11 ms·

Privacy activists oppose EU plans for a GDPR-compliant Whois v2

154 points by upofadown 5y ago

hyproxia 5y ago
As someone who wants to maintain his own blog: This is pretty concerning. Why should I need to publish my address for all to see in order to make a blog? And yes, I know that blogging platforms exist, but I don't want to rely on them. It kinda makes me wonder if this is a push towards further centralization on the web.
- 2Gkashmiri 5y ago
  i dont quite unerstand this. does this imply we are forced to give out our verifiable home address? i remember buying domains and just putting "001, abc street, 892032, india" in the fields. is this forcing me to change that to my home address?
- pluc 5y ago
  Because there's a box labeled 'address' doesn't mean you should put your address in there.
  - meowface 5y ago
    My understanding is this would make it illegal to not put your real address there. You can willingly break the law, but that'll create other issues for you.
    - travoc 5y ago
      My address is a mailbox store in Missouri.
      - mandelbrotwurst 5y ago
        Mailing addresses that are not your physical address may be a decent workaround, but should that even be necessary?
      - ISL 5y ago
        When opening a mailbox, I had to provide ID and a notarized signature.
    - ALittleLight 5y ago
      As someone who doesn't live in the EU why should I concern myself with their laws? It sounds bad, but I won't obey it.
      - SturgeonsLaw 5y ago
        The registrar is subject to EU law, so they could be forced to limit or remove your access to your domain
      - 3np 5y ago
        This proposal is regarding EU TLD registrars. Country TLDs in the EU (.de, .fr, .se etc) already require you to be an EU resident. So you wouldn't be subject to these rules as you're not entitled to hold one of those domains.
        jeltz 5y ago
        You are wrong about at least .se. You do not need to be sn EU resident to own a .se domain.
    - jobigoud 5y ago
      But will you also need to update it when you move?
- iratewizard 5y ago
  What's left of the old web may just have to move behind subdomains so only one person gives up their privacy. I'm glad I bought a 5 letter url for a project like that.
- SiempreViernes 5y ago
  Because you're supposed to be responsible for what you publish? Or as quoted in the article itself: > For those that say this is a hit to privacy: this operates the same way it would if you were buying property anywhere else. Yes, it's digital property, but you should have to be responsible for that permissive SPF record allowing relay of malware spam in the same way you have to be responsive when there's a gas leak on physical property. In any case, self hosting a blog seems like a pretty weird step if what you're after is good anonymity.
  - hyproxia 5y ago
    >In any case, self hosting a blog seems like a pretty weird step if what you're after is good anonymity. I'm not after anonymity, I just don't want my address and phone number to be easily available to every nutcase out there.
    - deleted 5y ago
      [deleted]
  - smnrchrds 5y ago
    There is a world of difference between being Satoshi level of anonymous and being an open book for anyone on planet earth to try to SWAT.
- matheusmoreira 5y ago
  Maybe if the web becomes bad enough people will start using onion hidden services for everything instead. Why not publish blogs that way? It even allows you to be anonymous.
  - hyproxia 5y ago
    >Why not publish blogs that way? Because onion sites are slower, harder to access, not easily searchable, and not easily protected against DDoS attacks.
    - travoc 5y ago
      Most of these things were once said about sites that used SSL.
      - sigstoat 5y ago
        > Most of these things were once said about sites that used SSL. in the sense that every possible thing has been said about everything, sure. and to a slightly greater extent maybe they were said about trying to SSL-ify _everything_. but "gee maybe shouldn't SSL-ify sites handling sensitive data" has never been a serious talking point.
      - amadeuspagel 5y ago
        The speed of light is a hard limit on improving the performance of onion sites. Having your requests routed through six (edit: random) servers is always going to be slow.
        cassonmars 5y ago
        Your traffic is certainly going over more than six links to get to you today, the only difference is clearnet traffic direction is organized for efficiency. TOR has inefficiency baked into the design for the purpose of privacy.
        5y ago
- charcircuit 5y ago
  Because sometimes people need to contact you and mail is one such way to send a message.
  - mandelbrotwurst 5y ago
    What’s wrong with e-mail?
    - charcircuit 5y ago
      Some people don't check their email so a physical letter can be used as a backup.
      - short12 5y ago
        Some people don't check their mail either
        jobigoud 5y ago
        But you can send a letter with proof of reception so at least they know if you received it or not.
  - smnrchrds 5y ago
    In Canada, if a copyright holder notices you are downloading something they own the rights to, e.g. because you are using torrent, they cannot ask the ISP for your name or address. The only recourse they have, short of going through the expensive and lengthy court process, is that they can give the ISP a note which they are legally required to forward to the client. It's a simple system. Your privacy remains preserved and you get the messages too. Why not mandate an email forwarding service by registrars if that's what they are after?
- lunatuna 5y ago
  The article doesn’t state that it will be published. It states that the registrar must have it. The Pirate Party member, as mentioned in the article, didn’t read the proposal.
  - nerdponx 5y ago
    That's one subpoena or warrant away from it being published to people who you don't want to have it.
    - ALittleLight 5y ago
      Or hack, misconfiguration, data leak, insider, etc.
    - wmf 5y ago
      Like real estate and vehicles, domain registrations probably shouldn't be too private by default.
    - PeterisP 5y ago
      That's a bit separate from the notion of privacy - warantless searches violate privacy, but there is (nor should be) any expectation of privacy given a valid warrant; valid warrants is the scenario where we the people have decided (and written in our laws and constitutions) that you should not be able to keep things hidden.
- dathinab 5y ago
