9 ms·

While GoDaddy has a point about the opt-in component being important for deciding whether spamming took place, they certainly didn't need to release her persona

• mcphilip 13y ago
  I read this as GoDaddy releasing her email address only. In theory, isn't an email address only personally identifiable if the address owner has done some action linking it to a real world identity? I assume that's the argument GoDaddy would make. However, it should have been made abundantly clear to someone reporting spam that their email address may be disclosed to the accused party.
  • kleim 13y ago
    Not necessarily: the email address could be the classical <first name>.<name>@<whatever>.com.
    • bhartzer 13y ago
      Yes, I agree, even if it is firstname dot name @ whatever, you still can just google that email address and even get more information or look it up online to get photos, address information, etc. etc.
  • jxf 13y ago
    An email is personally identifiable information, in and of itself. NIST includes it right in their definitions. [0] [0]: http://en.wikipedia.org/wiki/Personally_identifiable_information#Examples http://en.wikipedia.org/wiki/Personally_identifiable_informa...
    • mcphilip 13y ago
      Thanks for this. I am not up to date on what is considered privacy information, apparently.
    • deleted 13y ago
      [deleted]
  • sdfjkl 13y ago
    That may be true if your email address is pm@example.com, but less so if it is philip.mclelland@example.com. For example. And no, reporting abuse should not carry the expectation of having anything about the reporter disclosed to the abuser. That would severely discourage the reporting of abuse. Except of course if you deal in any way whatsoever with GoDaddy you should always expect the worst possible outcome.
    • deleted 13y ago
      [deleted]
    • makomk 13y ago
      So hypothetically speaking you'd be OK with receiving a message from a hosting provider you did business with accusing you of spamming an unspecified person at an unspecified e-mail address and threatening to terminate your account, leaving you with no way of knowing what actually happened?
      • asksol 13y ago
        The opt-in argument is useless since there is no way to verify that the user subscribed in the first place, giving them the address or not. All you do is providing value to the spammer since they have now verified that the email is indeed real and read by a person. When reporting abuse you can already forge any email out of nothing, and you cannot prove that the email was forged unless they have a trace of the email being sent by their server (logs), and if they have that trace they can see easily see a pattern of mass distribution and start an investigation by contacting the other recipients on that list, or just wait for more reports to come in. Guess it's been a while since I worked at an ISP, but I have never heard of a spam abuse investigation strategy that involves forwarding the address to the suspected spammer.
      • rada 13y ago
        If I am innocent, I will tell the ISP that fist.last@example.com opted in, and I will be telling the truth. If I am a spammer, I will say the same, and I will be lying. So what difference does it make?
  • bhartzer 13y ago
    If GoDaddy released the email address, then all the person had to do was go Google that email address and most likely they would have found it. Or, they could find it using DomainTools whois lookup (if they didn't use whois privay on ALL domains they own at all times), or use Gmail or Google Plus to find out who is associated with that email address. Once the email address is given out, then it's just as if someone had all their personally identifiable details.
• tomp 13y ago
  Hm... there really is no difference between an email address and SHA-1 (or SHA-2) of an email difference.If you have one, you can get another easily.
  • ibmthrowaway218 13y ago
    OK, email me at f234567a360f54c1d31a70936f336bc679ba4f9f (sha1sum of an email address with no trailing carriage return or line feed[1]) and I'll believe you. 1. e.g. $ echo -n billg@microsoft.com | sha1sum 2517e4726f81e16f65eb95cf6446ad35352f566e -
    • tomp 13y ago
      In general, the search space even for email addresses is probably too large for me to crack in a few days, but in the context above, where the author's email was already available online (on her website, in SPAM databases, in leaked credential datasets, ...), there is hardly any difference. In any case, if you consider my email address "personally identifiable information", I consider its checksum such information as well.
      • ibmthrowaway218 13y ago
        > In any case, if you consider my email address "personally identifiable information", I consider its checksum such information as well. I wonder what the odds are on a hash collision from another email address (including abusing + addressing) that genuinely belongs to another person (rather than just exists) and therefore the resulting hash does not uniquely identify a single person.
