13 ms·

Note that since the issue is GDPR compliance, this should only be a problem for registrants who are natural persons. So if Whois data were only collected and pu

Note that since the issue is GDPR compliance, this should only be a problem for registrants who are natural persons. So if Whois data were only collected and published for corporations, there shouldn't be a problem. I always felt uncomfortable having to submit my personal data, specifically: my address and phone number, and for it to be published like that (regarding domains where Whois protection services are not allowed). I can understand the motivation for this with regards to corporations and organizations, but what benefit is there with regards to natural persons?

chopin 9y ago
To have IP lawyers go after you. Of course there are no benefits and only downsides for natural persons. I have little sympathy for ICANN with this. Malevolent persons can always go to registrars which do not publish personal information and even accept anonymous registration. The current policy harms only lawful citizens.
- _o_ 9y ago
  The whois record was highly annoying I and i was getting spam at given email address (which was never posted anywhere else). I dont care what ICANN thinks about whois, it is annoying and it is great if it will go away.
  - jacquesm 9y ago
    The spam won't go away. Once your address is out there it will stay out there (unless you change your email address). Those email lists only tend to get longer, never shorter, I still see spam sent to addresses I haven't used in years (and backlink spam requests for websites that haven't been alive since the 90's!).
    - _o_ 9y ago
      I will just kill the email address. Due to the tracking on internet I am using a customized email address for each site where I register to (for example sha1(news.ycombinator.com-secret)@mydomain.com) while my personal address is never used on any website so my antispam quest is quite simple :) You send spam, you are redirected to /dev/null As a side effect, I know when my address is sold to anyone and by which site, I am already sharpening my papers, after 25. of May, every website that will give away my address is going to get serious papercut.
      - sjtgraham 9y ago
        How can you prove a data controller gave away your information and that you didn’t falsely do it yourself?
        mschuster91 9y ago
        The burden of proving the provenance of the data relies on the data controller. Unless the data controller wants to pay a high fine, he has to prove where he got the data, and how/when/where the data owner agreed that the data controller was allowed to use the data.
        sjtgraham 9y ago
        Have you read the GDPR?
      - GCU-Empiricist 9y ago
        Can you please post a blog guide on administering these paper-cuts.
captainmuon 9y ago
And the ridiculous thing is that European* law mandates that you have an "impressum" on all but the most basic sites. You can hide your personal adress in the WHOIS info by putting a neutral third party. The registry I use, inwx.de, offers this service for a few euros. But you cannot (easily) hide your identity in the impressum - you might be able to use a shell company or find a natural person willing to put their name there, but it is much harder. How can they claim "data protection" in one case and make it mandatory to put your name and phone number their in another? It makes me very uncomfortable to host a website, when I know I will get spam, unwanted telefone calls, maybe even unwanted visits at my home, etc.. And it deters me from posting something even a bit controversial on my own domain - this is probably an intended side-effect of the "impressum" policy. (* well, German law, but there is likely something similar in other countries)
- detaro 9y ago
  If I'm not mistaken, businesses are EU-wide required to have contact data on their pages. And German courts tend to use a very wide definition of commerce – the best compromise is probably to keep commerce and private opinion on strictly separated domains, even if that means no advertising income from the private page.
  - krageon 9y ago
    "contact data" is already a pretty nebulous term. If my experience with European business websites is anything to go by, this is not the sort of requirement that the GP is talking about.
    - detaro 9y ago
      I said "contact data" as shorthand for the specific requirements, since I would have to look them up. And yes, the "Impressumpflicht" the parent talks about is exactly that, in a very strict form. EDIT: To elaborate, the EU e-commerce directive from 2000 requires all member states to have laws that require commercial sites to have at least name of the entity, physical mailing address, business registration IDs if applicable, e-mail and VAT ID published. Since it's only a directive, the details vary from country to country. E.g. France requires also listing a phone number and an actual person responsible for site content.
walshemj 9y ago
But in Germany by law all websites must publish information about the publisher, including their name and address, telephone number or e-mail address, trade registry number, VAT number, and other information depending on the type of company. all this seems fine according to eu law so I am not sure why dns registration is any diferent
- kuschku 9y ago
  Because you publish yourself, you can change it yourself, and you can take it down again yourself. And as a reminder, the German rule only applies to commercial sites — a site with no ads and no way to pay such as quasseldroid.info does not need an Imprint.
  - dx034 9y ago
    Unless you provide journalistic content. Then you could be required to have an imprint as well. I was always wondering if they overturn this at some point. I don't know of any other country requiring it and I doubt that it helps taking down illicit content. If anything, it helps consultants for offshore companies.
    - cJ0th 9y ago
      I hate this law with a passion. It doesn't seem proportionate to me at all. The main beneficiaries are folks who want to sell addresses in bulk and dodgy lawyers ("Abmahnanwälte"). I'd be fine with depositing my personal date somewhere so that people with legitimate concerns can contact me but it should require some effort so that the function can't be abused.
  - cJ0th 9y ago
    > And as a reminder, the German rule only applies to commercial sites — a site with no ads and no way to pay such as quasseldroid.info does not need an Imprint. I wouldn't be too sure. There is, unfortunately, a lot of room for interpretation with this law. Rather cautious adviser urge you to have one as long as your website isn't private in the sense that can't be accessed by the public (i.e. a website for family members that can only be accessed with a password). This law (IANAL) is just horrible.