  To quote the quote this is about: > "Member States shall ensure that the TLD registries and the entities providing domain name registration services for the TLD publish, without undue delay after the registration of a domain name, domain registration data which are not personal data." Your address is personal data, so is email, phone number, more or less any contact information etc. So what is not personal data? Mainly thinks like that the domain had been registered through godaddy, i.e. thinks a police agency needs to know, to know where to go with a curt order for actual private information. Also interesting: It's for the TLD, I wonder if they have a clear definition of it, or else .co.uk and similar would no longer be covered (not that it matters anymore). But what definitely should not be covered are sub-domain registrars. Through I haven't read the draft of the directive, so I can't tell you if there are some uncanny effects between article 23 and other articles.
pmlnr 5y ago
When I registered my first domains in Hungary I had to send the registrars a copy of my national ID. Apparently the process was ahead of it's time /s
bserge 5y ago
Maybe I'm too tired, but wtf is this article even talking about. You can lose your domain if your data is not accurate/real. Registrars have also been offering proxy contact services for a long time now. Authorities, of course, can get the real info.
- unicornporn 5y ago
  > The EU is currently drafting legislation to increase cyber security (revised NIS Directive, in short “NIS 2”). According to this directive, the registration of internet domain names will in future require the correct identification of the owner in the Whois database, including name, address and telephone number. So far, registries such as denic do not register telephone numbers of the holders. The leading Industry Committee wants to additionally mandate „verification“ of the registration data. The plans could mean the end of “whois privacy” services for proxy registration of domains, threatening the safety of activists and whistleblowers.[1] [1] https://www.patrick-breyer.de/en/cybersecurity-eu-to-ban-anonymous-websites/ https://www.patrick-breyer.de/en/cybersecurity-eu-to-ban-ano...
  - Springtime 5y ago
    Proxy registration referred to in that quote isn't what Whois privacy generally refers to though, no? When I've seen it used by typical registrars it has meant that the owner's details aren't disclosed on public Whois lookups but are still required to be correct.
  - yjftsjthsd-h 5y ago
    That would be an odd regression; I thought current GDPR mandated whois privacy?
    - Macha 5y ago
      Yes, the current status is that the GDPR basically outlaws whois as "Domain holders must publish public contact information". ICANN's plan B, after failing to fight that requirement, is that registrars must hold contact information and provide it to parties with legitimate interests. The EU privacy regulators have been clear in their interpretation that IP lawyers do not have sufficient "legitimate interests" to be party to such a system, though they are ok with law enforcement having access. Part of that argument is IP lawyers are such a broad group as to make the information de facto public. Anyway, this proposal seems to be basically a GDPR exception to make "whois" in some form allowable, which is backsliding on the current state.
jikbd 5y ago
In some countries something like this has been mandatory for a long time. In Germany and its lapdog Austria there’s the mandatory impressum: fully doxxed whether you want it or not. In Spain if you handle a database with personal information (like a forum or a blog where people can leave their email addresses along with comments) you also have to put all your data somewhere in the page so people can contact you to have themselves removed. But hey we have cookie banners at least!
- realityking 5y ago
  > In Germany and its lapdog Austria there’s the mandatory impressum: fully doxxed whether you want it or not. At least in Germany, that’s only for commercial sites. If you’re not monetizing your site in any way (ads count) you don’t need an imprint.
- the_mitsuhiko 5y ago
  Austria has a public registry of addresses of all people living in the country.
- ChuckNorris89 5y ago
  >In Germany and its lapdog Austria there’s the mandatory impressum: fully doxxed whether you want it or not. Yep, the big eye-opener for me was when that Austrian politician complained about being "harassed" by someone calling her a "corrupt traitor" on Facebook, so the Austrian authorities got involved and the person behind that account got doxxed and charged with libel. Unreal. In Austria/Germany the freedom of speech is only free until it impacts the elite. Then you get the book thrown at you.
HappyCollision 5y ago
[walks into pizza shop] “This menu is horrible! I demand the owner’s name, address, and phone number!”
- 3np 5y ago
  TBF, in many EU countries you can get this through a public registry, and are entitled to that through law. So it's not inconsistent (:
bloqs 5y ago
Id assume this simply means that you will have a legal representative firm with a PO box and hardened phone number act as the whois holder instead rather than just paying godaddy to do it?
- vasco 5y ago
  Or just put one of the EU comissioners information on the domain instead of yours.
  - SiempreViernes 5y ago
    That's the current system though? The news is the registrars would be required to actually check the info and not accept obvious lies.
    - zarzavat 5y ago
      And why would a registrar outside the EU go to that trouble? EU is not a world government last time I checked.
      - SiempreViernes 5y ago
        If you're not using a registrar subject to the EU rules I'm not sure why you'd bother to object to the rules in the first place. So I take it as implied that whoever is complaining about the rules are actually going to be subject to them.
        akersten 5y ago
        > If you're not using a registrar subject to the EU rules I'm not sure why you'd bother to object to the rules in the first place. Because we don't want this horseradish inspiring other governments?
greatgib 5y ago
Here you can see a multi-year plan and no one complained when it was possible: - let's force everyone to use https. - but https relies on verified domain names and this comes with a cost... Solution: here is let's encrypt, so https everywhere is justified - last step, use the fact that registrar are centralized to ensure the identity of all domain names holders, anonymous servers without https will not be reachable by normal people!
- hyproxia 5y ago
  I'm not a big fan of https, but how is this related to it? Websites that are http-only will be affected as well. Edit: if you're talking about obtaining certs for bare IPs, it's actually possible to do that. See 1.1.1.1
  - _hyn3 5y ago
    OP said, "let's force everyone to use https." My guess is that OP's point was that "everyone" includes servers as well as browsers, presumably by shaming via no lock icon and other tactics.
    - hyproxia 5y ago
