News for hackers. Stuff that matters.
Re:Ask HN: Who really gives your personal info to Intelius, ... by JoshTriplett on Monday March 06, 2017 @12:58PM (#13804531)
If anyone reading this thread is interested: I would pay non-trivial amounts of money on a regular basis for a service that systematically worked to eliminate records like these (and the sources they draw from), as well as chasing down sources of junk mail and the lists they ultimately draw from.

The value would depend on effectiveness, and on the degree to which the service clearly reported exactly what they did. Calling and unsubscribing from sources of junk mail would be a moderate time-saver, but finding out where they got their names and addresses from and destroying those would be far more valuable.

It'd take some optimization and batching of the process to figure out how to avoid taking an excessive amount of time per person.

Re:Ask HN: Who really gives your personal info to Intelius, ... by jameslk on Monday March 06, 2017 @01:49PM (#13805007)
I've considered working on this problem from a business standpoint, but I couldn't figure out a good business model for it. I don't think too many people will pay a monthly fee to have their information removed from these services. My guess is that they would sign up for a month and after their information has been removed, immediately cancel their subscription until they needed to do it again. And a yearly fee seemed like it would cost too much for mass adoption.

There's also the problem that you'll often need to get the customer to "opt out" by providing their own information to verify they own it or they will need to click on a link from an email or receive an SMS text verification code. This gets really messy as an automated service.

Re:Ask HN: Who really gives your personal info to Intelius, ... by web007 on Monday March 06, 2017 @02:10PM (#13805156)
I used to work for https://www.reputationdefender.com/privacy - that is (was) exactly their business model. One of the big selling points was the time savings, where it would take you 80 hours a week or some crazy number if you did it yourself, filling out forms and keeping up with all of the new services that aggregate and sell this stuff. Doing it once is great, but won't help you after that month - all of the same places that initially sent all your data in to the aggregators are just going to do it again next month, so you'll get a new record all over again.

They have largely pivoted since then, into a service primarily for reviews and feedback management. I don't have any insight into the quality of the existing service on either side.

Re:Ask HN: Who really gives your personal info to Intelius, ... by JoshTriplett on Monday March 06, 2017 @02:30PM (#13805317)
It's possible that the business could be so successful that everyone uses it, the services selling this information all run out of customers and go out of business, none of them come up with newer and more evil ways to do this, and you run out of potential customers. In which case: mission accomplished, retire on your giant pile of money and bask in the knowledge that you made a far better place. (Avoid scenarios in which you have perverse incentives to allow the problem to continue.)

But in the meantime, tens of millions of potential customers times any reasonable fee seems more than enough to build a substantial business on.

You could tempt people in with a cheap fee to let them send in a few pictures of junk mail and stop those. (As you get more, find the biggest sources and automate or batch them so that they cost you almost nothing, which will pay for the higher-effort ones. Have an upper bound on effort expended, and tell people that they don't pay if you can't remove them.) You could then track down the underlying sources, and if you successfully identify them, contact the customer, and give them enough information to decide to pay you for a higher-end service to get them removed from those sources (and keep them removed).

The value that gets people to keep paying you would be a steady stream of reports of "we found this source leaking/selling your information, here's what we did about it". It'll take you years to track down all such sources and find paths to remove them; you will likely end up having to fund some legal work and possibly even a lawsuit or two, which will give you a giant pile of publicity.

(As one example of something much easier for a company optimized for the process to do than an individual: the USPS has a detailed process for formally putting a company on notice for mailing someone who has specifically unsubscribed, and that process ends in massive fines for continued mailing to that person. I read a report of someone doing that to stop receiving persistent Dell catalogs.)

If you're sufficiently creative, you could even pitch this as a service to marketing companies. You have a list of people who will not buy anything via direct mail, and who will despise any company that they receive such mail from. Convince the sources of postal spam that removing those people from their list makes the rest of their list more valuable. Convince the downstream customers of those sources that using your list directly is far more convenient for them than dealing with opt-outs from every individual on it.

That also gives people a continued incentive to pay to remain on that list.

Re:Ask HN: Who really gives your personal info to Intelius, ... by TrinaryWorksToo on Monday March 06, 2017 @02:44PM (#13805450)
>the USPS has a detailed process for formally putting a company on notice for mailing someone who has specifically unsubscribed, and that process ends in massive fines for continued mailing to that person. I read a report of someone doing that to stop receiving persistent Dell catalogs.)

I would love to learn this process! I've repeatedly asked for a certain mailing to stop and it hasn't ceased.

Re:Ask HN: Who really gives your personal info to Intelius, ... by edwhitesell on Monday March 06, 2017 @03:58PM (#13805994)
I'd rather see much larger bulk rates via the USPS for something like "environmental impact".