peterwwillis 9y ago
> what benefit is there with regards to natural persons? [ tries to visit ckastner.com ] [ the website is down ] [ looks up Whois record for ckastner.com ] [ picks up phone, dials number ] "Hello, yes, Christian Kastner? Your website is down. Just thought you should know." That, and for the abuse address, and for dealing with technical issues between different sites, etc. You can use a Whois-hiding service to make it private yet still get the communications.
- detaro 9y ago
  The ICANN proposal preserves a way to contact the owner (via e-mail), so that's not impacted.
  - peterwwillis 9y ago
    If your website is down, your mail relay may be down, making e-mail unavailable. The phone is also a much better way to contact someone immediately, which you might want when your website is down.
    - jacquesm 9y ago
      If you rely on your visitors to phone you when your website is down you are doing something very wrong.
      - peterwwillis 9y ago
        Once I worked for a company where part of the website had been compromised by an attacker, and was being used to host some malware. We only found out when a random visitor found it, then looked through the site and found a random support address (which was supposed to be internal-only), and sent us an e-mail to tell us about it, which luckily generated a ticket which we eventually reviewed. We would have preferred someone called us immediately, in case we didn't see the ticket immediately. But we didn't have a security hotline publicly listed. Putting a phone number in a big public directory of phone numbers for when e-mail doesn't work isn't a bad idea, regardless of what anyone (including the EU) says. We've had phone books forever. This is just a phone book for domains.
Lunatic666 9y ago
Most of the whois hiding services cost money, so if I get this “service” for free now, I don’t have much sympathy with the whois guys. If it’s about contacting people, they could make the abuse@ or webmaster@ address mandatory, then you can separate it from your normal email accounts, because the majority will be spam anyway.
- amaccuish 9y ago
  Or offer an anonimiser service in place of your email, which just redirects to your actual email. Not everyone hosts email on their domain.
- nabc45 9y ago
  >Most of the whois hiding services cost money Where? I never paid a dime
  - nicky0 9y ago
    Godaddy
    - tazard 9y ago
      At least in Canada, this is absolutely not true. https://ca.godaddy.com/domainaddon/private-registration.aspx https://ca.godaddy.com/domainaddon/private-registration.aspx
      - tazard 9y ago
        Sorry, I thought you were replying to the, where it's free parent, not the where it's not free parent. Please ignore what I wrote earlier.
  - ry_ry 9y ago
    123reg charge for whois privacy too, as do a bunch of other registrars. Always felt like mild extortion.
  - 9y ago
merinowool 9y ago
What about company officer data that is personal information?
yummybear 9y ago
So nefarious entities would just have an employee or owner register the domains personally.
ams6110 9y ago
One's address is a matter of public record anyway, so I'm not too concerned about my address appearing in a WHOIS. Phone number, at worst you get some spam calls, but I don't answer numbers I don't recognize so it's of low concern.
- always_good 9y ago
  Lowering the bar of getting your name + address + phone number just lowers the bar for social engineering. It does you zero favors.
- Magnets 9y ago
  Personal addresses are not public record in the UK for the vast majority of people, and neither are phone numbers
  - ams6110 9y ago
    You don't have phone directories?
    - nocobot 9y ago
      In Germany you can choose to not be listed in those, I assume it's the same in the UK .
    - return1 9y ago
      you mean, in the US you can't opt out of them?
      - ghaff 9y ago
        When everyone had landlines, I believe you could get an unlisted number for a fee. Very few did AFAIK. There is no white pages for cellphones but I still get junk calls anyway.
    - Angostura 9y ago
      YOu can opt out and many people do (ex-directory)
Animats 9y ago
Whois info should be available for all businesses under EU law, under the European Directive on Electronic Commerce. In the EU, privacy is only for individuals. If you're in business, the commercial rules apply:[1] Member States shall ensure that the service provider shall render easily, directly and permanently accessible to the recipients of the service and competent authorities, at least the following information: (a) the name of the service provider, (b) the geographic address at which the service provider is established, (c) the details of the service provider, including his electronic mail address, which allow him to be contacted rapidly and communicated with in a direct and effective manner. A "service provider" is basically anyone with a commercial web site. See (17) and (18) in [1] for the detailed definition. [1] http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32000L0031:EN:HTML http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:...
roymckenzie 9y ago
"Corporations are people, my friend."
giobox 9y ago
One of the few practical uses of WHOIS data is basically so ICANN have an address on file for when someone wants to dispute your ownership of a domain on trademark grounds. Anyone who registers a gTLD is forced to submit to their private dispute resolution process (UDRP) as part of their agreement with their registrar. There’s literally no way to opt out unless you don’t want a gTLD, thanks to ICANN’s total control. There's also (very bad) precedent in the UDRP for using out of date or inaccurate WHOIS information as evidence of Registration/Use in bad faith. There's even been cases where a UDRP panelist has argued using WHOIS privacy services was prima facie evidence of bad faith, which beggars belief. http://www.udrpsearch.com/naf/1684372 http://www.udrpsearch.com/naf/1684372 "This Panel member is persuaded there is bad faith registration and use because of several factors. The first factor is using a privacy service in a commercial context raises a rebuttable presumption of bad faith. Respondent has done nothing to rebut that presumption. Respondent does not need to conceal its identity from the marketplace to be a domain name reseller. Respondent offers no explanation as to why Respondent concealed its identity (and conceals it to this very day). Only people with an intent to deceive conceal their identity, which is the very definition of bad faith. Since Respondent did this at the time of registration and through the present day, there was bad faith registration and use of the domain name." Thankfully other panel members dissented, but the UDRP has a long history of questionable reasoning and decision making, and bizarre WHOIS issues are not unheard of.