      I know, but I still don't understand how this is related to the news at hand. You'll have to publish your info regardless of which protocols you're using (if any).
  - andrius4669 5y ago
    you can connect using bare IPs with http.
    - bruce511 5y ago
      You can with https as well. For most of us that means an untrusted cert, and hence a browser warning, but that's equivalent to the browser padlock icon when browsing http (and arguably safer). Plus, if you are browsing or publishing using plain ip addresses you are already outside the "regular behaviour" so users doing that will be happy to click through. However this subthread is irrelevant to the main thread. The https/http question is unrelated to the dns question, since dns applies to both equally.
Aeolun 5y ago
I’ve had these things up for years since I first registered a domain back in 2008. I’ve never been doxxed, or had any negative effect from this information being public. I think at some point my registry stopped showing address information, but the name and email are still public. I know that’s just anecdotal, but I feel the fears here are a bit overblown.
- robbedpeter 5y ago
  That tells me you're either self censoring or hold no controversial opinions which you share in public. You doxxing yourself and nothing bad happening is lucky for you, but you should have enough self awareness to realize that nothing bad happened simply because you were not an interesting target. For others, the content they share makes them more interesting to potential attackers.
  - Kbelicius 5y ago
    This tells me you neither read the article nor the EUs draft. Do you also believe that by giving your personal information to a bank that you are doxxing yourself?
- SturgeonsLaw 5y ago
  That's very trusting of you, Bart, and perhaps the police in Suginami, Japan are less likely to SWAT you than those in the USA, but you are placing trust in the population of the internet not to misuse the information you've shared, and that, in my view, is simply a case of security by obscurity.
  - Aeolun 5y ago
    Point taken. That said, we used to have phone books with everyone’s name, number (and address?) distributed to everyone in town. I guess people are just bigger assholes when they’re not within throwing distance?
    - haods 5y ago
unityByFreedom 5y ago
The article states, > What won't be happening, however, is the free publication of names and contact details. Currently the draft text of article 23 states: "Member States shall ensure that the TLD registries and the entities providing domain name registration services for the TLD publish, without undue delay after the registration of a domain name, domain registration data which are not personal data." It's unclear to me what data would be newly exposed with the proposed directive.
- raverbashing 5y ago
  Thanks for checking the actual text. Yeah, sounds like exaggeration and fear mongering This looks like it would be as dangerous as standard whois
rektide 5y ago
Arguments for & against aside, who the frell does the EU think it is that they're going to try to bully the internet into doing what they want? Incredibly rage inducing era we're entering that after decades of the internet functioning relatively well, via good technical agreement mostly, the bloody bureaucrats of XYZ keep showing up & telling the entire planet how they have to operate. I cant stand the entire internet being ongoingly bullied around whenever this country or that gets some funny notion. I wish we saw more of the national &c threats to disconnect various services or systems go through, wish we saw less negotiation with the random governments of the world, wish we saw services that valued who they are & the right of their network users more than they feared the hundreds and hundreds of arms of bureaocracy that constantly threaten them. Let yourself get disconnected damn it, someone make a stand, stop agreeing to every demand and let these fools punch themselves in the face. If this nation cant abide by the informal rules of the internet too damned bad for them. They've gotta figure outnwhatbthey want to do about ut themselves; they cant unilaterally keep redefining thr rules of the road for everyone. The right to be forgotten is another prime example of colossal sovereign overreach. After a decade in the courts it seems like, in spite of much much much belly aching & shitstirring, nations generally have to accept that they cant legislate what contentnis available in other territories, but for a while it seemed like the dastardly rich were going to be able to demand any coverage they didnt like get disappeared from the internet entirely. At some point we need to stop treating politicians & poltician consequneces as things to adjust to, & start telling these nations off. The internetnis more important than your territory.
- beebeepka 5y ago
  This comment is triggering my whataboutism reflex. So many words, yet the real motives behind this rant remain unclear. If you operate in the EU, you are expected to follow the local rules. Not sure why would you object to that. I mean, I have my suspicions but I'd wait for a clarification before accusing you of exceptionalism I wonder what you have to say about your country (US, I bet) bending most of the world to its will via the very real threat of violence.
  - rektide 5y ago
amadeuspagel 5y ago
> What won't be happening, however, is the free publication of names and contact details. Currently the draft text of article 23 states: "Member States shall ensure that the TLD registries and the entities providing domain name registration services for the TLD publish, without undue delay after the registration of a domain name, domain registration data which are not personal data." > That italicised line seems to have passed by an awful lot of very shouty people. This makes it look like personal data is not involved at all, or like the issue is really about what data TLD registries would be forced to publish. But of course they would be forced to collect, verify and store personal data, and that's the problem. This link should be changed to the original story[1], which is already discussed on HN[2]. [1]: https://www.patrick-breyer.de/en/cybersecurity-eu-to-ban-anonymous-websites/ https://www.patrick-breyer.de/en/cybersecurity-eu-to-ban-ano... [2]: https://news.ycombinator.com/item?id=28841849 https://news.ycombinator.com/item?id=28841849
technion 5y ago
This is what a junk mail folder looks like on a mailbox that registered a domain and didn't employ domain privacy: https://ibb.co/jbF4169 https://ibb.co/jbF4169 It's like this all day, every day, and that's only what's gotten through after several manual efforts to hard reject common offenders by domain and IP addresses. I appreciate there needs to be a middle ground of some sort, but the old defaults were an absolute problem and should never have been able to persist for so long.
