4 ms·

I don't see how this can work at a fundamental level. You're telling me that to remove my info I have to essentially give (through your service) all these comp

I don't see how this can work at a fundamental level. You're telling me that to remove my info I have to essentially give (through your service) all these companies & data brokers my info so they can opt me out, and actually trust them that they'll do so? If anything, opting out is a signal that you may actually be of more interest to them than not doing anything. If these companies can also infer that the request is coming from your service (and they will, unless you use random proxies and browser automation), the flag becomes "this person has enough disposable money to pay for such a service" which suddenly increases the value of your profile by orders of magnitude. How are you going to make money to justify the VC funding? VCs rarely fund boring, sustainable businesses that sell a service and make a slim profit; for them it's all about hypergrowth, but I don't see the potential here - unless of course you start doing the very thing you're currently protecting against. The simple fact that it's VC-funded tells me to steer well clear. The only proper way to deal with this is with GDPR-like regulation and actually enforcing it - the latter has been lacking in Europe, but thankfully seems like it's somewhat picked up recently.

mderazon 5y ago
The same feeling I get when I click unsubscribe from spam emails - Am I actually signaling them that I exist and reading their spam ?
troydavis 5y ago
> You're telling me that to remove my info I have to essentially give (through your service) all these companies & data brokers my info so they can opt me out, and actually trust them that they'll do so? Other people raised that concern when this appeared on HN (https://news.ycombinator.com/context?id=27668140 https://news.ycombinator.com/context?id=27668140), and at the time, that’s indeed what the service did. Even if one ignores intentional misuse, simple incompetence by a data broker seems like enough to cause a problem. It only takes one data broker to commingle fields from opt-out requests with existing data (and then share/sell/trade that existing data) for the opt-out fields to spread.
- beyondd 5y ago
  That's certainly one way to look at it. Another way to look at it is that if you do nothing, you information will continue to persist, multiply, and propagate unchecked. Those that take the time (or money) to remove the profiles, have dramatically reduced online footprints, which is why these types of services are becoming more and more popular. Many companies are starting to mandate their employees use services like ours to strengthen their security posture to reduce exposure to phishing, hacking, email spam, etc.
  - troydavis 5y ago
    I’m all for spending the time or money to remove my profile. I’d rather also spend a little extra time to see where I’m listed and evaluate that organization, though.
  - fleetwoodsnack 5y ago
    > you[sic] information will continue to persist, multiply, and propagate unchecked Based on how the underlying problem is presented in your own business model, it seems like this will happen regardless of whether a customers uses this service or not. Like conscripting a recruit into a losing battle (and arguably an unwinnable war) at cost to oneself with little specificity as to what qualifies as success.
  - estaseuropano 5y ago
    Can you give an example of a company that mandates this?
beyondd 5y ago
Anyone can submit opt outs, with, or without, a service like ours. The vast majority of data brokers do remove the information after an opt out request is submitted. Unfortunately, over time, many data brokers start adding it back. The CCPA (California's Privacy Law) permits a data broker to stop honoring an opt out after 12 months. To answer your question though, yes, in order to get these companies to remove your info, you have to submit an opt out that identifies who you are. There is a catch-22, otherwise, they would not know who to opt out. There are a multitude of reasons why people submit opt outs beyond whether or not the person can pay, e.g. victims of domestic violence, police officers, public figures, government officials, members of the military, etc. The data brokers are aware of this and generally have processes to accommodate the requests. Millions of people use some form of identity protection to protect themselves from identity theft, email spam, phishing, scams, hacking, etc. It is a multi-billion dollar market across the consumer, business, and government levels. I do agree that we need stronger privacy laws in the U.S. ASAP!
- mawise 5y ago
  > in order to get these companies to remove your info, you have to submit an opt out that identifies who you are. I wonder if you could build an opt-out service or protocol where you share a hash of your personal information instead of the info itself. With the hash you can identify matching records but you cannot create a record from the hash. If Optery bought full datasets from databrokers, it could use a hash to identify matching records and submit those back to the brokers for opt-out (this wouldn't work for querying their public APIs...) Probably not a feasible solution, but it's a fun possibility to think about!
  - joering2 5y ago
    > With the hash you can identify matching records but you cannot create a record from the hash. I always chuckle when I see someone saying this. A buddy of mine (email marketer) tried to convince me that his 50 million large email database is "well protected" because they are using "industry standard md5 encryption". Of course its not encryption but rather hashing. He was so sure of his, erm, encryption, that he send me the whole database and said "here, crack it". I found a large hacked Facebook email database online, run few python scripts to weed us most combinations of usernames (name+numbers, numbers+name, numbers+some random chars, etc) and some 1000 generic email domains names (like gmail.com, yahoo.com, etc). It took my regular i9 five days to go thru the whole 50M of md5s and compare each combination of usernames + domains names. Oh boy his shock when I returned some 70% "unencrypted" plain text emails back to him :) Bottom line is, if there is some "industry standard" of hashing data, then there are ways to unhash it. Yes in many cases it may be in millions of years to circle thru all possibilities, but if your standard is first name + last name + email address (and all caps), then you can easily plug database of names and download millions of email records online and narrow down your hashing search greatly.
striking 5y ago
> I have to essentially give (through your service) all these companies & data brokers my info Happy user of Optery here: you don't have to give Optery a whole lot of info. No SSNs or anything, just things they would search by to help you remove them. Are there fields for past addresses or people you lived with or past names you may have had? Sure. Do you have to fill them out? No. Are they provided in bulk to the data brokers? No.
- estaseuropano 5y ago
  So they will enter all this data on the websites of the brokers which sell such data....this reminds me of the website that promises it contains all/most bitcoin private keys - just enter yours to find out if its there!
  - beyondd 5y ago
    In the vast majority of cases Optery only submits the opt out (a) if we’ve already located your profile at the data broker, meaning they already have your information to begin with and (b) with the minimum information necessary to complete the out, generally First Name, Last Name, Age, Current City, and Current State, no more information than what’s already publicly available online.
throw10920 5y ago
> You're telling me that to remove my info I have to essentially give (through your service) all these companies & data brokers my info How can you index into a hashmap, an array, or a DB table without a key? Answer: you cannot. There's no way for data-broker opt-outs to work without uniquely identifying the individual who wishes to be removed. Sure, I agree that "GDPR-like regulation and actually enforcing it" is the proper solution - but how long will that take? Five years? Ten? What if I want my personal data removed from these brokers now? Edit: now that I think about it - you could build some scheme where you give the data-brokers a cryptographic hash of some personally-identifying information, so if they don't already have you in their database, then they can't get your information. But, in order to do that, you'd need regulation equivalent to the GDPR (otherwise they'd never do it), in which case the above argument still applied.