chopin 9y ago

To have IP lawyers go after you. Of course there are no benefits and only downsides for natural persons. I have little sympathy for ICANN with this. Malevolent persons can always go to registrars which do not publish personal information and even accept anonymous registration. The current policy harms only lawful citizens.

_o_ 9y ago
The whois record was highly annoying I and i was getting spam at given email address (which was never posted anywhere else). I dont care what ICANN thinks about whois, it is annoying and it is great if it will go away.
- jacquesm 9y ago
  The spam won't go away. Once your address is out there it will stay out there (unless you change your email address). Those email lists only tend to get longer, never shorter, I still see spam sent to addresses I haven't used in years (and backlink spam requests for websites that haven't been alive since the 90's!).
  - _o_ 9y ago
    I will just kill the email address. Due to the tracking on internet I am using a customized email address for each site where I register to (for example sha1(news.ycombinator.com-secret)@mydomain.com) while my personal address is never used on any website so my antispam quest is quite simple :) You send spam, you are redirected to /dev/null As a side effect, I know when my address is sold to anyone and by which site, I am already sharpening my papers, after 25. of May, every website that will give away my address is going to get serious papercut.
    - sjtgraham 9y ago
      How can you prove a data controller gave away your information and that you didn’t falsely do it yourself?
      - mschuster91 9y ago
        The burden of proving the provenance of the data relies on the data controller. Unless the data controller wants to pay a high fine, he has to prove where he got the data, and how/when/where the data owner agreed that the data controller was allowed to use the data.
        sjtgraham 9y ago
        Have you read the GDPR?
    - GCU-Empiricist 9y ago
      Can you please post a blog guide on administering these paper-cuts.