cookiengineer 5y ago
This week I literally dug through the documentation of whois query APIs of all registrars and registries. The RIPE servers (and therefore APNIC, AFRINIC, too) are much more detailed in what you can find out about their assigned number ranges via inverse queries. [1] ARIN and LACNIC both use their own response format (which is outdated, sucks and is super hard to parse). But now to the interesting part: You can query "the internet" for all customers that have specific IP ranges by that specific ISP. For example, this will show all customers with a static IP at Unitymedia, which is a VODANET subsidary ISP in Germany. I've chosen this example to reduce the wall of text, use VODANET with expectancy to get blocked due to too large response: whois -h whois.ripe.net -- "-i mnt-by UNITYMEDIA-MNT" The responses are - from an OSINT perspective - a nightmare, too. Because I know that literally all of those customers probably have an outdated router hardware that they cannot patch or update. It also nails down the possible hardware to less than 5 models (from ARRIS, AVM and UPC), which makes it very open to router exploits. (Remember UBEEkey? yeah, that's those routers [2]). Also, what the article only mentions marginally: WHOIS got deprecated since GDPR, back then by RIPE which seems to lead in terms of specification compliance. The new protocol that is pretty much the same, but in JSON is RDAP; which also allows to search for nameservers, for domains etc. and therefore superseeds the featureset of the WHOIS protocol. [3] [1] https://www.ripe.net/manage-ips-and-asns/db/support/documentation/ripe-database-documentation/types-of-queries/inverse-queries https://www.ripe.net/manage-ips-and-asns/db/support/document... [2] https://github.com/yolosec/upcgen https://github.com/yolosec/upcgen [3] https://datatracker.ietf.org/doc/html/rfc7482 https://datatracker.ietf.org/doc/html/rfc7482
- tephra 5y ago
  There must be around 4-5000 registries and registrars out there. That seems like an ungodly amount of work..
  - cookiengineer 5y ago
    Actually, it's not that many that have documentation available. /s But, given that Donuts Inc are the overlord of the internet in terms of (g)TLDs, there's not as many as some might think. The native whois client on most distributions is on github and contains a self-maintained list of whois servers in case you're curious [1]. It also contains a list of all new gTLDs [2], which, for the most part are registered via Donuts Inc. in the end. It's kinda ridiculous that something like ".gmbh" is owned, hosted, and distributed by an American company in Texas :-/ The interesting part is that some companies like "dotBERLIN GmbH & Co KG" (for .berlin) operate their own whois servers but seemingly reuse the infrastructure that Donuts Inc. provides for them. The ICANNWiki also has some nice side-facts about registrars if you're more curious about their organizational structure [3]. Donuts Inc. also has some chinese TLDs (like .游戏 or .xn--unup4y which means "games") registered via the Spring Fields LLC company that is a subsidary of Donuts Inc. [4] and [5] So yeah, I guess I kind of agree with the centralization of the internet argument here. [1] https://github.com/rfc1036/whois/blob/next/tld_serv_list https://github.com/rfc1036/whois/blob/next/tld_serv_list [2] https://github.com/rfc1036/whois/blob/next/new_gtlds_list https://github.com/rfc1036/whois/blob/next/new_gtlds_list [3] https://icannwiki.org/Donuts https://icannwiki.org/Donuts [4] https://icannwiki.org/.%E6%B8%B8%E6%88%8F https://icannwiki.org/.%E6%B8%B8%E6%88%8F [5] https://newgtlds.icann.org/en/program-status/delegated-strings https://newgtlds.icann.org/en/program-status/delegated-strin...
black_puppydog 5y ago
From the full text quote at the bottom of Breyer"s blog: > 4. Member States shall ensure that the TLD registries and the entities providing domain name registration services for the TLD publish, in accordance with Article 6(1)(c) and Article 6(3) of Regulation (EU) 2016/679 and without undue delay after the registration of a domain name, certain domain name registration data, such as the domain name and the name of the legal person. That does read pretty ambiguously like at the very least my name becoming public when I register a domain. Opening for example an anti-fascist blog under its own domain this would become a real life threat if you don't happen to be called John Smith or the local equivalent. Overall I come down pretty hard on Breyer's side of the argument here. This is the DNS equivalent to enforcing operators of online forums to check users' real names. It's ripe for abuse and it will inevitably be used to chill dissenting voices. The fact that the register (and the people they interviewed) see this differently seems to be that they trust that data collected will only be used by "trusted" authorities. But with the above quote I don't see that being the case, and the trust in authorities is really only an effective protection if your website happens to defend the status quo, good luck otherwise.
- KarlKemp 5y ago
  It’s always been the rule in the German-speaking world that websites had to disclose someone responsible, both on-site and in Whois. It’s a continuation from the analog world, where even flyers handed out at a protest have to state someone’s name & address. The expectation is that you don’t have to fear anything for lawful activity. For the most part, that’s not too far from reality, and even a few anti-fascist organizations have complied and not had any trouble. For individuals (and the not-exactly-anti fascists) it’s a bit harder, and they tend to skirt the rules by choosing other TLDs or finding some strawperson/organisation to register the domain for them.
  - inglor_cz 5y ago
    I am from a non-German-speaking part of the EU and I believe that anonymity is an important value that helps unpopular speech survive. Societal trust levels in the EU are all over the map, with some countries being really low, and in that situation, the 'you don’t have to fear anything for lawful activity' principle isn't really exportable from Germany. You do not want to try this out in a country where mafias are strong, for example.
gjvnq 5y ago
"Fun" fact: Brazilian domains (.br) have been showing the owner's full name and CPF number (like the US SSN) for years. I think that they used to also publish the mailing address for domains owned by legal persons but my memory might be failing here. https://www.tutoriart.com.br/dominio-br-dados-expostos-na-internet/ https://www.tutoriart.com.br/dominio-br-dados-expostos-na-in... https://registro.br/tecnologia/ferramentas/whois/?search=registro.br https://registro.br/tecnologia/ferramentas/whois/?search=reg...

