Doxxing defense: Remove your personal info from data brokers

http://www.computerworld.com/article/2849263/doxxing-defense-remove-your-personal-info-from-data-brokers.html#tk.cwfb

by ilamont • 12 years ago

209 152 12 years ago

doctorfoo11• 12 years ago

"Many women gamers and developers, as well as those who support them, have lately come under attack from online trolls"

Please don't whitewash the GamerGaters who have also experienced such attacks. (For example, one was "doxed" and mailed a knife with a suggestion to kill himself - which I'd argue a far worse "attack" than any online threats. The anti-GamerGate media of course doesn't report on this.)

lentil_soup• 12 years ago

What about a source for that?

doctorfoo11• 12 years ago

https://twitter.com/kingofpol/status/525755692318457856

Keywords "gamergate knife".

theorique3• 12 years ago

@nero (on twitter) was sent a syringe in the mail.

doctorfoo11• 12 years ago

I will optimistically assume I am being downvoted for off-topic rather than further whitewashed.

eli3• 12 years ago

I don't know what "whitewashed" means in this context, but you are definitely off topic and your comment reads like you are trying to justify some pretty terrible actions. The fact that other bad things happen to other people in no way excuses the bad things that happened to female game developers.

TeMPOraL4• 12 years ago

I guess you are (though I personally didn't); this topic is totally politicized and leads to long and unproductive threads.

sp3322• 12 years ago

It's just an example, not an exhaustive list.

icebraining• 12 years ago

Where in that sentence are "GamerGaters" excluded?

doctorfoo11• 12 years ago

They are excluded by omission. The words "come under attack from online trolls" link to a further article that paints all GGs as the very devils themselves.

blauwbilgorgel• 12 years ago

Just because a data aggregation site does not show your data on the front-end, does not mean they deleted it from the back-end. So now you can charge 50$ for people to search in the "special" data pile, where people took the effort to remove it from the front-end.

These data brokers crawl publicly available information. Telling them to remove your data, only slows down the doxxer, it does not stop them at all, since the data was already shared. It is not plugging the leak, it is mopping up some of the water. A false sense of security and a clear sign to the doxxer that you care about your anonymity (so more "lulz" to be had).

A proper doxxing is also much more than entering a name in some search engines. Especially hackers do not like to be doxxed. For internet civilians who already put this data out there (on social media) a simple data broker doxxing is a mere reminder that such data is public to everyone, not just friends.

Doxxing defense is guarding your anonymity online. Everywhere. Doxxing defense is knowing when to change persona's, and when to log off. That is: If you care about it at all. If you care about keeping your identity a secret online, see: https://www.youtube.com/watch?v=9XaYdCdwiWU (The Grugq - OPSEC: Because Jail is for wuftpd).

sp3322• 12 years ago

Slides from that talk: http://www.slideshare.net/grugq/opsec-for-hackers

Edit: and discussion https://news.ycombinator.com/item?id=5729860

niels_olson• 12 years ago

Yeah, this isn't even mopping up water. This is exerting effort to lie only to yourself. The emperor has no clothes and the emperor is you.

joe_the_user• 12 years ago

Yeah,

The simplest defense is to completely separate any online persona from your "real" offline persona. Obviously, how separate you make them has to be proportionate to many enemies you expect.

But you are an actual public person who is public with their real name, I do not envy you.

hackuser3• 12 years ago

Just because a data aggregation site does not show your data on the front-end, does not mean they deleted it from the back-end. So now you can charge 50$ for people to search in the "special" data pile

Do you have evidence of aggregators doing this? It's plausible, but I haven't heard about it happening.

Telling them to remove your data, only slows down the doxxer, it does not stop them at all

I think you have a good point overall but let's not dismiss the solution in the ComputerWorld article, which is valuable. All security solutions do the same thing: They increase the attacker's costs, which stops attackers unwilling to pay the price. There is no perfect security.

For example, we tell users to use strong passwords on their Windows logons, but that only raises the cost of an attack and does not completely secure the machine.

rl32• 12 years ago

The fact most of these sites even have opt-out mechanisms, and that they're apparently effective, is surprising and quite nice.

Though, I suspect this became the case out of necessity as a result of horror stories and litigation.

theorique3• 12 years ago

How trustworthy are those mechanisms though? I'm rather skeptical of the "guarantee" of a business whose model is to aggregate huge amounts of "dirt" and let people pay to suppress it.