captainmuon 9y ago

And the ridiculous thing is that European* law mandates that you have an "impressum" on all but the most basic sites. You can hide your personal adress in the WHOIS info by putting a neutral third party. The registry I use, inwx.de, offers this service for a few euros. But you cannot (easily) hide your identity in the impressum - you might be able to use a shell company or find a natural person willing to put their name there, but it is much harder. How can they claim "data protection" in one case and make it mandatory to put your name and phone number their in another? It makes me very uncomfortable to host a website, when I know I will get spam, unwanted telefone calls, maybe even unwanted visits at my home, etc.. And it deters me from posting something even a bit controversial on my own domain - this is probably an intended side-effect of the "impressum" policy. (* well, German law, but there is likely something similar in other countries)

detaro 9y ago
If I'm not mistaken, businesses are EU-wide required to have contact data on their pages. And German courts tend to use a very wide definition of commerce – the best compromise is probably to keep commerce and private opinion on strictly separated domains, even if that means no advertising income from the private page.
- krageon 9y ago
  "contact data" is already a pretty nebulous term. If my experience with European business websites is anything to go by, this is not the sort of requirement that the GP is talking about.
  - detaro 9y ago
    I said "contact data" as shorthand for the specific requirements, since I would have to look them up. And yes, the "Impressumpflicht" the parent talks about is exactly that, in a very strict form. EDIT: To elaborate, the EU e-commerce directive from 2000 requires all member states to have laws that require commercial sites to have at least name of the entity, physical mailing address, business registration IDs if applicable, e-mail and VAT ID published. Since it's only a directive, the details vary from country to country. E.g. France requires also listing a phone number and an actual person responsible for site content.

walshemj 9y ago

But in Germany by law all websites must publish information about the publisher, including their name and address, telephone number or e-mail address, trade registry number, VAT number, and other information depending on the type of company. all this seems fine according to eu law so I am not sure why dns registration is any diferent

kuschku 9y ago
Because you publish yourself, you can change it yourself, and you can take it down again yourself. And as a reminder, the German rule only applies to commercial sites — a site with no ads and no way to pay such as quasseldroid.info does not need an Imprint.
- dx034 9y ago
  Unless you provide journalistic content. Then you could be required to have an imprint as well. I was always wondering if they overturn this at some point. I don't know of any other country requiring it and I doubt that it helps taking down illicit content. If anything, it helps consultants for offshore companies.
  - cJ0th 9y ago
    I hate this law with a passion. It doesn't seem proportionate to me at all. The main beneficiaries are folks who want to sell addresses in bulk and dodgy lawyers ("Abmahnanwälte"). I'd be fine with depositing my personal date somewhere so that people with legitimate concerns can contact me but it should require some effort so that the function can't be abused.
- cJ0th 9y ago
  > And as a reminder, the German rule only applies to commercial sites — a site with no ads and no way to pay such as quasseldroid.info does not need an Imprint. I wouldn't be too sure. There is, unfortunately, a lot of room for interpretation with this law. Rather cautious adviser urge you to have one as long as your website isn't private in the sense that can't be accessed by the public (i.e. a website for family members that can only be accessed with a password). This law (IANAL) is just horrible.

peterwwillis 9y ago

> what benefit is there with regards to natural persons? [ tries to visit ckastner.com ] [ the website is down ] [ looks up Whois record for ckastner.com ] [ picks up phone, dials number ] "Hello, yes, Christian Kastner? Your website is down. Just thought you should know." That, and for the abuse address, and for dealing with technical issues between different sites, etc. You can use a Whois-hiding service to make it private yet still get the communications.

detaro 9y ago
The ICANN proposal preserves a way to contact the owner (via e-mail), so that's not impacted.
- peterwwillis 9y ago
  If your website is down, your mail relay may be down, making e-mail unavailable. The phone is also a much better way to contact someone immediately, which you might want when your website is down.
  - jacquesm 9y ago
    If you rely on your visitors to phone you when your website is down you are doing something very wrong.
    - peterwwillis 9y ago
      Once I worked for a company where part of the website had been compromised by an attacker, and was being used to host some malware. We only found out when a random visitor found it, then looked through the site and found a random support address (which was supposed to be internal-only), and sent us an e-mail to tell us about it, which luckily generated a ticket which we eventually reviewed. We would have preferred someone called us immediately, in case we didn't see the ticket immediately. But we didn't have a security hotline publicly listed. Putting a phone number in a big public directory of phone numbers for when e-mail doesn't work isn't a bad idea, regardless of what anyone (including the EU) says. We've had phone books forever. This is just a phone book for domains.

