<story><title>Amazon&apos;s customer service backdoor</title><url>https://medium.com/@espringe/amazon-s-customer-service-backdoor-be375b3428c4#.lqxcfockn</url></story><parent_chain><item><author>danneu</author><text>Whois is great for social engineering attackers. You get a name, email, address, and the first service to attack.&lt;p&gt;Meanwhile, the ICANN is working around the clock to make it illegal for us to protect our personal information, and whois protection is becoming an increasingly niche service for registrars.&lt;p&gt;For example, gandi.net (and thus Amazon) doesn&amp;#x27;t hide your name when you have it turned on. By the time you find this out, it might occur to you to just type in a different name, but now you&amp;#x27;re violating ICANN policy. And it&amp;#x27;s already been scraped by any of those whois history websites.</text></item></parent_chain><comment><author>lucaspiller</author><text>In the UK this and a lot more is public information. As an example of what is available about me online (without paying a penny) just by searching for my name:&lt;p&gt;- The year I was born&lt;p&gt;- The district I was born (not the exact town, although that wouldn&amp;#x27;t be hard to guess)&lt;p&gt;- My mother&amp;#x27;s maiden name (which is what most banks et al ask as a security question...)&lt;p&gt;- The areas I&amp;#x27;ve lived (based upon the electoral register, which you can opt out of but supposedly this impacts your credit rating)&lt;p&gt;- That I am a director of a company&lt;p&gt;This is just what is available for free - you can get the full records this is extracted from by paying a small fee.&lt;p&gt;If you know the name of my company (which isn&amp;#x27;t hard to find out), you can also find for free:&lt;p&gt;- My full name&lt;p&gt;- My address&lt;p&gt;- My date of birth&lt;p&gt;- Roughly how much I make a year&lt;p&gt;TL;DR; If you rely on this to &amp;#x27;identify&amp;#x27; someone, you are doing it wrong.</text></comment>
<story><title>Amazon&apos;s customer service backdoor</title><url>https://medium.com/@espringe/amazon-s-customer-service-backdoor-be375b3428c4#.lqxcfockn</url></story><parent_chain><item><author>danneu</author><text>Whois is great for social engineering attackers. You get a name, email, address, and the first service to attack.&lt;p&gt;Meanwhile, the ICANN is working around the clock to make it illegal for us to protect our personal information, and whois protection is becoming an increasingly niche service for registrars.&lt;p&gt;For example, gandi.net (and thus Amazon) doesn&amp;#x27;t hide your name when you have it turned on. By the time you find this out, it might occur to you to just type in a different name, but now you&amp;#x27;re violating ICANN policy. And it&amp;#x27;s already been scraped by any of those whois history websites.</text></item></parent_chain><comment><author>fps</author><text>I think the bigger problem is that public information like your name and address is sufficient for proving your identity.   If we make whois information private, what about phone books, property records, direct mail databases, etc. etc.</text></comment>