300bps• 12 years ago

The fact most of these sites even have opt-out mechanisms, and that they're apparently effective,

My last name is one that fewer than 20 people in the world have. So doxxing protection and name management in general is very important to me. A few years ago I took about a day and had myself removed from everywhere I could find. Far more comprehensive than this article.

In the three years since, I've slowly been added back to all of them. I haven't moved, I haven't added or subtracted phone numbers, I've made no life changes. It just seems like these data brokers remove your information when you ask and then for whatever reason just add it back again. One example: whitepages.com. I was removed from there about two years and then suddenly my name and address are back again. That's just one example that leads me to believe the opt-out at these data brokers is "temporarily effective" at best.

rl32• 12 years ago

Seems like doing it on a persistent basis is required then, regardless. Admittedly it's a sad state of affairs, but it beats nothing.

thinkling• 12 years ago

I only looked at Spokeo, the first site on the list in the article. To opt out, you have to give Spokeo your email address, they send you a link, and you click the link to be delisted.

Why does Spokeo make it so easy?

The only answer I can think of is that they now have your email address and value that. Draw your own conclusions...

ForHackernews• 12 years ago

I used a fake email address.

wpietri6• 12 years ago

Wow. This is an app just waiting to be built. I would definitely subscribe to a service like this. And I would happily give money to a nonprofit who provides this as a free service for women in tech. Developers, start your IDEs!

muyuu3• 12 years ago

Why not men too?

psykovsky• 12 years ago

Because men.

wpietri6• 12 years ago

This response grates a little. It's so common that it's widely discussed and parodied. E.g.:

http://finallyfeminism101.wordpress.com/2007/10/18/phmt-argu...

http://www.robot-hugs.com/but-men/

And it's closely related to the "not all men" line, equally mocked:

http://www.listen-tome.com/save-me/

http://imgur.com/gallery/z5AYz66

But assuming that you are sincere and just unaware of the context: The reason that I personally would offer to fund this service for women in tech is that diversity in tech is an issue I have been working on for a while. Even though women are a relatively small proportion of the field, those women are a disproportionately large share of those getting abused with things like doxxing. I don't like that and want it to stop.

It would be my hope that by offering it widely, it would enable more women to speak up both about tech and about their experience in tech. Which I in turn hope will promote a more diverse and inclusive field. Which I think is a good end in itself, but I also think that means better empathy for all sorts of users of tech, and therefore better products and less systemic waste.

Is that helpful?

theorique3• 12 years ago

Because patriarchy.

azitzer• 12 years ago

LifeLock is launching a free service to help with this exact problem. We're in Beta right now. You can request an invite here: https://privacy.lifelock.com and here's an article about it: http://www.bizjournals.com/phoenix/blog/techflash/2014/10/li...

a1a• 12 years ago

You should really consider making a non-js version of your website. The noscript googletagmanager iframe is not really screaming "we care about your privacy" either.

ryan-c• 12 years ago

Abine's DeleteMe[1] service will take care of removing you from these sites, though it's not cheap. They will keep re-checking and re-removing. I've been using it for a few years, and it seems to work pretty well. IIRC there was still one site that I had to call and deal with myself.

1. https://www.abine.com/deleteme/

ghayes3• 12 years ago

I would also add Safe Shepherd [0]. We remove your information from the standard data brokers, and also give you guides on how to remove yourself from a large universe of sites yourself. Message me if you have any questions.

Edit: The service costs $13.95/mo, but you can get started with a 10-day free trial where we'll kick off all of the removals. You can (fully) delete your account at any time if you'd like.

[0] https://www.safeshepherd.com/

tempVariable• 12 years ago

Dude, there is absolutely no mention of price, cost , whether it's FREE or NOT anywhere on that site, before I give you my information, and that includes the terms of service copy. I looked and the only headline in the ToS that kind of address it is "You have to pay us in order to use some of our Products". If that is a base-case you start with for new customers, then thanks but no thanks.

tilsammans• 12 years ago

Thanks for adding the price info to your post. Should probably be on the site too. :-) is your service open for non-US people? And will it be useful?

blacksmith_tb• 12 years ago

Question - I can see the value of a service that automates all these removal requests. That said, the monthly subscription model seems a bit excessive, as I assume data would creep back in gradually. I would think quarterly, or even annually resubmitting them all would be adequate. No?

