Facebook accused of trying to decloak domain owners' personal Whois info

https://www.theregister.com/2020/06/23/facebook_gdpr_workaround/

461 133 6 years ago

cynusx6• 6 years ago

I actually agree with Facebook on this one, domain owners should have legal personalities.

That said, it shouldn't necessarily include their email, phone and address. Just the legal owner name (company or person) would be sufficient.

tasogare• 6 years ago

Why that? To ease political persecution maybe? The system is good as is.

cynusx6• 6 years ago

Well, it's a two-edged sword.

If you happen to live in a part of the world where freedom of speech is actively persecuted then I agree it's better the way it is. However, if you live in a world where democracy and due process is well established and you are not intent on doing illegal things then it can only help law enforcement and private citizens/organizations to seek justice under those laws.

fxtentacle• 6 years ago

If the article is correct in that Facebook is requesting this data for domains that look alike to Facebook and/or do Phishing, then I very much believe they should receive the data necessary to go to court.

Just because Facebook is highly unsympathetic, doesn't mean that all their initiatives are evil.

And shady websides hiding behind third party privacy providers to avoid legal responsibility for their illegal content is sadly something that I've had to deal with myself in the past.

justinclift• 6 years ago

The clear examples given of FB repeatedly trying to gain the personal owner details of non-shady websites, purely in order to sue them... that's ok with you?

blibble• 6 years ago

yeah I'm sure facebooksucks.org is phishing facebook accounts

amaccuish• 6 years ago

Then facebook can do that through the official means by submitting requests. They want to skip that process. I'd prefer their requests to be vetted before personal information is divulged. That way there is oversight.

We've already seen with the DMCA what happens when you give free-reign to companies in this area.

raxxorrax2• 6 years ago

They have for most registrars, although many act as a delegate and you need to contact them for personal contact information. It should be noted that the mail address you enter there will get a lot of spam. Quite a lot...

Santosh835• 6 years ago

I have my main email in the whois records for my website and I haven't noticed any increase of spam before and after. Perhaps the level of spam is proportionate to the popularity/traffic of your site?

enriquto2• 6 years ago

"Legal name" policies are randomly discriminatory and thus not fair in principle. Some people have unique names, others have a name that is shared among thousands of people. Imposing a real name policy is a great burden on the former, but it does not really matter to the latter.

cynusx6• 6 years ago

That's a fair point but usually that is solved by disclosing an additional datapoint like the date of birth of the person.

belorn• 6 years ago

Many cctld require a legal person that is located in the country. In practice this mean a lot of domain names are written in the name of local lawyer firm that becomes the local presence.

cynusx6• 6 years ago

I find this a bit backward actually but I suppose it exists to be able to serve legal notices to those domains.

There's a lot of issues when you operate across jurisdictions that probably won't be solved until some international treaty comes along.

searchableguy4• 6 years ago

No, they shouldn't if you don't want web to be censored and tranny of few people.

Whois shouldn't exist publicly at all in the first place.

Do you really want big corps to send some goons at your home to harass you for putting up a bigcorpsucks.com ?

example: https://www.theverge.com/2020/6/15/21291666/ebay-employees-a...

notRobot• 6 years ago

Progress has been slow going, in large part because commercial entities desperately want access to the full registration data of domains – which includes people’s home addresses, telephone numbers and email addresses – and have been trying to find ways around the privacy protections.

Ouch. This is going to make it very hard for people to host content on the web anonymously, forcing them to link their entire identity to their website. This sucks.

hjnilsson• 6 years ago

Hm? It is changing from a system were it is very hard to host content anonymously to one where it is (domains currently require full name, address, phone and email to register). Not the other way around.

Xelbair• 6 years ago

Depends on the country - you do need to provide full info to theregistar.. but they cannot share that if you are a private person - at least over here.

Santosh835• 6 years ago

Some ccTLDs even make it impossible to use privacy protection the last time I read about the matter, like for example the .in ccTLD.