154 points by upofadown 5y ago

As someone who wants to maintain his own blog: This is pretty concerning. Why should I need to publish my address for all to see in order to make a blog? And yes, I know that blogging platforms exist, but I don't want to rely on them. It kinda makes me wonder if this is a push towards further centralization on the web.

2Gkashmiri 5y ago
i dont quite unerstand this. does this imply we are forced to give out our verifiable home address? i remember buying domains and just putting "001, abc street, 892032, india" in the fields. is this forcing me to change that to my home address?
pluc 5y ago
Because there's a box labeled 'address' doesn't mean you should put your address in there.
- meowface 5y ago
  My understanding is this would make it illegal to not put your real address there. You can willingly break the law, but that'll create other issues for you.
  - travoc 5y ago
    My address is a mailbox store in Missouri.
    - mandelbrotwurst 5y ago
      Mailing addresses that are not your physical address may be a decent workaround, but should that even be necessary?
    - ISL 5y ago
      When opening a mailbox, I had to provide ID and a notarized signature.
  - ALittleLight 5y ago
    As someone who doesn't live in the EU why should I concern myself with their laws? It sounds bad, but I won't obey it.
    - SturgeonsLaw 5y ago
      The registrar is subject to EU law, so they could be forced to limit or remove your access to your domain
    - 3np 5y ago
      This proposal is regarding EU TLD registrars. Country TLDs in the EU (.de, .fr, .se etc) already require you to be an EU resident. So you wouldn't be subject to these rules as you're not entitled to hold one of those domains.
      - jeltz 5y ago
        You are wrong about at least .se. You do not need to be sn EU resident to own a .se domain.
  - jobigoud 5y ago
    But will you also need to update it when you move?
iratewizard 5y ago
What's left of the old web may just have to move behind subdomains so only one person gives up their privacy. I'm glad I bought a 5 letter url for a project like that.
SiempreViernes 5y ago
Because you're supposed to be responsible for what you publish? Or as quoted in the article itself: > For those that say this is a hit to privacy: this operates the same way it would if you were buying property anywhere else. Yes, it's digital property, but you should have to be responsible for that permissive SPF record allowing relay of malware spam in the same way you have to be responsive when there's a gas leak on physical property. In any case, self hosting a blog seems like a pretty weird step if what you're after is good anonymity.
- hyproxia 5y ago
  >In any case, self hosting a blog seems like a pretty weird step if what you're after is good anonymity. I'm not after anonymity, I just don't want my address and phone number to be easily available to every nutcase out there.
  - deleted 5y ago
    [deleted]
- smnrchrds 5y ago
  There is a world of difference between being Satoshi level of anonymous and being an open book for anyone on planet earth to try to SWAT.
matheusmoreira 5y ago
Maybe if the web becomes bad enough people will start using onion hidden services for everything instead. Why not publish blogs that way? It even allows you to be anonymous.
- hyproxia 5y ago
  >Why not publish blogs that way? Because onion sites are slower, harder to access, not easily searchable, and not easily protected against DDoS attacks.
  - travoc 5y ago
    Most of these things were once said about sites that used SSL.
    - sigstoat 5y ago
      > Most of these things were once said about sites that used SSL. in the sense that every possible thing has been said about everything, sure. and to a slightly greater extent maybe they were said about trying to SSL-ify _everything_. but "gee maybe shouldn't SSL-ify sites handling sensitive data" has never been a serious talking point.
    - amadeuspagel 5y ago
      The speed of light is a hard limit on improving the performance of onion sites. Having your requests routed through six (edit: random) servers is always going to be slow.
      - cassonmars 5y ago
        Your traffic is certainly going over more than six links to get to you today, the only difference is clearnet traffic direction is organized for efficiency. TOR has inefficiency baked into the design for the purpose of privacy.
        5y ago
charcircuit 5y ago
Because sometimes people need to contact you and mail is one such way to send a message.
- mandelbrotwurst 5y ago
  What’s wrong with e-mail?
  - charcircuit 5y ago
    Some people don't check their email so a physical letter can be used as a backup.
    - short12 5y ago
      Some people don't check their mail either
      - jobigoud 5y ago
        But you can send a letter with proof of reception so at least they know if you received it or not.
- smnrchrds 5y ago
  In Canada, if a copyright holder notices you are downloading something they own the rights to, e.g. because you are using torrent, they cannot ask the ISP for your name or address. The only recourse they have, short of going through the expensive and lengthy court process, is that they can give the ISP a note which they are legally required to forward to the client. It's a simple system. Your privacy remains preserved and you get the messages too. Why not mandate an email forwarding service by registrars if that's what they are after?
lunatuna 5y ago
The article doesn’t state that it will be published. It states that the registrar must have it. The Pirate Party member, as mentioned in the article, didn’t read the proposal.
- nerdponx 5y ago
  That's one subpoena or warrant away from it being published to people who you don't want to have it.
  - ALittleLight 5y ago
    Or hack, misconfiguration, data leak, insider, etc.
  - wmf 5y ago
    Like real estate and vehicles, domain registrations probably shouldn't be too private by default.
  - PeterisP 5y ago
    That's a bit separate from the notion of privacy - warantless searches violate privacy, but there is (nor should be) any expectation of privacy given a valid warrant; valid warrants is the scenario where we the people have decided (and written in our laws and constitutions) that you should not be able to keep things hidden.
dathinab 5y ago
To quote the quote this is about: > "Member States shall ensure that the TLD registries and the entities providing domain name registration services for the TLD publish, without undue delay after the registration of a domain name, domain registration data which are not personal data." Your address is personal data, so is email, phone number, more or less any contact information etc. So what is not personal data? Mainly thinks like that the domain had been registered through godaddy, i.e. thinks a police agency needs to know, to know where to go with a curt order for actual private information. Also interesting: It's for the TLD, I wonder if they have a clear definition of it, or else .co.uk and similar would no longer be covered (not that it matters anymore). But what definitely should not be covered are sub-domain registrars. Through I haven't read the draft of the directive, so I can't tell you if there are some uncanny effects between article 23 and other articles.