Someone12344• 12 years ago

The US really needs something akin to the EU's Data Protection Directive[0].

I've seen tons of businesses hide some tiny clause in their T&Cs (page 30, subsection 15, paragraph 11, etc) which allows them to resell your data to whoever will pay. For example the National Geographic Store sold my personal data when I purchased something from them (even with no check-box opt out, etc during checkout), and I've been receiving girly catalogues and credit card applicaton snail mail ever since (with a glaring typo which points right to National Geo's store).

I don't really see that happening (the US getting better data protections) as the US constitution is being largely used to protect business's "freedom [to do whatever the hell they want]" rather than individuals/people as was intended.

I was really hopeful that when the blackmail criminal-record racket started that that might finally result in substantial changes within the US, but nope. Nothing has changed and the blackmailers still operate.

[0] https://en.wikipedia.org/wiki/Data_Protection_Directive

giarc2• 12 years ago

I know you can enter email addresses as x+y@example.com where x=your regular email and y=some word/phrase to indicate who might have sold your email.

For example, if you register bill+NG@example.com with national geographic, and you find yourself getting to: bill+NG@example.com from spam, you know who sold your info. My question is, do you think companies know this trick and just remove the portion following the "+"?

marco1• 12 years ago

That does only work with Gmail, doesn't it? I don't think this is that widespread yet, so few companies (if any) will remove the part after the plus.

stormbrew• 12 years ago

There's nothing special about + as far as email in general is concerned, that's just a convention some mail servers (such as gmail) use. Any server using qmail, for example, uses '-' for the same purpose, but + can be part of a full name there.

While cutting out the + might still get your mail to gmail users, there's no guarantee it would for anyone else. I don't really think the people doing the spamming care, and they'd rather it arrive in an account at all than burn their sources.

riquito• 12 years ago

Spam companies knows it but don't really care I suppose, it's not their problem. Your problem is that if you forget the password you must remember if and how you personalized the e-mail address to reset it.

subsection1h• 12 years ago

if you register bill+NG@email.com

Please use the second level domain label example[1] when writing examples of email addresses. For all you know, you just posted someone's email address.

[1] http://en.wikipedia.org/wiki/Example.com

IshKebab• 12 years ago

Yeah you'd be surprised how many websites don't accept email addresses containing +.

dghughes• 12 years ago

We had a meeting about privacy at work and the presenter told a story about his ISP who messed up his name when he signed up something like Roge rJones instead of Roger Jones. The ISP stated they do not sell customer information to 3rd parties.

Within a week after signing up he was getting spam and junk mail addressed to Mr. Roge rJones just copied and pasted right from the ISP customer database.

Indirectly in a way what you say to try, a unique identifier.

codezero3• 12 years ago

Personally I self host a domain that accepts anything@ and file it into a special inbox. This lets me give real addresses to specific sites and blacklist them as needed.

TallGuyShort• 12 years ago

Most of the time when I try to use this it just doesn't accept the email address. I've wondered if they sincerely don't think that's a valid email address or if they're intentionally thwarting that strategy.

ciupicri• 12 years ago

That doesn't work with Yahoo! Mail.

ghaff• 12 years ago

Note that a lot of the information being discussed is public information in the US though. Companies aggregate this information--often for a fee--but it's public by law. To take just one example that struck a lot of people as surprising when it became a topic during the last US election, in many states it's a matter of public record whether you vote or not (not who you vote for but whether you vote). And there are many, many other examples.

Historically, uncovering this information would have meant spending many hours going through files at county or town clerks--which put a very real limit on how widely it would be used. Now much of it is digitized (and aggregated). So at least part of today's issue isn't so much that private information is being made public but that ostensibly public information is now such much easier to access and cross-reference.

rootlocus• 12 years ago

It's unfortunate that more and more services started blacklisting mailinator.

Symbiote• 12 years ago

Last week I have pointed a subdomain (x.example.net) to Mailinator.