The next logical step will be to link whois records with your national digital ID. It will probably happen eventually, as most govts and corporations seem determined to destroy privacy while providing a thin illusion of it.

smolder2• 6 years ago

Yes, there is a concerted effort by wealthy string pullers to invade every facet of the little people's lives so that we have no recourse when we're eventually stripped of our remaining rights by the captured government. We'll have to swear fealty to neo-feudalist lords for protection. See: Cato institute politics.

hnarn3• 6 years ago

Are you really forced to enter correct personal information for all domains, regardless of TLD and registrar?

gear54rus• 6 years ago

I imagine your bank card payments may be somehow traced to your own identity but don't quote me on that.

I guess some crypto options might help that.

ceejayoz• 6 years ago

Yes. https://www.icann.org/resources/pages/contact-verification-2...

The Whois Accuracy Program Specification of the 2013 Registrar Accreditation Agreement (RAA) requires registrars to validate and verify certain Whois data fields, which may include contacting you by phone, email or postal mail. Registrars must suspend or delete domain names that are not timely verified.

voidmain0001• 6 years ago

Time to use a proxy. https://njal.la/

ponsin• 6 years ago

That gives me an idea. A privacy oriented NGO could create an address and agree to publicly upload all letters received and allow the users to read the mail anonymously.

Havoc• 6 years ago

That's pretty damn shady. The half-arsed attempt to dress it up as a security matter "harvest people's login details" makes it even worse.

Shared404• 6 years ago

Won't somebody think of the -c-h-i-l-d-r-e-n- Security(tm).

RNCTX3• 6 years ago

Well, well. It's harder and harder every day to argue with the legal opinion offered by former SCOTUS justice Kennedy, which seemed hilariously corrupt at the time, that corporations are effectively people.

A defining trait of an awful lot of people is that they accuse what they're guilty of.

In this case, Facebook accusing other websites of trademark violations is the very definition of hypocrisy. Facebook in particular, but Twitter as well, are absolutely littered with t-shirt vendors selling other people's logos and brand names, logarithmically generated with ad data.

If you fill out your movies, music, and books "likes" as they tell you to do, within 2 days tops you'll be able to buy a Pink Floyd t-shirt from virtually anyone on the planet... except Roger Waters or David Gilmour.

The fact that Facebook refuses all search indexes makes policing Facebook's infringement on the copyrights of others impossible. At least with Napster any musician could log in and see how many users were giving their content away for free. Not so on Facebook, you can't ever know how many pirated logos of yours that Facebook sold.

classified• 6 years ago

logarithmically generated

I think you got something mixed up here.

skanderbm• 6 years ago

an exponentially growing number of tshirts perhaps ?

RNCTX3• 6 years ago

You got me, it's early yet ;)

CSMastermind• 6 years ago

Well, well. It's harder and harder every day to argue with the legal opinion offered by former SCOTUS justice Kennedy, which seemed hilariously corrupt at the time, that corporations are effectively people.

I hate this meme. That's not what the decision said.

First "corporate personhood" means that corporations are allowed to sue and be sued like they were individuals. Along with being taxed and regulated.

Citizens United, the decision you are referencing did not involve this concept.

Rather it said that the rights of individuals to free speech is not diminished if they act collectively as opposed to individually.

If I'm allowed to say, "RNCTX doesn't understand the issue" and so is my friend, then us saying it together doesn't make it illegal because we acted in coordination.

Likewise if I'm allowed to purchase a billboard that says it and so is my friend then there should be no issue with us pooling our money to purchase one together.

And that's what Citizens United said. Corporations are one such mechanism through which we could pool our money to purchase that advertisement but others such as unions, non-profits, and all other forms of collective groups are covered.

It's actually a very common sense extension of the first amendment.

fennecfoxen• 6 years ago

Corporations are "people" because their owners are people and people get to work together and corporations are how they work together.

