4 ms·

> The address exposure vulnerability is really, really bad I have the President of the United States' address. 1600 Pennsylvania Avenue. Oh no! I done dox'd hi

> The address exposure vulnerability is really, really bad I have the President of the United States' address. 1600 Pennsylvania Avenue. Oh no! I done dox'd him! Exposing information about someone that is largely already public is somewhat bad, but it's not "really, really bad". And it's certainly not worse than exposing the last 4 of their SSN. There are many ways to dox people. If you have a specific target, you probably know their name; if not, you can phish it, and any other information you want. If you have their IP, you know their ISP. With their name and their ISP, and maybe some extra info gleaned from various sources like social media, you can get pretty much anything you want. Account access, phone numbers, billing information, socials, etc. With their phone number you can take over their phone, and then all their SMS-linked accounts. Is this scary? Yes. Did I need to slowly extract their home address using a vendor's web form and their IP? No. The last 4 of the social is much worse. It makes all of this incredibly easy and gives access to much more sensitive information, like medical records, payroll, government service information, etc.

loeg 8y ago
Yeah. Homeowner in Seattle? http://gismaps.kingcounty.gov/parcelviewer2/ http://gismaps.kingcounty.gov/parcelviewer2/ has your address publically available, unless you made special plans to purchase with an LLC or something. (And you probably need to be sure your LLC's mailing address is a PO box as well.)
- golem14 8y ago
  That's beside the point. Resolving parcel numbers to owners is also problematic, likewise resolving license plate numbers to owners (used to be possible in Switzerland), but we're talking resolving IP addresses to owners. I wonder how many porn sites could blackmail viewers, or Honeypot mpaa operatos could sue torrent users more easily...
  - loeg 8y ago
    It sounds like you think we disagree, but we don't disagree. Parcel lookup is just an interesting public information database many people are unaware of — so I felt it was worth sharing.
  - lawl 8y ago
    > likewise resolving license plate numbers to owners (used to be possible in Switzerland) Still is, depending on the canton. For Zürich you get 5 lookups per day per IP[0]. For other cantons they might charge you a swiss franc or so [1]. Cantons that charge 10-20 CHF and require a reasoning for why you need this data are in the minority. [0] https://stva.zh.ch/internet/sicherheitsdirektion/stva/de/StVAfz/FZindex/FZeindex.html https://stva.zh.ch/internet/sicherheitsdirektion/stva/de/StV... [1] https://www.linker.ch/eigenlink/autonummern_index.htm https://www.linker.ch/eigenlink/autonummern_index.htm
  - SpaceManiac 8y ago
    "Honeypot mpaa operatos could sue torrent users more easily" Irrelevant, since Comcast already hands this information over to such parties willingly.
kibwen 8y ago
> I have the President of the United States' address. 1600 Pennsylvania Avenue. Oh no! I done dox'd him! If only we all had access to the Secret Service. Lots of modern games make use of P2P behind the scenes (e.g. for voice chat), which means that maladjusted script kiddie I just sniped already has my IP and might decide to forego DDoSing me and skip straight to calling in a hostage situation at my home address. Being able to easily resolve a concrete address from an IP is certainly a bigger deal than being able to determine its ISP.
- mcny 8y ago
  This is sad but exposed the actual problem: militarization of our police. Of course, that is a completely different problem. The last time I mentioned how disciplined our military was compared to seemingly trigger happy police though someone said quietly to let the military our of the barracks and live in my neighborhood as well as occupy public space everywhere within the country and my opinion will change within a few years. I suspect this is true. I don't have any solutions to this militarization, just wanted to point out that doxxing isn't there real problem but rather the swatting is.
  - mschuster91 8y ago
    > just wanted to point out that doxxing isn't there real problem but rather the swatting is. The problem is that SS7 still allows anyone and their dog to spoof phone numbers. Swatting will always work because a (real) hostage situation is among the worst things that can happen for police, the others being terrorist attacks and serial killers. Swatting can only be prevented reasonably by fixing telephony signalling and throwing the ones doing it into jail for a couple of years.
    - godelski 8y ago
      And just for the parent to your comment. > Swatting will always work Because ALSO most forces can't spend the money to train their police in hostage situations. It isn't just giving them big "toys" that they want to play with. It isn't that they aren't trained. It is that it is impractical to train them.
throwaway91241 8y ago
Strongly disagree here. > Exposing information about someone that is largely already public A home address may be public, but the connection between that address and online activity, like posts on reddit / HN / some forum (political? fetish/porn? extremist? etc etc), is very much not public. Last 4 of social is not uniquely identifiable, but a (partial) home address almost is. > If you have a specific target, you probably know their name Not if they're being careful, like anyone would be if they don't want their posts online mapped back to them. But now you can DM them a link (or email them an image if you have an email address or redirect) and turn their IP into a home address. That's very bad. Doxing someone isn't just exposing an arbitrary address, it's connecting a purportedly anonymous online account with personally identifying info. Going back to the president, what if you could find out that some angry anonymous person posting racial slurs online was actually the POTUS? That is doxing.
- zenexer 8y ago
  > Going back to the president, what if you could find out that some angry anonymous person posting racial slurs online was actually the POTUS? That is doxing. While I agree with your general sentiment, I hope you appreciate the irony of this particular example.
- peterwwillis 8y ago
  It's still not that difficult to trace an IP back to a person. Besides the private marketing databases you can tap into, geoip, crappy ISP support, DNS cache poisoning, phishing, consumer internet router hacking, web service hacking, and other attacks on an address space itself, there's attacks in a social space that give away much more. Saying this is a really bad vuln because you aren't as private as you think you are online is like saying lock picking is a really bad vuln because you didn't know door locks could be opened by anyone with a bent piece of metal or a shaved down key. Locks don't actually keep bad people out. They just make people feel safe. Same with this idea that your IP is anonymous. It's really not. It's a literal address.