mderazon 5y ago

The same feeling I get when I click unsubscribe from spam emails - Am I actually signaling them that I exist and reading their spam ?

troydavis 5y ago

> You're telling me that to remove my info I have to essentially give (through your service) all these companies & data brokers my info so they can opt me out, and actually trust them that they'll do so? Other people raised that concern when this appeared on HN (https://news.ycombinator.com/context?id=27668140 https://news.ycombinator.com/context?id=27668140), and at the time, that’s indeed what the service did. Even if one ignores intentional misuse, simple incompetence by a data broker seems like enough to cause a problem. It only takes one data broker to commingle fields from opt-out requests with existing data (and then share/sell/trade that existing data) for the opt-out fields to spread.

beyondd 5y ago
That's certainly one way to look at it. Another way to look at it is that if you do nothing, you information will continue to persist, multiply, and propagate unchecked. Those that take the time (or money) to remove the profiles, have dramatically reduced online footprints, which is why these types of services are becoming more and more popular. Many companies are starting to mandate their employees use services like ours to strengthen their security posture to reduce exposure to phishing, hacking, email spam, etc.
- troydavis 5y ago
  I’m all for spending the time or money to remove my profile. I’d rather also spend a little extra time to see where I’m listed and evaluate that organization, though.
- fleetwoodsnack 5y ago
  > you[sic] information will continue to persist, multiply, and propagate unchecked Based on how the underlying problem is presented in your own business model, it seems like this will happen regardless of whether a customers uses this service or not. Like conscripting a recruit into a losing battle (and arguably an unwinnable war) at cost to oneself with little specificity as to what qualifies as success.
- estaseuropano 5y ago
  Can you give an example of a company that mandates this?