Corporations are allowed free speech because their owners are allowed free speech as a group; the corporation is the tool for organizing it. Corporations are not allowed to vote, because people are not allowed to vote as a group.

This is not new. This is not Kennedy's fault. This has been the case since the beginning of the United States, and it has been Supreme Court precedent since 1819, when the New Hampshire Legislature said they could take over a private university because it was a corporation, and therefore had no rights, and they could take its property and change its rules at will, ant the court said No. (Dartmouth College v. Woodward)

If corporations were not treated as people and not afforded civil rights, it would be legal for the government to censor newspapers at will because they have no First Amendment rights (News Corp, NY Times, etc are corporations). It would be legal for the President to order a warrantless search of the DNC headquarters, for the DNC is a corporation, and the Fourth Amendment would not apply. It would be legal to impose a trillion dollar fine on Planned Parenthood, a corporation, for any minor paperwork infraction, for the Eighth Amendment prohibition on excessive fines would not apply. It would be legal for the government to sue them for this infraction without a jury, for the Seventh Amendment would not apply.

jacobush• 6 years ago

Yes, and the road to hell is paved with good intentions. I don't disagree with your reasoning. Do you agree with my observation that superpacs are destroying (even more) democracy?

Something should be done about these sorts of things. I'm not saying that law needs to be removed, but something should be done. There's plenty of precedent around the world that democracy can work pretty fine without Coca Cola buying superpacs.

RNCTX3• 6 years ago

First "corporate personhood" means that corporations are allowed to sue and be sued like they were individuals. Along with being taxed and regulated.

A person doing business face to face in a store cannot hide the nature of their business from their own 'customers' for lack of a better word. How long would it take the police to show up at a business that wouldn't let anyone including the people buying things from it see inside the doors or windows? Everyone could only buy things from them in the parking lot, with payment made to anonymous intermediaries, and the product delivered later by a third party. Every customer walks out holding a fake Rolex, talking about how great a store Facebook is.

See how ridiculous Facebook is when compared to the scam 'businesses' of the 80s and 90s that it emulates?

Citizens United, the decision you are referencing did not involve this concept.

I've read the case, thanks. It equated speech with money. Individuals (only) had that right prior to it, now money has speech. Corporations are money; they hoard it and do all of the bad things that it can do with it.

It's actually a very common sense extension of the first amendment.

Sure, if corporations can also go to prison and/or be executed. When Facebook lies to their own customers about their ad performance for the 13th month in a row, no more fines and civil suits, the board will go to prison. When a random nutjob goes and shoots up a nightclub or a school based on his political radicalization on Facebook, we'll just send the police over to arrest those same board members and management as accomplices to murder. After all, a getaway driver can be charged with a murder in a lot of US jurisdictions if the bank robber shoots the teller, and in the relationship between terrorists and victims compared to robbers and banks, Facebook is serving basically the same role as the getaway driver in the terrorist's case.

Alternatively, if Facebook refuses to hand over a board member or senior management member for prosecution in these cases we will simply 'execute' the company. Its assets will be seized and spent by the state, just like we do to the property of individual street drug dealers, for example. There's no need to convict them, just as there's no need to convict the street drug dealer. Take the money first, and if Facebook chooses to ask for it back they can hire their own legal representation and ask the courts for the money back, with their own money not the corporation's money... because they don't have that anymore.

Oh wait... corporations don't want that. They just want the rights, not the responsibilities, of personhood. They want to keep the individual indemnity.

Which is my point, in a roundabout way the decision justifies itself by becoming a self-fulfilling prophecy. If money is speech then money is a person, and if money is a person then money has rights, and if the whole society is based on money, then money is not only a person but the best person.

hedora3• 6 years ago

“Corporations are people” was first inserted into the Supreme Court’s findings by an railroad baron that was for some reason acting as the court reporter.

sfgweilr4f• 6 years ago

From TFA, Facebook "... continues to claim that being a registered trademark holder is sufficient to be granted full access to the Whois database, and that all other routes are unduly burdensome."