I've only used it once so far, but I don't expect many sites to have made the effort to block it.

john_b• 12 years ago

Yes. We already have laws that protect a person's likeness by default. All that is necessary is to extend the concept to protecting personal information (of which a likeness is one example) by default. It probably won't happen until large numbers of Americans start valuing their personal information, however.

danudey• 12 years ago

The odd thing is that Canada's version of a data privacy act, PIPEDA, was enacted 14 years ago (2000) specifically so that people could trust private corporations with their data while e.g. shopping online [1].

In the end, the problem with these sorts of things is that once people are making millions doing something that should be illegal, they have the resources to ensure that it never becomes illegal.

[1] http://en.wikipedia.org/wiki/Personal_Information_Protection...

gear54rus• 12 years ago

The Internet never forgets. No app is going to change that because Internet is de-centralized and de-centralization makes it impossible to know if the data was really completely removed or not.

Let's face it: the only way to not expose your personal info is to not share it in the first place (forget silly Facebook, G+, Instagrams and all that stuff). If you've already done that, make sure that whatever you are doing that might lead to doxxing is done with your other identity (although this is hardly fool proof since linking identities can happen in many unexpected places). Worst of all is that that kind of infomation, once it slips, is impossible to contain and you have to cut ties and start over.

Relevant: http://en.wikipedia.org/wiki/Streisand_effect

munin• 12 years ago

this information gets populated without you sharing it. if you pay utility bills, rent, buy a house, appear in court, or other similar acts, those acts get stuck into online databases forever.

so to not "expose" your personal information is to not buy things and live in a tent. but be sure not to get arrested for trespassing or vagrancy...

hyperbovine• 12 years ago

Not relevant. I've never used social media a day in my life. Nevertheless, clicking a few links in this article turned up my full name, age, birthday, every address I've had since I was 14, email address, and convenient links to pages containing that same information for every member of my family. This is all obtained from public records over which you have literally no control if you lead any semblance of a normal life. There should be more legal protections in place to prevent using public data in this way.

csommers• 12 years ago

The issue at hand isn't really related to "silly" Facebook, or other "cultural" sites.

Unless you straight-up do NOT: own a home, rent, buy anything, go to school, etc. you will have some kind of available public record.

Yes, it's true that many people go beyond this with what they make available on social media and that's a definite issue. When people start "combining" excess social media posts, with "outside" known data...that's when you've got an issue. This usually results in people being able to EASILY dox someone due to the social side of things giving out information that is normally "protected"(think maiden name, previous locations, relationships, dob/location, etc.), all of which can be leveraged with public information to nearly total dox someone.

At the end of the day, we're in a new "age", where people will have to learn to protect their internet identity, as well as their "personal".

grecy5• 12 years ago

Rather than trying to make it harder for people to stalk/harass/intimidate others by hiding data, why don't we get tough with laws and sentencing?

A 5 year jail stint for the next 10 idiots to pull this stunt will reduce the incident rate of this happening a lot faster.

angersock2• 12 years ago

Yes, indeed, that's what we need--5 year prison sentences for exercising 1st amendment rights. Preventing the creation of these databases? No, far too difficult to enforce...instead, let's go after the uppity little guys.

You've suggested a remarkably short-sighted solution to a very thorny problem.

grecy5• 12 years ago

You're telling me it's my first amendment right to mail a knife to your home address and suggest you kill yourself?

Someone12344• 12 years ago

The first amendment doesn't protect criminal activity.

Someone12344• 12 years ago

Because the drug war proved that that method was ineffective and worse actually further criminalised individuals.

frtab• 12 years ago

There's no significant link between prison sentences and crime rates.

If there was, Norway would have a high crime rate and the US would have a low crime rate.

gpvos• 12 years ago

In that case, maybe there is a link, it's just the other way round...

eplanit2• 12 years ago

A bit of a broadly brushed analysis. This assumes all other variables/characteristics are equal: economic, social, political, etc.

jonahx• 12 years ago

Your first point may be true, but the US/Norway example is not good evidence for it. There are significant other confounding factors -- relative homogeneity of the population, economic differences, population size, cultural history are just a handful that spring to mind.

seanp2k2• 12 years ago

Because it interferes with what the government deems legitimate business practice -- collecting and selling your info. Maybe some day, the NSA will also open some data taps for those with deep enough pockets. For now though, they're not competing, so let them live.