beyondd 5y ago

Anyone can submit opt outs, with, or without, a service like ours. The vast majority of data brokers do remove the information after an opt out request is submitted. Unfortunately, over time, many data brokers start adding it back. The CCPA (California's Privacy Law) permits a data broker to stop honoring an opt out after 12 months. To answer your question though, yes, in order to get these companies to remove your info, you have to submit an opt out that identifies who you are. There is a catch-22, otherwise, they would not know who to opt out. There are a multitude of reasons why people submit opt outs beyond whether or not the person can pay, e.g. victims of domestic violence, police officers, public figures, government officials, members of the military, etc. The data brokers are aware of this and generally have processes to accommodate the requests. Millions of people use some form of identity protection to protect themselves from identity theft, email spam, phishing, scams, hacking, etc. It is a multi-billion dollar market across the consumer, business, and government levels. I do agree that we need stronger privacy laws in the U.S. ASAP!

mawise 5y ago
> in order to get these companies to remove your info, you have to submit an opt out that identifies who you are. I wonder if you could build an opt-out service or protocol where you share a hash of your personal information instead of the info itself. With the hash you can identify matching records but you cannot create a record from the hash. If Optery bought full datasets from databrokers, it could use a hash to identify matching records and submit those back to the brokers for opt-out (this wouldn't work for querying their public APIs...) Probably not a feasible solution, but it's a fun possibility to think about!
- joering2 5y ago
  > With the hash you can identify matching records but you cannot create a record from the hash. I always chuckle when I see someone saying this. A buddy of mine (email marketer) tried to convince me that his 50 million large email database is "well protected" because they are using "industry standard md5 encryption". Of course its not encryption but rather hashing. He was so sure of his, erm, encryption, that he send me the whole database and said "here, crack it". I found a large hacked Facebook email database online, run few python scripts to weed us most combinations of usernames (name+numbers, numbers+name, numbers+some random chars, etc) and some 1000 generic email domains names (like gmail.com, yahoo.com, etc). It took my regular i9 five days to go thru the whole 50M of md5s and compare each combination of usernames + domains names. Oh boy his shock when I returned some 70% "unencrypted" plain text emails back to him :) Bottom line is, if there is some "industry standard" of hashing data, then there are ways to unhash it. Yes in many cases it may be in millions of years to circle thru all possibilities, but if your standard is first name + last name + email address (and all caps), then you can easily plug database of names and download millions of email records online and narrow down your hashing search greatly.

striking 5y ago

> I have to essentially give (through your service) all these companies & data brokers my info Happy user of Optery here: you don't have to give Optery a whole lot of info. No SSNs or anything, just things they would search by to help you remove them. Are there fields for past addresses or people you lived with or past names you may have had? Sure. Do you have to fill them out? No. Are they provided in bulk to the data brokers? No.

estaseuropano 5y ago
So they will enter all this data on the websites of the brokers which sell such data....this reminds me of the website that promises it contains all/most bitcoin private keys - just enter yours to find out if its there!
- beyondd 5y ago
  In the vast majority of cases Optery only submits the opt out (a) if we’ve already located your profile at the data broker, meaning they already have your information to begin with and (b) with the minimum information necessary to complete the out, generally First Name, Last Name, Age, Current City, and Current State, no more information than what’s already publicly available online.

throw10920 5y ago

> You're telling me that to remove my info I have to essentially give (through your service) all these companies & data brokers my info How can you index into a hashmap, an array, or a DB table without a key? Answer: you cannot. There's no way for data-broker opt-outs to work without uniquely identifying the individual who wishes to be removed. Sure, I agree that "GDPR-like regulation and actually enforcing it" is the proper solution - but how long will that take? Five years? Ten? What if I want my personal data removed from these brokers now? Edit: now that I think about it - you could build some scheme where you give the data-brokers a cryptographic hash of some personally-identifying information, so if they don't already have you in their database, then they can't get your information. But, in order to do that, you'd need regulation equivalent to the GDPR (otherwise they'd never do it), in which case the above argument still applied.