So any fraudster just needs a registered trademark and they would, according to Facebook's request, be granted full access to the database.

And no oversight, as "all other routes are unduly burdensome." That means they DON'T want subpeonas or any kind of restriction in between like a judge who could evaluate the request based on some kind of merit. No limits. Just a giant straw they can use to get all that juicy data.

Facebook's request doesn't sound very good to me. Sounds great for criminals though.

waheoo2• 6 years ago

I agree with your position but that last sentence is a bit redundant.

Nextgrid2• 6 years ago

Not disagreeing with you, but "criminals" is not a Boolean variable when you have power over those who determine who is and isn't a criminal.

Facebook (and other big social media) has a lot of power over those who define and enforce the laws, both within the bounds of the existing laws, and within a grey area where they'd be technically breaking the law, but nobody would want to enforce said law on them due to potential repercussions (Facebook could instantly shut down a lot of politicians' careers by just airing their dirty laundry, on which Facebook has a lot of visibility due to its omnipresence).

Those who make the laws rely on Facebook to succeed in their own personal interests (getting elected, which means money & power).

The problem here isn't just Facebook, it's the people that are supposed to be drafting & enforcing laws in the best interests of society are instead doing so to pursue their own personal interests instead. Facebook is just coming along for a free ride - can't really blame them.

DisjointedHunt• 6 years ago

This is a wonderful admission by Facebook. So any one of the millions of companies who have had their copyrights or trademarks infringed by fraudulent Chinese advertisers on Instagram and Facebook should now be given FULL access to all advertisers personal details on Facebook including the complete historic library of ads that have ever run on Facebook since, by their own argument, “You don’t know who to sue until you’ve got the Whois information,”

inetknght3• 6 years ago

I agree. I also think getting a judge to sign off on that would be unduly burdensome.

hedora3• 6 years ago

No. They’re arguing anyone with a registered trademark should have full access to everything, with no infringement required.

They’re also arguing a restriction to advertisers would be an undue burden.

fortran775• 6 years ago

Just holding the domain, without conducting business under that name, shouldn't be enough to be considered "infringing" in the mark. So this argument isn't valid under any means.

If someone has a business (offering goods and services in exchange for money) using an infringing trademark, then it should be possible to contact them through the same means that customers do to buy their product or service. No need for the "whois" data.

throwaway_jobs5• 6 years ago

No if you are filing a lawsuit you can’t just “contact them” the same way a customer can.

You have to serve them pursuant to the law, which generally for businesses means serving their registered agent. In order to find the registered agent you will need the legal name of the business running the infringing website (you will need the state of incorporation as well).

charwalker• 6 years ago

If I pay for my identity to be masked, would I not be entitle to a refund if my identity was revealed by the same vendor?

advisedwang• 6 years ago

morally maybe, but legally I'd guess they have provisions in whatever ToS you agreed to that mean not.

beagle3• 6 years ago

Do you really want your $10 (or however much cloaking cost you), rather than the right to sue for damages (and that right being what keeps the service honest and on your side?)

I have a great business: pay me $100 to guarantee the gender of your not-yet conceived child. If you didn't get what you asked for, I'll refund your $100. How does that sound?

balladeer• 6 years ago

I had deleted my Facebook a/c 5 years ago. I recently needed to look for apartment for rent and that is, unfortunately, done best on Facebook where I live unless you want to involve brokers who charge insane brokerage and show places you'd hate instantly, so you'd end up just wasting your time.

I choose my name as "first name + initial of my last name" (iirc that was my name in my previous/deleted a/c as well) and email and my date of birth and a real photo of mine (very clear -- basically a mug shot). Sent friend requests to 10-12 friends of mine and most of them accepted immediately.

Next day when I logged in I got a prompt that my account was disabled (flagged?) and I can request a review (or it said I can reactivate) only after adding a mobile number and I did that.