SapphireSun• 12 years ago

From what I've heard, most people when committing a crime don't evaluate the expected value of the harshness of punishment, merely whether there will be a substantial punishment at all. So long as you're attempting to use prison to deter crime, it argues for relatively light sentences. If you're trying to simply remove offenders from circulation, that's a different question. It won't really help them improve their character much though if the sentence is too harsh.

EDIT: A well publicised message of "if you do this we will catch you" and a well publicised conviction would help though mostly regardless of the length of sentence. Very few people find going to jail at all an acceptable outcome.

eplanit2• 12 years ago

It's very unusual and ironic to find an argument _for_ punitive incarceration here on HN, which is more typically a bastion of anti-incarceration advocacy. I guess it depends on where societies' and governments' fears lie (the more representative the gov't is the more these fears overlap).

ams6110• 12 years ago

The ususal stance is against punitive incarceration for crimes like drug posession and maybe even sex trade activities. Crimes where someone is actually harmed? I don't think you see a lot of arguments againts punishment for those.

Torgo• 12 years ago

why don't we get tough with laws and sentencing?

The utter inevitability of misuse and overuse of it. England has set a great example for why I never want that kind of speech enforcement here.

ceejayoz3• 12 years ago

A 5 year jail stint for the next 10 idiots to pull this stunt will reduce the incident rate of this happening a lot faster.

Copyright infringement comes with the potential for multi-million dollar fines, but that hasn't put much of a dent in it. Why would it be different here?

cowsandmilk• 12 years ago

There are plenty of sources of information where you cannot opt out.

If you own property in Massachusetts, I can find it using http://www.masslandrecords.com , you can't opt out of that.

hackuser3• 12 years ago

The electricity provider here requires the use of 'smart meters' (that is, if you want to use their electricity). Via smart meters, they can identify what electrical appliances are used in your house and when (and possibly even how you are using them, such as what TV show you are watching), giving them a good picture of everything that goes on in the privacy of your home.[1]

There is no opt-out. They have this information on everyone in the state.

[1] This is not at all a fringe theory. It's been discussed on HN at least a few times.

cthalupa• 12 years ago

(and possibly even how you are using them, such as what TV show you are watching)

This seems hard to implement, realistically. I know the theory behind it - they can determine how much power a scene takes to show on a TV. But this is going to fluctuate depending on the brand of TV, the model, and so on. They would need to have data for each scene for each different unique type of TV set, and that just doesn't really seem all that feasible, if you ask me.

jn12343• 12 years ago

Except is that information public? That information actually has an extremely legitimate use, which is to better manage peak grid usage and how to optimize that.

judk• 12 years ago

Install a capacitor to smooth out the signal.

Watch the Adult Swim SmartPipe infomercial for another take.

jn12343• 12 years ago

The best hack to get around this is to create a holding company, so then that holding company name appears. However, in most property records also include an address to where the yearly property tax bill is sent.

peterwwillis• 12 years ago

I don't think this is an effective defense.

First of all, doxing works the same way private investigators do, so they do not require one-stop-shopping data banks. Social engineering and public records searches usually give you everything you need and are free. Second, if you're coming from the standpoint of a feminist decrying the ails of an oppressive society, you are pissing people off that will be motivated in attacking you; they aren't going to back off just because your information didn't show up on PeopleFinder.

IMO, the only defense against doxing is to dox yourself. Doxing is just a form of intimidation, after all, usually done by people who think publicizing some "secret information" will be taken as a vague threat. Make the information public and you remove their ammunition.

To me, the best defense against a troll is being completely nonchalant and not giving a shit what they do. Hacked my accounts? Oh well, it's just an account, i'll make another. Sent me death threats? Hey, life is short and we all die some time. The more you show your attackers that you will not be bothered, the more they realize they are powerless to harass you. That combined with reducing one's online footprint in general will break down their motivation and move them to other avenues for venting hate and frustration.

shadowfox• 12 years ago

IMO, the only defense against doxing is to dox yourself. Doxing is just a form of intimidation, after all, usually done by people who think publicizing some "secret information" will be taken as a vague threat. Make the information public and you remove their ammunition.
To me, the best defense against a troll is being completely nonchalant and not giving a shit what they do. Hacked my accounts? Oh well, it's just an account, i'll make another. Sent me death threats? Hey, life is short and we all die some time.