Lunatic666 9y ago

Most of the whois hiding services cost money, so if I get this “service” for free now, I don’t have much sympathy with the whois guys. If it’s about contacting people, they could make the abuse@ or webmaster@ address mandatory, then you can separate it from your normal email accounts, because the majority will be spam anyway.

amaccuish 9y ago
Or offer an anonimiser service in place of your email, which just redirects to your actual email. Not everyone hosts email on their domain.
nabc45 9y ago
>Most of the whois hiding services cost money Where? I never paid a dime
- nicky0 9y ago
  Godaddy
  - tazard 9y ago
    At least in Canada, this is absolutely not true. https://ca.godaddy.com/domainaddon/private-registration.aspx https://ca.godaddy.com/domainaddon/private-registration.aspx
    - tazard 9y ago
      Sorry, I thought you were replying to the, where it's free parent, not the where it's not free parent. Please ignore what I wrote earlier.
- ry_ry 9y ago
  123reg charge for whois privacy too, as do a bunch of other registrars. Always felt like mild extortion.
- 9y ago

merinowool 9y ago

What about company officer data that is personal information?

yummybear 9y ago

So nefarious entities would just have an employee or owner register the domains personally.

ams6110 9y ago

One's address is a matter of public record anyway, so I'm not too concerned about my address appearing in a WHOIS. Phone number, at worst you get some spam calls, but I don't answer numbers I don't recognize so it's of low concern.

always_good 9y ago
Lowering the bar of getting your name + address + phone number just lowers the bar for social engineering. It does you zero favors.
Magnets 9y ago
Personal addresses are not public record in the UK for the vast majority of people, and neither are phone numbers
- ams6110 9y ago
  You don't have phone directories?
  - nocobot 9y ago
    In Germany you can choose to not be listed in those, I assume it's the same in the UK .
  - return1 9y ago
    you mean, in the US you can't opt out of them?
    - ghaff 9y ago
      When everyone had landlines, I believe you could get an unlisted number for a fee. Very few did AFAIK. There is no white pages for cellphones but I still get junk calls anyway.
  - Angostura 9y ago
    YOu can opt out and many people do (ex-directory)

Animats 9y ago

Whois info should be available for all businesses under EU law, under the European Directive on Electronic Commerce. In the EU, privacy is only for individuals. If you're in business, the commercial rules apply:[1] Member States shall ensure that the service provider shall render easily, directly and permanently accessible to the recipients of the service and competent authorities, at least the following information: (a) the name of the service provider, (b) the geographic address at which the service provider is established, (c) the details of the service provider, including his electronic mail address, which allow him to be contacted rapidly and communicated with in a direct and effective manner. A "service provider" is basically anyone with a commercial web site. See (17) and (18) in [1] for the detailed definition. [1] http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32000L0031:EN:HTML http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:...

roymckenzie 9y ago

"Corporations are people, my friend."

giobox 9y ago

One of the few practical uses of WHOIS data is basically so ICANN have an address on file for when someone wants to dispute your ownership of a domain on trademark grounds. Anyone who registers a gTLD is forced to submit to their private dispute resolution process (UDRP) as part of their agreement with their registrar. There’s literally no way to opt out unless you don’t want a gTLD, thanks to ICANN’s total control. There's also (very bad) precedent in the UDRP for using out of date or inaccurate WHOIS information as evidence of Registration/Use in bad faith. There's even been cases where a UDRP panelist has argued using WHOIS privacy services was prima facie evidence of bad faith, which beggars belief. http://www.udrpsearch.com/naf/1684372 http://www.udrpsearch.com/naf/1684372 "This Panel member is persuaded there is bad faith registration and use because of several factors. The first factor is using a privacy service in a commercial context raises a rebuttable presumption of bad faith. Respondent has done nothing to rebut that presumption. Respondent does not need to conceal its identity from the marketplace to be a domain name reseller. Respondent offers no explanation as to why Respondent concealed its identity (and conceals it to this very day). Only people with an intent to deceive conceal their identity, which is the very definition of bad faith. Since Respondent did this at the time of registration and through the present day, there was bad faith registration and use of the domain name." Thankfully other panel members dissented, but the UDRP has a long history of questionable reasoning and decision making, and bizarre WHOIS issues are not unheard of.