For example, I'm currently getting no less than 3 letters per week from Spectrum (formerly TWC) promoting their new triple-play plans. I drop all of them in the recycling bin.

I couldn't care less about their bottom line, but I do care about the environmental impact.

At 3x per week, it probably costs them around USD$0.80/week (postage, paper, printing, etc.) to send those 3 letters. Call it USD$1 to make the math easier. I currently pay about $9.03/week. If I upgraded, it would be at least 3x that amount.

I'm not sure how to calculate the profit they would gain after an upgrade, but I can't imagine it would take more than 2-3 months for the new rates to more than cover the mailing fees for an entire year of their letters.

And yet, I'll never upgrade and I hate the waste caused by their practices.

Re:Ask HN: Who really gives your personal info to Intelius, ... by jey on Tuesday March 07, 2017 @03:08AM (#13808972)
Why does this happen? Is there some subcontractor who just bills by the piece so they don't care about de-duping the idiotic mailmerge that has 5 entries for each entity I'm affiliated with?
Re:Ask HN: Who really gives your personal info to Intelius, ... by edwhitesell on Tuesday March 07, 2017 @07:53AM (#13809938)
In the case I listed above, these are separate, distinct letters. Certainly from an automated process, but clearly all part of a larger marketing program.

In the ones like Dell (which I've also experienced in the past), I suspect there's some metric involved for getting the most contacts for "coverage". The reality is unless they were tracking my moves to different companies, there could be different people with the same name. In that sense, I'm very glad they can't correlate with employment data.

There's also the idea that sending to multiple people within a company means someone may see something they want and try to go through the procurement process because of the catalog, rather than because "IT" says it's time for a refresh.

Not that I agree with any of those practices, for a number of reasons, but I could understand the case for them.

Re:Ask HN: Who really gives your personal info to Intelius, ... by jdeibele on Saturday March 11, 2017 @10:45PM (#13848817)
Cable and phone companies don't seem to care about efficiency in their marketing efforts. Almost everywhere they're allowed to count it as an expense and fold it into their regulated costs and make a regulated profit off it.

Putting on my cynic hat, buying lots of newspaper, television and radio ads is a good way to keep the media on the sidelines instead of criticizing the incumbents.

Re:Ask HN: Who really gives your personal info to Intelius, ... by tjalfi on Tuesday March 07, 2017 @01:14AM (#13808614)
You want a USPS form 1500 (https://about.usps.com/forms/ps1500.pdf). The intended use is for reporting obscene mail but the decision about whether something is objectionable is left up to the addressee (Rowan v. United States Post Office Department - https://www.law.cornell.edu/supremecourt/text/397/728).
Re:Ask HN: Who really gives your personal info to Intelius, ... by JoshTriplett on Monday March 06, 2017 @03:02PM (#13805582)
Re:Ask HN: Who really gives your personal info to Intelius, ... by bogomipz on Monday March 06, 2017 @06:06PM (#13806919)
>"the USPS has a detailed process for formally putting a company on notice for mailing someone who has specifically unsubscribed, and that process ends in massive fines for continued mailing to that person."

I am doubting this is enforced in any meaningful way. I don't doubt there is a well-detailed process however the US Post Office's bread and butters seems to be Dell Catalogs and Southwest Airlines credit card offers. This fact is what killed Outbox:

http://www.insidesources.com/outbox-vs-usps-how-the-post-off...

Re:Ask HN: Who really gives your personal info to Intelius, ... by compuguy on Monday March 06, 2017 @03:10PM (#13805648)
Dell is pretty bad. I get every month three (when one is more than enough) catalogs to my address, because of slight variances in my name, even though they are all the same person.
Re:Ask HN: Who really gives your personal info to Intelius, ... by notwhoyouthink on Monday March 06, 2017 @03:52PM (#13805957)
We get four catalogs a month to three different people, one of which gets two catalogs; one addressed to their role as Vice President, and one as Boardmember.

We don't even want _one_ of them. It's not like we're going to see a new printer in a catalog and say "hey, sounds like a great buy!"

Re:Ask HN: Who really gives your personal info to Intelius, ... by TheSpiceIsLife on Monday March 06, 2017 @08:59PM (#13807746)
Maybe the solution is to sign up about 3000 people at every address you've ever lived at, if all of us sign up for hardcopy catalogues everywhere under every variant of our own names and fictitious names maybe they'll eventually stop or go out if business.
Re:Ask HN: Who really gives your personal info to Intelius, ... by cmdrfred on Tuesday March 07, 2017 @08:47AM (#13810239)
Why bother yourself or the new residents of your home? Sign up any Dell related outfits (resellers, etc) for them instead.
Re:Ask HN: Who really gives your personal info to Intelius, ... by ssully on Monday March 06, 2017 @02:11PM (#13805160)
People, like myself, pay a monthly fee for credit monitoring services. A lot of these services will identify if personal information of yours is publicly available on the web.