pmlnr 5y ago

When I registered my first domains in Hungary I had to send the registrars a copy of my national ID. Apparently the process was ahead of it's time /s

bserge 5y ago

Maybe I'm too tired, but wtf is this article even talking about. You can lose your domain if your data is not accurate/real. Registrars have also been offering proxy contact services for a long time now. Authorities, of course, can get the real info.

unicornporn 5y ago
> The EU is currently drafting legislation to increase cyber security (revised NIS Directive, in short “NIS 2”). According to this directive, the registration of internet domain names will in future require the correct identification of the owner in the Whois database, including name, address and telephone number. So far, registries such as denic do not register telephone numbers of the holders. The leading Industry Committee wants to additionally mandate „verification“ of the registration data. The plans could mean the end of “whois privacy” services for proxy registration of domains, threatening the safety of activists and whistleblowers.[1] [1] https://www.patrick-breyer.de/en/cybersecurity-eu-to-ban-anonymous-websites/ https://www.patrick-breyer.de/en/cybersecurity-eu-to-ban-ano...
- Springtime 5y ago
  Proxy registration referred to in that quote isn't what Whois privacy generally refers to though, no? When I've seen it used by typical registrars it has meant that the owner's details aren't disclosed on public Whois lookups but are still required to be correct.
- yjftsjthsd-h 5y ago
  That would be an odd regression; I thought current GDPR mandated whois privacy?
  - Macha 5y ago
    Yes, the current status is that the GDPR basically outlaws whois as "Domain holders must publish public contact information". ICANN's plan B, after failing to fight that requirement, is that registrars must hold contact information and provide it to parties with legitimate interests. The EU privacy regulators have been clear in their interpretation that IP lawyers do not have sufficient "legitimate interests" to be party to such a system, though they are ok with law enforcement having access. Part of that argument is IP lawyers are such a broad group as to make the information de facto public. Anyway, this proposal seems to be basically a GDPR exception to make "whois" in some form allowable, which is backsliding on the current state.

jikbd 5y ago

In some countries something like this has been mandatory for a long time. In Germany and its lapdog Austria there’s the mandatory impressum: fully doxxed whether you want it or not. In Spain if you handle a database with personal information (like a forum or a blog where people can leave their email addresses along with comments) you also have to put all your data somewhere in the page so people can contact you to have themselves removed. But hey we have cookie banners at least!

realityking 5y ago
> In Germany and its lapdog Austria there’s the mandatory impressum: fully doxxed whether you want it or not. At least in Germany, that’s only for commercial sites. If you’re not monetizing your site in any way (ads count) you don’t need an imprint.
the_mitsuhiko 5y ago
Austria has a public registry of addresses of all people living in the country.
ChuckNorris89 5y ago
>In Germany and its lapdog Austria there’s the mandatory impressum: fully doxxed whether you want it or not. Yep, the big eye-opener for me was when that Austrian politician complained about being "harassed" by someone calling her a "corrupt traitor" on Facebook, so the Austrian authorities got involved and the person behind that account got doxxed and charged with libel. Unreal. In Austria/Germany the freedom of speech is only free until it impacts the elite. Then you get the book thrown at you.

HappyCollision 5y ago

[walks into pizza shop] “This menu is horrible! I demand the owner’s name, address, and phone number!”

3np 5y ago
TBF, in many EU countries you can get this through a public registry, and are entitled to that through law. So it's not inconsistent (:

bloqs 5y ago

Id assume this simply means that you will have a legal representative firm with a PO box and hardened phone number act as the whois holder instead rather than just paying godaddy to do it?

vasco 5y ago
Or just put one of the EU comissioners information on the domain instead of yours.
- SiempreViernes 5y ago
  That's the current system though? The news is the registrars would be required to actually check the info and not accept obvious lies.
  - zarzavat 5y ago
    And why would a registrar outside the EU go to that trouble? EU is not a world government last time I checked.
    - SiempreViernes 5y ago
      If you're not using a registrar subject to the EU rules I'm not sure why you'd bother to object to the rules in the first place. So I take it as implied that whoever is complaining about the rules are actually going to be subject to them.
      - akersten 5y ago
        > If you're not using a registrar subject to the EU rules I'm not sure why you'd bother to object to the rules in the first place. Because we don't want this horseradish inspiring other governments?

greatgib 5y ago

Here you can see a multi-year plan and no one complained when it was possible: - let's force everyone to use https. - but https relies on verified domain names and this comes with a cost... Solution: here is let's encrypt, so https everywhere is justified - last step, use the fact that registrar are centralized to ensure the identity of all domain names holders, anonymous servers without https will not be reachable by normal people!

hyproxia 5y ago
I'm not a big fan of https, but how is this related to it? Websites that are http-only will be affected as well. Edit: if you're talking about obtaining certs for bare IPs, it's actually possible to do that. See 1.1.1.1
- _hyn3 5y ago
  OP said, "let's force everyone to use https." My guess is that OP's point was that "everyone" includes servers as well as browsers, presumably by shaming via no lock icon and other tactics.
  - hyproxia 5y ago
    I know, but I still don't understand how this is related to the news at hand. You'll have to publish your info regardless of which protocols you're using (if any).
- andrius4669 5y ago
  you can connect using bare IPs with http.
  - bruce511 5y ago
    You can with https as well. For most of us that means an untrusted cert, and hence a browser warning, but that's equivalent to the browser padlock icon when browsing http (and arguably safer). Plus, if you are browsing or publishing using plain ip addresses you are already outside the "regular behaviour" so users doing that will be happy to click through. However this subthread is irrelevant to the main thread. The https/http question is unrelated to the dns question, since dns applies to both equally.