I am clearly a little less nonchalant than you. But I don't feel all that inclined to publicly post my home address or my kid's school address or scout camp location.

spindritf• 12 years ago

The threats of violence are usually empty posturing but there are other serious risks associated with speaking out online under your real name. In the US you can get "swatted"[1], which is an evil twist on usual pizza pranks. It's not far from that to getting shot (or having your dog shot).

Then there are basic SEO threats to your good name. And the old "taking information out of the Internet is like taking piss out of a pool." Whether the information is true or not.

I don't think this is an appropriate defence though. Sticking to usual good practices of not conflating anonymous personas with your real identity, using a PO box and proxy services (whether for domain registrations or actual network proxies) will be more productive. Not good enough when evading FBI but probably more than fine otherwise.

[1] https://en.wikipedia.org/wiki/Swatting

michaelochurch2• 12 years ago

What creeps me out is that there are now salary databases that people can use to see someone's prior salary history, job titles, and (in some cases) details of separation. It shouldn't be legal for those to exist, nor for companies to use them.

I actually checked myself in one ("The Work Number") in 2012 and it had an accurate title and salary history, which I hadn't made public. Scary, creepy stuff going on. How the fuck are they able to know that?

ci5er• 12 years ago

How the fuck are they able to know that?

This is a good question, that I'd like to see answered too -- if anyone here knows.

On a related (only to me) note: Is there any way that I can set a watcher on your comment to notify me if there is a response to it?

ilamont• 12 years ago

It looks like it's part of Equifax, which also does credit reports -- they already have name, address, social, etc. Not sure how they would get the salary info, though, unless the company or the IRS disclosed it.

ben010783• 12 years ago

I'm just guessing, but they could be using info that was obtained when a user was trying to get a loan. Typically, your info is sent to multiple lenders so you can get the best rate. Somebody could be collecting the info somewhere along the line.

wl2• 12 years ago

If you have information in The Work Number, it means your employer gave it to them. Employers do this because it allows them to outsource income verification.

I know of no way to opt out of it other than quitting. Also, while income information can only be accessed if you consent, collection agencies can get accounts that allow them to see the home address you have on file with them.

michaelochurch2• 12 years ago

So are you saying that companies can't get income information on, say, prospective job candidates?

devindotcom• 12 years ago

There are a LOT more data brokers than listed here, though it's a decent list to start with. These are small fry in the scheme of things though. You can start working your way through this one if you're really concerned:

http://www.worldprivacyforum.org/2013/12/data-brokers-opt-ou...

pasbesoin• 12 years ago

People who can afford to are going to begin hiding behind shell corporations. Houses, other assets, etc. will be corporate-owned, with suitable non-descriptive names and corporate addresses.

In fact, this is already occurring, although a prime driver has been a form of trust that reduces taxes particularly inheritance taxes.

I'm not familiar with what e.g. Hollywood celebrities do, but at a guess many of them are likely also doing something similar.

Need to restrict access? Introduce a layer of indirection.

gcb0• 12 years ago

agreed. most of the data those companies had on my name were from utilities, insurance, etc.

and most of them aggregated people with my common name in several states.

they had a lot of info, but also a lot of wrong info. all mixed together. i send removals for all entries, mine and otherwise :)

legohead• 12 years ago

If any of your personal info is on the internet, it has already been saved where you cannot remove it. This is a personal conundrum I have been trying to wrap my head around, especially as it relates to pictures of my kids I'd like to keep offline (but other people take pictures of them and upload them, and it's too late at that point...)

A company I'm familiar with was attacked by a blackhat. He sent the company owner all his personal information including SSN, address, etc. It scared the owner enough to pay off the blackhat, but he also asked the blackhat how he got his information. The blackhat sent the owner a website that you can go to, pay around $4 in bitcoin, and search for anyone's information.

Joona• 12 years ago

I think just using a nickname (instead of your own name) and not sharing addresses etc is the best way to go.

Lirik (a big Twitch streamer) chooses to only use his online alias, and although it's a common question what his real name (or other details) are, no one really has an answer. You just have to put some effort to not leaking information from registrations to sites (and such).

r00fus• 12 years ago

This is useless. The only way to defeat mass collection is to poison the well. I always put some fake data wherever it's not legally required. The only issue is where it is required and that is the root of the problem - why is it required in so many places?

Doxxing defense: Remove your personal info from data brokers

Related Stories