        • shabble 13y ago
          Very, very small. The 'birthday attack'[0] article covers this pretty well, but if we take the output size of a SHA-1 hash as 160 bits, and assume it's outputs are equally distributed[1], a brute-force approach (equivalent to a non-maliciously generated accidental collision across all addresses ever) is: sqrt(2**160 * PI/2) ~= 1.5 x10**24 for there to be a 50% probability of a collision occurring. (if I understood/got the maths right) [0] https://en.wikipedia.org/wiki/Birthday_attack https://en.wikipedia.org/wiki/Birthday_attack [1] This is the intent of all hash functions, and I don't think there are any fundamental attributes of email addresses that would cause systematic bias in the output
• preinheimer 13y ago
  Let me fix that for you: Customer: [generates the SHA1 of every email on their list they bought for $14.95 from totally-not-sketchy-email-lists.com] Here you go There's nothing in the hash of an email address other than an indicator that the person knew who they emailed.
  • jxf 13y ago
    Hence the "prove to us that they opted in" part. (That's why law enforcement should handle this, btw.)
• devicenull 13y ago
  So, that process assumes that the end users are technically competent. Based on the way it was phrased (it sounds like this guy just CCd everyone), that does not seem to be the case. That also assumes that a person looked at this email before it was forwarded on. With a hosting company the size of Godaddy, that's unlikely.
• forgottenpass 13y ago
  While GoDaddy has a point about the opt-in component being important for deciding whether spamming took place I don't think they do have a point. If someone is spamming, why the hell aren't they just going to lie to GoDaddy about who opted in? Even if they're not outright lying, lots of businesses have a very sketchy idea of what "opting in" means. I had my email address posted on a website once as a public contact. You would be surprised how many people consider that "opting in." When I used that email address to make sales enquirers, plenty of sales departments considered that an "opt-in" too. The spam filters we had were fine for the outright trash, but the the flavor of spam that doesn't fall under the legal definition of spam was a nightmare. I eventually had Constant Contact blacklist every single email alias I had at the organization because of how often I was "opting in" to email.
  • Turing_Machine 13y ago
    "When I used that email address to make sales enquirers, plenty of sales departments considered that an "opt-in" too." This seems like more of a gray area to me. Sending sales material to people who have actually sent queries to your sales department doesn't seem nearly as bad as spamming random people (as long as there's a clear, and working, way to turn the sales emails off if you don't want them).
    • forgottenpass 13y ago
      Sending sales material to people who have actually sent queries to your sales department doesn't seem nearly as bad as spamming random people And it's all not nearly as bad as sending me spam for horse pron websites. You can rationalize it however you want. Still doesn't make any of it cool. Why didn't the person I'm already in an email conversation with ask if I wanted to be on the list? Because they know I'd say no (especially when the conversation turns to the fact their company can't do anything for us). That's what makes it opt-out bullshit. It's not something that gets me hot under the collar, even at it's worst it was a minor nuisance I dealt with over coffee. But after a year having a published address and 4 years of fallout afterwards, I've heard all the bad rationalizations for spam and they don't stand up. I have a polite and friendly "fuckoff" form letter for people without unsubscribe links. The second time I have to send it I CC the technical contacts in the domain's whois record. When someone gets upset or angry at me for doing so, I know damn well that they know they're lying when they try to justify their spam.
• konceptz 13y ago
  GoDaddy: "We have received complaints that you've been spamming. Give us a list of SHA-1 hashes of addresses of the people that opted in and show us how they opted in." Considering that the spammer has the email addresses already, it would be as simple as forging a letter. Even fake a handwritten sign up form should "prove" it. No one is going to do a handwriting check to make sure it's actually correct.
  • jwcrux 13y ago
    This is absolutely the case. I think the original comment missed the assumption that the spammer already has the email addresses they spammed.
• throwaway420 13y ago
  > they certainly didn't need to release her personal information to the spammer At that point in the process, your premise that they are a spammer is flawed. They are an accused spammer. Even though Godaddy's customer service process isn't a courtroom, the principle of innocent before before proven guilty should apply when penalties could be applied. A small business, individual, big company, anybody should have the right to have full information to adequately defend themselves from false claims. You don't think there are unscrupulous small businesses out there that file false spamming claims on their competitors? That does happen. Or you don't think that people actually do opt into email lists, forget it about, and then accuse a company of spamming a few months later? It also happens.
  • rnovak 13y ago
    Small businesses making false claims are pathological and completely identifiable cases by a hosting company themselves, they don't need to give the 'accused spammer' _anything_ to verify that sort of thing. If you even want to go with the 'courtroom' analogy, accused only get the chance to 'confront' their accuser in court, they don't get a dossier on them outside of court so they can do whatever they want. You know why? Because this type of thing would happen. This is nothing short of harassment and defamation/libel