Aeolun 5y ago

I’ve had these things up for years since I first registered a domain back in 2008. I’ve never been doxxed, or had any negative effect from this information being public. I think at some point my registry stopped showing address information, but the name and email are still public. I know that’s just anecdotal, but I feel the fears here are a bit overblown.

robbedpeter 5y ago
That tells me you're either self censoring or hold no controversial opinions which you share in public. You doxxing yourself and nothing bad happening is lucky for you, but you should have enough self awareness to realize that nothing bad happened simply because you were not an interesting target. For others, the content they share makes them more interesting to potential attackers.
- Kbelicius 5y ago
  This tells me you neither read the article nor the EUs draft. Do you also believe that by giving your personal information to a bank that you are doxxing yourself?
SturgeonsLaw 5y ago
That's very trusting of you, Bart, and perhaps the police in Suginami, Japan are less likely to SWAT you than those in the USA, but you are placing trust in the population of the internet not to misuse the information you've shared, and that, in my view, is simply a case of security by obscurity.
- Aeolun 5y ago
  Point taken. That said, we used to have phone books with everyone’s name, number (and address?) distributed to everyone in town. I guess people are just bigger assholes when they’re not within throwing distance?
  - haods 5y ago

unityByFreedom 5y ago

The article states, > What won't be happening, however, is the free publication of names and contact details. Currently the draft text of article 23 states: "Member States shall ensure that the TLD registries and the entities providing domain name registration services for the TLD publish, without undue delay after the registration of a domain name, domain registration data which are not personal data." It's unclear to me what data would be newly exposed with the proposed directive.

raverbashing 5y ago
Thanks for checking the actual text. Yeah, sounds like exaggeration and fear mongering This looks like it would be as dangerous as standard whois

rektide 5y ago

Arguments for & against aside, who the frell does the EU think it is that they're going to try to bully the internet into doing what they want? Incredibly rage inducing era we're entering that after decades of the internet functioning relatively well, via good technical agreement mostly, the bloody bureaucrats of XYZ keep showing up & telling the entire planet how they have to operate. I cant stand the entire internet being ongoingly bullied around whenever this country or that gets some funny notion. I wish we saw more of the national &c threats to disconnect various services or systems go through, wish we saw less negotiation with the random governments of the world, wish we saw services that valued who they are & the right of their network users more than they feared the hundreds and hundreds of arms of bureaocracy that constantly threaten them. Let yourself get disconnected damn it, someone make a stand, stop agreeing to every demand and let these fools punch themselves in the face. If this nation cant abide by the informal rules of the internet too damned bad for them. They've gotta figure outnwhatbthey want to do about ut themselves; they cant unilaterally keep redefining thr rules of the road for everyone. The right to be forgotten is another prime example of colossal sovereign overreach. After a decade in the courts it seems like, in spite of much much much belly aching & shitstirring, nations generally have to accept that they cant legislate what contentnis available in other territories, but for a while it seemed like the dastardly rich were going to be able to demand any coverage they didnt like get disappeared from the internet entirely. At some point we need to stop treating politicians & poltician consequneces as things to adjust to, & start telling these nations off. The internetnis more important than your territory.

beebeepka 5y ago
This comment is triggering my whataboutism reflex. So many words, yet the real motives behind this rant remain unclear. If you operate in the EU, you are expected to follow the local rules. Not sure why would you object to that. I mean, I have my suspicions but I'd wait for a clarification before accusing you of exceptionalism I wonder what you have to say about your country (US, I bet) bending most of the world to its will via the very real threat of violence.
- rektide 5y ago

amadeuspagel 5y ago

> What won't be happening, however, is the free publication of names and contact details. Currently the draft text of article 23 states: "Member States shall ensure that the TLD registries and the entities providing domain name registration services for the TLD publish, without undue delay after the registration of a domain name, domain registration data which are not personal data." > That italicised line seems to have passed by an awful lot of very shouty people. This makes it look like personal data is not involved at all, or like the issue is really about what data TLD registries would be forced to publish. But of course they would be forced to collect, verify and store personal data, and that's the problem. This link should be changed to the original story[1], which is already discussed on HN[2]. [1]: https://www.patrick-breyer.de/en/cybersecurity-eu-to-ban-anonymous-websites/ https://www.patrick-breyer.de/en/cybersecurity-eu-to-ban-ano... [2]: https://news.ycombinator.com/item?id=28841849 https://news.ycombinator.com/item?id=28841849

technion 5y ago

This is what a junk mail folder looks like on a mailbox that registered a domain and didn't employ domain privacy: https://ibb.co/jbF4169 https://ibb.co/jbF4169 It's like this all day, every day, and that's only what's gotten through after several manual efforts to hard reject common offenders by domain and IP addresses. I appreciate there needs to be a middle ground of some sort, but the old defaults were an absolute problem and should never have been able to persist for so long.

