (it was a four digit sum, but still way more than I paid for it).
I am slightly split on this issue. I don't want my personal information in there (and faking is not an option for me, I want to stick to the rules), but I want to see other peoples information. Guess there is a tradeoff somewhere along the line.
Anyways, just wanted to point out that the WHOIS database can be extremly useful and/or helpful sometimes.
Re:Obstacle to distributing a shareware applicatio (Score:1, Insightful)
Re:Remember when... (Score:3, Insightful)
That information needs to be valid in case someone needs to contact the admin in a hurry.
Nothing has been more of a pain in the past when trying to deal with infected/rooted servers and trying to find the admin via the domain owner only to find out the contact info is invalid.
Makes me have to go to the isp(the slow route) rather than either getting the box owner or the box owner.
Mind you that doesn't apply as much if the domain is simply hosted on a sever somewhere and your not the admin.
Re:amen (Score:5, Insightful)
Re:How else... (Score:5, Insightful)
There is nothing to say you need to put clues to your gender into the domain info. Put in a fake name if you want.. use your work email address.. use a PO BOX and a pager as long as you can be contacted without too much trouble it's all good.
Anyone who thinks this info needs to be removed from the public needs to have their head examined.
Re:How else... (Score:3, Insightful)
Re:UK WhoIS (Score:4, Insightful)
We have always taken the view that private individuals have a right to secrecy, and that those individuals should make an effort if they want some data published. The USA has taken the opposite stance; people have a right to reveal information, while keeping it secret should take effort.
In an age where data processing is always manual, the USA had it right; stopping gossip is hard, and there's lots of work involved in revealing information. Further, the more you wish to reveal about someone, the more work you have to perform. Automated data processing has pushed the cost of this work down to the point where it is easy to reveal lots of potentially harmful information in one go.
Basically, it's wrong to look at the Americans as catching up on this one; they took a fundamentally opposed view to us, and it's still not clear who's got the better system (although I prefer the European one).
Re:amen (Score:4, Insightful)
False or missing information in whois records is already a problem that helps (for instance) spammers hide their contact information from people with legitimate reasons to contact them. If you get no response from the contact listed in the domain's SOA record, abuse, admin, webmaster, postmaster, etc, and there is no contact information posted on the site (or false contact information), what do you do? You check out the WHOIS record for the domain. If the info that's supposed to be there is present and accurate, you have a way to contact somebody, if it isn't, you have ammo for asking the registrar to suspend the domain registration, and if *they* won't, you have ammo to ask ICANN to suspend the registrar's activities.
Unfortunately, people don't realize the reason that WHOIS records exist, which is to provide contact information. That's the WHOLE reason. Removing that information makes the WHOIS database useless.
Re:If there were strong checking (Score:2, Insightful)
Different domains for different purposes (Score:3, Insightful)
Any entity registering in
Any entity registering in
Any entity registering in
We have a '.name' now (which personally I think should have been '.nom'), for personal users. I think it's perfectly reasonable to expect that individuals will not want to put any contact information there. I also think it's perfectly reasonable for an ISP's contact information to be exposed in its place, though.
Basically, just apply privacy requirements to the intent of the domain name. If regular Joes want to register a
Subdomains under a country code would need to be addressed by the countries in question.
A good reason to need public WHOIS info... (Score:3, Insightful)
Need the WHOIS info, and here's why...
A few months ago, I purchased quite a bit of money in CD's from an Internet site. It's a business, but it's a proprietorship run by one person. I never received the CD's and the guy stopped returning my emails. I had paid him via PayPal, and the ridiculously short PayPal complaint/insurance period had run out, so I couldn't get my funds back.
The guy has no contact information other than an email on his site. (And don't play me for idiot...This is a big music site and I've successfully purchased there before.)
So...I wanted to send him to a collection agency. Several warnings to him went unheeded, so I went about trying to track down his personal information.
And I ended up on netsol. It referred me to GKG.net, another registration company. I went on the WHOIS and the guy had NO information whatsoever. Every field said nothing.
So I emailed GKG.net and told them that when collection proceedings began, we would be asking them for this guy's info. They emailed me back that it's their policy to have updated and correct information in the WHOIS database. They emailed the guy and gave him 48 hours to provide it, with the threat that his site would be shut down.
A day later, all of his information was up. I had a name/phone/address. I sent him to a collection agency based on the only place I was somewhat easily able to obtain information.