Few days later I try to login again:

"Your account has been disabled"

"You can't use Facebook because your account, or activity on it, didn't follow our Community Standards. We have already reviewed this decision and it can't be reversed. To learn more about the reasons why we disable accounts visit the Community Standards."

Maybe I will try to open with another email but they may again force me to use my mobile number and I can't keep getting new mobile numbers. While I do need to look at those "on rent" posts.

This company really has too much power!

Red_Leaves_Flyy3• 6 years ago

Power without accountability or responsibility *

Reply

ClumsyPilot5• 6 years ago

Well, the other day there was a thread on hackernews full of people declaring how they dont trust democracy to deal with freedom of speech, and would rather trust a corporation with policing it.

Reply

Sylamore2• 6 years ago

Get some cheap 30 day SIM cards from like Mint mobile that you can activate and use a burner numbers. Cheaper than a Burner (the app) number and won't be flagged as a VOIP number preventing you from using it.

On Amazon you can get a starter kit for $0.99 that has 2 SIM cards that gives you 100 texts, 100 minutes of talk and 100MB of data and you won't need the data part.

Reply

mister_hn• 6 years ago

Can you activate them with fake data / without ID card?

Reply

gruez2• 6 years ago

Are they seeking to get the customer details that the registrar has on file, or just the whois data? If it's the latter, aren't you protected if you use a whois privacy service? In that case it's just going to be a shell company in panama or something.

Reply

searchableguy4• 6 years ago

They are not just going after phishing sites but sites criticizing and protesting Facebook and it's other social media apps. There's a good chance it's a normal person behind those sites.

See: https://www.theverge.com/2020/6/15/21291666/ebay-employees-a...

Why does anyone think this won't happen to normal site owners?

Reply

Qub3d2• 6 years ago

I mean, normal site owners often get this service through their registrar for free nowadays. I run one of my project sites, https://dotbun.com, through google domains, and they just obfuscate your details as part of the purchase unless you opt out.

Take a look at my domain's whois info: https://www.whois.com/whois/dotbun.com

You will see that the name and org. aren't just redacted; they are in care of a company called "Contact Privacy Inc."

There's nothing for ICANN to unmask for FB in this case. They'd have to go to the company, and given that said company's entire business model is privacy, I would expect it to be a much more difficult argument.

Now, let me be clear that I don't like Facebook's actions here one bit. I just suspect it may be less of an issue that some people think.

Reply

DoctorOW• 6 years ago

It says they are contacting registrars directly. While the article mentions some new privacy protections I think it'd be fair to assume they're trying to work around the old protections as well.

Reply

Aeolun• 6 years ago

That’s not the answer that’s going to work for us.

Well boo hoo hoo. You know what’s not going to work for me?

You having unrestricted access to whois details!

The gall of these companies is amazing.

Reply

texasbigdata• 6 years ago

Like why do they even need it.

Reply

maltelandwehr• 6 years ago

Assuming best intentions, Facebook could use this data to better identify spammers, fake news networks, etc.

Reply

koheripbal3• 6 years ago

Ultimately, these massive global corporations, with their massive political and monetary power, WILL gain control over these systems and databases.

We should be working to decentralize/anonymize these pieces of the infrastructure to rob them of the opportunity.

Personally, I don't see the value in putting my personal name and address on a domain. The owner of the domain should be whomever has the private key - period.

Reply

holidayacct2• 6 years ago

This has never been difficult to achieve, why is this a big deal? Privacy never existed in the first place. People have been able to eavesdrop on homes by targeting pretty much anything containing metal coils (including appliances) with advanced HAM radio equipment since the early 1970s. We need to stop pretending there is such a thing as privacy and start actually looking at where scientific progress is at right now. If you actually get a basic grasp of physics, radio theory and electrical engineering you're going to find out exactly how little privacy we have.