cookiengineer 5y ago

This week I literally dug through the documentation of whois query APIs of all registrars and registries. The RIPE servers (and therefore APNIC, AFRINIC, too) are much more detailed in what you can find out about their assigned number ranges via inverse queries. [1] ARIN and LACNIC both use their own response format (which is outdated, sucks and is super hard to parse). But now to the interesting part: You can query "the internet" for all customers that have specific IP ranges by that specific ISP. For example, this will show all customers with a static IP at Unitymedia, which is a VODANET subsidary ISP in Germany. I've chosen this example to reduce the wall of text, use VODANET with expectancy to get blocked due to too large response: whois -h whois.ripe.net -- "-i mnt-by UNITYMEDIA-MNT" The responses are - from an OSINT perspective - a nightmare, too. Because I know that literally all of those customers probably have an outdated router hardware that they cannot patch or update. It also nails down the possible hardware to less than 5 models (from ARRIS, AVM and UPC), which makes it very open to router exploits. (Remember UBEEkey? yeah, that's those routers [2]). Also, what the article only mentions marginally: WHOIS got deprecated since GDPR, back then by RIPE which seems to lead in terms of specification compliance. The new protocol that is pretty much the same, but in JSON is RDAP; which also allows to search for nameservers, for domains etc. and therefore superseeds the featureset of the WHOIS protocol. [3] [1] https://www.ripe.net/manage-ips-and-asns/db/support/documentation/ripe-database-documentation/types-of-queries/inverse-queries https://www.ripe.net/manage-ips-and-asns/db/support/document... [2] https://github.com/yolosec/upcgen https://github.com/yolosec/upcgen [3] https://datatracker.ietf.org/doc/html/rfc7482 https://datatracker.ietf.org/doc/html/rfc7482

tephra 5y ago
There must be around 4-5000 registries and registrars out there. That seems like an ungodly amount of work..
- cookiengineer 5y ago
  Actually, it's not that many that have documentation available. /s But, given that Donuts Inc are the overlord of the internet in terms of (g)TLDs, there's not as many as some might think. The native whois client on most distributions is on github and contains a self-maintained list of whois servers in case you're curious [1]. It also contains a list of all new gTLDs [2], which, for the most part are registered via Donuts Inc. in the end. It's kinda ridiculous that something like ".gmbh" is owned, hosted, and distributed by an American company in Texas :-/ The interesting part is that some companies like "dotBERLIN GmbH & Co KG" (for .berlin) operate their own whois servers but seemingly reuse the infrastructure that Donuts Inc. provides for them. The ICANNWiki also has some nice side-facts about registrars if you're more curious about their organizational structure [3]. Donuts Inc. also has some chinese TLDs (like .游戏 or .xn--unup4y which means "games") registered via the Spring Fields LLC company that is a subsidary of Donuts Inc. [4] and [5] So yeah, I guess I kind of agree with the centralization of the internet argument here. [1] https://github.com/rfc1036/whois/blob/next/tld_serv_list https://github.com/rfc1036/whois/blob/next/tld_serv_list [2] https://github.com/rfc1036/whois/blob/next/new_gtlds_list https://github.com/rfc1036/whois/blob/next/new_gtlds_list [3] https://icannwiki.org/Donuts https://icannwiki.org/Donuts [4] https://icannwiki.org/.%E6%B8%B8%E6%88%8F https://icannwiki.org/.%E6%B8%B8%E6%88%8F [5] https://newgtlds.icann.org/en/program-status/delegated-strings https://newgtlds.icann.org/en/program-status/delegated-strin...

black_puppydog 5y ago

From the full text quote at the bottom of Breyer"s blog: > 4. Member States shall ensure that the TLD registries and the entities providing domain name registration services for the TLD publish, in accordance with Article 6(1)(c) and Article 6(3) of Regulation (EU) 2016/679 and without undue delay after the registration of a domain name, certain domain name registration data, such as the domain name and the name of the legal person. That does read pretty ambiguously like at the very least my name becoming public when I register a domain. Opening for example an anti-fascist blog under its own domain this would become a real life threat if you don't happen to be called John Smith or the local equivalent. Overall I come down pretty hard on Breyer's side of the argument here. This is the DNS equivalent to enforcing operators of online forums to check users' real names. It's ripe for abuse and it will inevitably be used to chill dissenting voices. The fact that the register (and the people they interviewed) see this differently seems to be that they trust that data collected will only be used by "trusted" authorities. But with the above quote I don't see that being the case, and the trust in authorities is really only an effective protection if your website happens to defend the status quo, good luck otherwise.

KarlKemp 5y ago
It’s always been the rule in the German-speaking world that websites had to disclose someone responsible, both on-site and in Whois. It’s a continuation from the analog world, where even flyers handed out at a protest have to state someone’s name & address. The expectation is that you don’t have to fear anything for lawful activity. For the most part, that’s not too far from reality, and even a few anti-fascist organizations have complied and not had any trouble. For individuals (and the not-exactly-anti fascists) it’s a bit harder, and they tend to skirt the rules by choosing other TLDs or finding some strawperson/organisation to register the domain for them.
- inglor_cz 5y ago
  I am from a non-German-speaking part of the EU and I believe that anonymity is an important value that helps unpopular speech survive. Societal trust levels in the EU are all over the map, with some countries being really low, and in that situation, the 'you don’t have to fear anything for lawful activity' principle isn't really exportable from Germany. You do not want to try this out in a country where mafias are strong, for example.

gjvnq 5y ago

"Fun" fact: Brazilian domains (.br) have been showing the owner's full name and CPF number (like the US SSN) for years. I think that they used to also publish the mailing address for domains owned by legal persons but my memory might be failing here. https://www.tutoriart.com.br/dominio-br-dados-expostos-na-internet/ https://www.tutoriart.com.br/dominio-br-dados-expostos-na-in... https://registro.br/tecnologia/ferramentas/whois/?search=registro.br https://registro.br/tecnologia/ferramentas/whois/?search=reg...