Damn good reason to keep WHOIS info open. If people don't want to give out their home addresses, then they should rent a P.O. box for $20/year. If they don't want their names public, then I can only imagine either a) unwarranted paranoia or b) that the person shouldn't have on the web whatever it is that they have on there.
WHOIS helped, and the guy went to a collection agency.
-SD
Re:As it should be (Score:3, Insightful)
The internet is part of the public sphere. Courts in the USA (and everywhere else AFAIK) have held that when you leave your house and enter the public sphere (or in this case operate a sever connected to the internet), you volunatarily give up some of your privacy.
Re:amen (Score:5, Insightful)
All it'll take is some blowhard out on the net (and you know from being on Slashdot that there are plenty of them) to get pissed off at something someone posts on their web page. It might not even be anything really bad, people get pissed off over the stupidest things. Joe Blowhard decides to look up Jane Somebody's home address on whois, then goes over her house and kills her. Or kicks her ass. Or rapes her. Or robs her. But you get the idea.
Currently, the anonymity you have on the web is the only thing protecting you from all the crazies out there. Put your address on a website, and you take your chances. Not wanting to risk possible red death should NOT ban you from having a website, and that's what this is really all about.
Identity theft is one thing. Getting your ass beaten by some lunatic who didn't like your website (maybe he thinks you're not religious enough, maybe he doesn't like your politics, whatever) is quite another.
Missing the point: Stalkers, Child Predators (Score:2, Insightful)
Re:amen (Score:3, Insightful)
These are every day events that happen locally. The person you piss of on the internet my be your neighbor, but more than likely they are hundreds of miles away.
Could the above scenerios happen? Yes, but I will not let fear of possible lunatics affect my day to day actions.
It's my phonebook (Score:3, Insightful)
I'm strongly in the camp that domain contact information, at least the technical contact, should be public. I've dealt with abuse issues for ISPs too long the think any other way could work. If there is a technical or abuse issue with a domain a network admin needs to be able to contact the person responsible. At least contacts for DNS servers need to be required.
Re:amen (Score:2, Insightful)
If you want to complain to the CEO of AT&T, you call him at work--not at home.
If the target registrant is using false information, the registrar itself [AS IS REQUIRED] would still find out--really, it's actually a non-change for them.
There are plenty of allegories to this in existing systems--this shouldn't be a big deal.
Public Domain (Score:2, Insightful)
Re:amen (Score:3, Insightful)
Indeed you do have an odd view on privacy. This sort of view on privacy puts free speech, freedom of religion, and even democracy at great risk.
A key element of freedom is some level of privacy. Like all things this is a continuum, but the privacy needs to be there.
Take the extreme case. Your vote is private. It's absolutely essential that it be private. If it wasn't private, some local "Honest Businessman" might want by each household in a distict saying, "You've got yourselves a nice house here. It would be shame if something happened to it. If you don't vote for Sentator Gimmebribes, something might happen. That would be very unfortunate." Thanks to the privacy of your vote, you can go vote out the creep, then return home and say, "I have no idea how he lost the election, I sure voted for him!"
On a more historic level, support for the United States revolution was built up by anonymous pamphleteering. If the publishers had put their names on it the British would have strung them up. By working anonymously they could continue to spread their message and do more good than if they were quietly executed early in their campaign.
To take a still fairly extreme case, say you're in a strongly racist community, one in which violence occasionally erupts against one race and people defending that race. This might be South Africa of the past or parts of the United States in the past. I'm sure it still goes on in other countries right now. You feel that the racism is wrong, but you've got a family. If you speak out against it publically there is a real risk you'll be lynched, or your children attacked. But you can secretly spread pamphlets or other media exposing the evil.
This applies in many other areas. Is your preferred religion unpopular, perhaps even dangerous? If you're not in the mood to be a martyr (or perhaps make your children martyrs), quietly, privately practice your religion. Hopefully this isn't something that happens anywhere, but in some parts of the world it's a risk.
Want to speak out against a group that you feel is criminal and willing to harm you? (Perhaps a large cult?) The police don't agree it's a threat and won't protect you, but you want to warn the world? Well, privacy in the form of anonymous speech may be your tool.
Getting a domain (typically to run a web site) can be a great way to get your message our inexpensively. To declare that you can't be private while doing so is to limit potentially important speech.