I only know of Instant Checkmate because my fiancé uses Mint Credit Monitoring and they notified her that her info was available on that site. I promptly helped her opt out of the site. I would have loved if Mint just had a 'Help me purge my info from this site' button, because I felt dirty just having to confirm my Fiancés info was on that site and then go through their process to remove it.

Re:Ask HN: Who really gives your personal info to Intelius, ... by bogomipz on Monday March 06, 2017 @06:10PM (#13806954)
>"I don't think too many people will pay a monthly fee to have their information removed from these services."

I would be interested in hearing what are you basing this on? Did you do some market research?

My feeling is that there is money in privacy, people seem to have no problem paying 5 or 10 dollars a month for a VPN provider for instance.

Re:Ask HN: Who really gives your personal info to Intelius, ... by jameslk on Monday March 06, 2017 @09:05PM (#13807764)
I can't remember the exact reasons since it was something I was researching a couple years ago. I saw a few competing services that offered annual plans in the $50-$100 range and I think I divided that by 12 and then imagined what would happen when people got most of the value out of the service on first use. It seems to be a very niche market and I'm not sure how much of a pain point it really is to that niche.

I had some other ideas to differentiate, which were a bit of a gray-area hack. This included pulling from the same data sources that Spokeo and similar services use to be able to search for that data. That way, the user wouldn't have to enter any personal information other than say an email address.

You could then offer a free service that let users enter their email address and they would find all the sites you've crawled where you found their information (similar to haveibeenpwned.com), with an upsell to automatically remove it.

Once a subscriber was signed up or previously had used the free service and hadn't opted out, I would keep crawling services for additional data and then give them a warning email when their data popped up again.

It seemed like a semi-reasonable business model at the time, but just a really small market, and I had other business ideas I wanted to pursue.

Re:Ask HN: Who really gives your personal info to Intelius, ... by bogomipz on Monday March 06, 2017 @10:42PM (#13808106)
Interesting points. I wonder if giving the customer visibility into events like "you data was successfully removed from X" would make a difference? Similar to peeking at your Spam folder now and again to see that it is working for you.

Also about the market size I imagine the market is just US? It seems other places, at leas Europe anyway has better laws to protect against these kinds of invasive services.

Re:Ask HN: Who really gives your personal info to Intelius, ... by shshhdhs on Monday March 06, 2017 @02:30PM (#13805325)
What about pay-per-record? If you identify 100 records? You could charge $50 (50 cents per record, as an example). Shows the value versus a blanket annual fee. The price-per-record could be reduced for the more records they have, or capped at $100 or something.
Re:Ask HN: Who really gives your personal info to Intelius, ... by npezolano on Monday March 06, 2017 @02:43PM (#13805436)
Why not structure the company as a public benefit corporation or a non-profit?
Re:Ask HN: Who really gives your personal info to Intelius, ... by JoshTriplett on Monday March 06, 2017 @05:31PM (#13806681)
> Why not structure the company as a public benefit corporation or a non-profit?

This seems like a good idea; I'd happily support such an endeavor.

Re:Ask HN: Who really gives your personal info to Intelius, ... by EmielMols on Tuesday March 07, 2017 @05:09AM (#13809389)
You could always "enhance" the business case by selling "whitelisting" to some of these data collection services. Just ask the guy from adblock plus.
Re:Ask HN: Who really gives your personal info to Intelius, ... by samstave on Monday March 06, 2017 @03:28PM (#13805791)
What about letting a user enter all their pertinent details, then having a "NUKE ME" button and it would eval how many sites and places to nuke from, and you base your costs to the user based on the effort to nuke the info you find. Then give a very straightforward list to the user and let them select which site/item they want to nuke and provide an upfront cost to them.

* You're found on sites 1, 2, 3

* Nuking site 1 is $10.00

* 2 is $1.50

* 3 is $22.55

---

Or something like that?

Re:Ask HN: Who really gives your personal info to Intelius, ... by Dotnaught on Monday March 06, 2017 @07:09PM (#13807279)
Offering a reward that rises in proportion to the number of sites with your personal information might just provide an incentive to create more such sites.

The more you'd pay for privacy, the more it would be worth to violate it.

Re:Ask HN: Who really gives your personal info to Intelius, ... by samstave on Monday March 06, 2017 @08:44PM (#13807691)
Game theory on your comment, sure... but I was just referring to "price per record/line item" -- how to separate these???
Re:Ask HN: Who really gives your personal info to Intelius, ... by ccvannorman on Monday March 06, 2017 @06:26PM (#13807047)
>I don't think too many people will pay a monthly fee to have their information removed from these services.

$5-10 a month right here, and I am not rich (yet). Time is valuable. My offer goes up with assurances/contingencies if my name is still on the lists/I am affected (e.g. LifeLock's $1M backing guarantee).