loeg 8y ago

Yeah. Homeowner in Seattle? http://gismaps.kingcounty.gov/parcelviewer2/ http://gismaps.kingcounty.gov/parcelviewer2/ has your address publically available, unless you made special plans to purchase with an LLC or something. (And you probably need to be sure your LLC's mailing address is a PO box as well.)

golem14 8y ago
That's beside the point. Resolving parcel numbers to owners is also problematic, likewise resolving license plate numbers to owners (used to be possible in Switzerland), but we're talking resolving IP addresses to owners. I wonder how many porn sites could blackmail viewers, or Honeypot mpaa operatos could sue torrent users more easily...
- loeg 8y ago
  It sounds like you think we disagree, but we don't disagree. Parcel lookup is just an interesting public information database many people are unaware of — so I felt it was worth sharing.
- lawl 8y ago
  > likewise resolving license plate numbers to owners (used to be possible in Switzerland) Still is, depending on the canton. For Zürich you get 5 lookups per day per IP[0]. For other cantons they might charge you a swiss franc or so [1]. Cantons that charge 10-20 CHF and require a reasoning for why you need this data are in the minority. [0] https://stva.zh.ch/internet/sicherheitsdirektion/stva/de/StVAfz/FZindex/FZeindex.html https://stva.zh.ch/internet/sicherheitsdirektion/stva/de/StV... [1] https://www.linker.ch/eigenlink/autonummern_index.htm https://www.linker.ch/eigenlink/autonummern_index.htm
- SpaceManiac 8y ago
  "Honeypot mpaa operatos could sue torrent users more easily" Irrelevant, since Comcast already hands this information over to such parties willingly.

kibwen 8y ago

> I have the President of the United States' address. 1600 Pennsylvania Avenue. Oh no! I done dox'd him! If only we all had access to the Secret Service. Lots of modern games make use of P2P behind the scenes (e.g. for voice chat), which means that maladjusted script kiddie I just sniped already has my IP and might decide to forego DDoSing me and skip straight to calling in a hostage situation at my home address. Being able to easily resolve a concrete address from an IP is certainly a bigger deal than being able to determine its ISP.

mcny 8y ago
This is sad but exposed the actual problem: militarization of our police. Of course, that is a completely different problem. The last time I mentioned how disciplined our military was compared to seemingly trigger happy police though someone said quietly to let the military our of the barracks and live in my neighborhood as well as occupy public space everywhere within the country and my opinion will change within a few years. I suspect this is true. I don't have any solutions to this militarization, just wanted to point out that doxxing isn't there real problem but rather the swatting is.
- mschuster91 8y ago
  > just wanted to point out that doxxing isn't there real problem but rather the swatting is. The problem is that SS7 still allows anyone and their dog to spoof phone numbers. Swatting will always work because a (real) hostage situation is among the worst things that can happen for police, the others being terrorist attacks and serial killers. Swatting can only be prevented reasonably by fixing telephony signalling and throwing the ones doing it into jail for a couple of years.
  - godelski 8y ago
    And just for the parent to your comment. > Swatting will always work Because ALSO most forces can't spend the money to train their police in hostage situations. It isn't just giving them big "toys" that they want to play with. It isn't that they aren't trained. It is that it is impractical to train them.

throwaway91241 8y ago

Strongly disagree here. > Exposing information about someone that is largely already public A home address may be public, but the connection between that address and online activity, like posts on reddit / HN / some forum (political? fetish/porn? extremist? etc etc), is very much not public. Last 4 of social is not uniquely identifiable, but a (partial) home address almost is. > If you have a specific target, you probably know their name Not if they're being careful, like anyone would be if they don't want their posts online mapped back to them. But now you can DM them a link (or email them an image if you have an email address or redirect) and turn their IP into a home address. That's very bad. Doxing someone isn't just exposing an arbitrary address, it's connecting a purportedly anonymous online account with personally identifying info. Going back to the president, what if you could find out that some angry anonymous person posting racial slurs online was actually the POTUS? That is doxing.

zenexer 8y ago
> Going back to the president, what if you could find out that some angry anonymous person posting racial slurs online was actually the POTUS? That is doxing. While I agree with your general sentiment, I hope you appreciate the irony of this particular example.
peterwwillis 8y ago
It's still not that difficult to trace an IP back to a person. Besides the private marketing databases you can tap into, geoip, crappy ISP support, DNS cache poisoning, phishing, consumer internet router hacking, web service hacking, and other attacks on an address space itself, there's attacks in a social space that give away much more. Saying this is a really bad vuln because you aren't as private as you think you are online is like saying lock picking is a really bad vuln because you didn't know door locks could be opened by anyone with a bent piece of metal or a shaved down key. Locks don't actually keep bad people out. They just make people feel safe. Same with this idea that your IP is anonymous. It's really not. It's a literal address.