Reply

cjslep• 6 years ago

We can skip the formalities then!

Please state your full legal name, date of birth, current address of residence, bank account numbers, credit card numbers, email addresses, passwords, your favorite type of pornography, and your mother's maiden name.

Thanks in advance!

Reply

holidayacct2• 6 years ago

Just because there is no privacy does not mean we should give away our privacy easily.

Reply

buboard• 6 years ago

why should domain names have any privately identifying information with them anyway? it's not technically required.

Reply

Santosh835• 6 years ago

Not really. Given a panopticon with infinite resources, yes, nothing can escape them, but there is relative privacy which is valuable in its own way and needs to be defended lest we get that panopticon much sooner than otherwise.

For example the requirement that every Joe hosting a small blog needs to provide his actual home address and phone number as per ICANN regulations is an insane and archaic holdover from the infancy of the WWW and needs to be seriously revised. An email ought to be sufficient for public access (though of course your Registrar will have the rest of the info in case you do illegal stuff on the domain)...

Stuff like this is important to discuss and revise. The loss of privacy is the case of the proverbial slow boiling of the frog. Taking an absolute view means one of two options: Opt out of modern society altogether or don't even care for the barest semblance of privacy. Most people won't find either acceptable or even sensible.

Reply

ClumsyPilot5• 6 years ago

There was no privacy since the stone age! Any door can be lock-picked, warrants can be obtained under false pretences, mail can be opened, etc.?

The concept of protecting privacy is that targetting people is difficult and expensive. With custom radio equipment you can't spy on millions of people willy nilly because youll soon be bancrupt.

Reply

fortran775• 6 years ago

I own a domain that's <some other word>book.com

It's registered via one of those "privacy" services. There's no website on it, but I use the dns for some internet connected devices.

I keep getting requests, which I ignore, for information relayed by the privacy service. Lately, they've morphed into offers to "buy" the domain. I wonder if it's simply Facebook's attorneys who want to find some way to contact me to send a "notice of trademark infringement" to me?

Reply

kgwxd• 6 years ago

Off topic, I was given the option to "allow" "premium adverts", supposedly, non-tracking. But they come from a different site (ithinkthereforeiam.net) and therefore, it's a 3rd-party tracker. I'm fine with self hosted ads, but this is no different than the usual junk.

Is there something about ithinkthereforeiam.net that's keeping them off ad blocker lists, and is there some reason The Register felt the need to ask me before showing what they clearly could have shown without the prompt?

Reply

creativecupcak3• 6 years ago

Why are people surprised when facebook is caught doing sketchy stuff? Like I’m glad the media is covering it, but whatever.

Reply

koheripbal3• 6 years ago

Reporting new information does not mean people are surprised.

Reply

annadane• 6 years ago

I am getting very tired of "why are people surprised"

I am certainly surprised when FB does something evil because their CEO continually preaches the importance of privacy, so shame on me I guess for taking him at his word

Reply

asveikau• 6 years ago

All they say is, ‘Go get a subpoena,’ or, ‘File a UDRP.’ That’s not the answer that’s going to work for us.”

If you can't find an answer that is going to work for you, many would take that as a hint to stop it and not ask that question.

Reply

afrcnc2• 6 years ago

wow....Namecheap, a company that makes a ton of money by selling services to crooks and fraudsters, sure likes to spin a tall tale

no... facebook is not requesting that.... facebook sued namecheap last month in an attempt to unmask domains used by both fraudsters and nso group, yet namecheap is protecting those details cause it knows once it folds, all its (not-so-legal) customers will move shop, so it's now inveted this bs about facebook trying to break gdpr

Reply

slenk• 6 years ago

Why should Namecheap give up the name of its customers?

Reply

afrcnc2• 6 years ago

if their customers are breaking the law, then WHY NOT!

you're aiding and abetting at that point

Reply

Facebook accused of trying to decloak domain owners' personal Whois info

Related Stories