Re:Ask HN: Who really gives your personal info to Intelius, ... by SomeCollegeBro on Monday March 06, 2017 @03:15PM (#13805695)
Well, there could be a possible solution to your first problem: offer both a high priced one-time removal attempt, or a recurring subscription with a minimum contractual obligation (6 months for example).
Re:Ask HN: Who really gives your personal info to Intelius, ... by gcb0 on Tuesday March 07, 2017 @10:58AM (#13811368)
why would people pay for the opposite of what they daily work on at Facebook for free: sharing their private life.

the new generation grew up with spam and giving out private info like there's no tomorrow.

I may sound like a pessimist, but try to talk to any 14-16 year old and see for yourself.

Re:Ask HN: Who really gives your personal info to Intelius, ... by Sunset on Monday March 06, 2017 @04:55PM (#13806386)
What about a better business idea. Accept cryptocurrency to shut down these aggregating and re-selling services. Physically, by any means necessary. ANY.
Re:Ask HN: Who really gives your personal info to Intelius, ... by mirimir on Tuesday March 07, 2017 @01:01AM (#13808577)
Obligatory reference to https://cryptome.org/ap.htm
Re:Ask HN: Who really gives your personal info to Intelius, ... by mikehollinger on Monday March 06, 2017 @03:14PM (#13805681)
I actually am running a (year long) experiment. I found a data broker who had my info. They offered a way to "correct" the record, so I added a car that I don't own (who's warranty should be ready for extended warranty offers in a few months) and added many many "off by one" errors like an extra zero on my income, or transposed digits on the size of my house.

We'll see where it lands.

I personally would also pay for this sort of service.

Re:Ask HN: Who really gives your personal info to Intelius, ... by mehrdadn on Monday March 06, 2017 @03:29PM (#13805811)
> I found a data broker who had my info.

How...? Or do you just mean sites like InstanCheckmate themeselves?

> They offered a way to "correct" the record, so I added a car that I don't own

That's amazing! They didn't need proof? How did you convince them? Is this legal?

Re:Ask HN: Who really gives your personal info to Intelius, ... by uiri on Monday March 06, 2017 @07:00PM (#13807227)
Is this legal?

IANAL

That said, fraud is usually defined as "An intentional misrepresentation of material existing fact made by one person to another with knowledge of its falsity and for the purpose of inducing the other person to act, and upon which the other person relies with resulting injury or damage."

So, in order for such misinformation to be illegal, the data broker needs only to demonstrate injury or damage. Unless the data broker makes assurances to their customer about the truth of the information and gets sued by one of their customers for providing false information, I find it hard to believe that the data broker will be able to demonstrate injury or damages.

I think the data broker knows better than to make such claims about their data but who really knows. And it isn't like the downstream customers are going to independently verify all the information.

Re:Ask HN: Who really gives your personal info to Intelius, ... by mirimir on Tuesday March 07, 2017 @03:07AM (#13808965)
That makes no sense, unless there's a contract, or at least a business relationship.
Re:Ask HN: Who really gives your personal info to Intelius, ... by literallycancer on Monday March 06, 2017 @06:53PM (#13807182)
Why wouldn't it be? It's not like you are lying on tax forms.
Re:Ask HN: Who really gives your personal info to Intelius, ... by otto_ortega on Monday March 06, 2017 @11:48PM (#13808343)
> I found a data broker who had my info.

What's the name of it?

Re:Ask HN: Who really gives your personal info to Intelius, ... by mehrdadn on Monday March 06, 2017 @01:00PM (#13804553)
I've come across sites like these (SafeShepherd, though it doesn't claim to wipe your information from the "sources", only the sites they see your information on); the problem is I'm not sure I would trust them with something like my driver's license photo. Would you? Or what if they decide to sell your information behind your back later?

Edit: Maybe it was a different site that needed your license (I thought it was SafeShepherd but I can't find it anymore). I know I've definitely come across ones that do.

Re:Ask HN: Who really gives your personal info to Intelius, ... by JoshTriplett on Monday March 06, 2017 @01:02PM (#13804580)
I wouldn't trust them with a driver's license (why would they even need that?), but I'd trust them with name/address/phone/email information, because that's the information that seems far too readily available already.
Re:Ask HN: Who really gives your personal info to Intelius, ... by mehrdadn on Monday March 06, 2017 @01:09PM (#13804642)
I know they need it because a lot of the info-searching sites that they "opt" you "out" from require it. I feel like I read that some need SSN too but I'm not sure about that one.

Also note that SafeShepherd has this fine clause right at the end [1]:

"You agree that Safe Shepherd isn't liable for any failure to comply with these Terms."

What is this supposed to mean? Would you accept it?

[1] https://www.safeshepherd.com/tos

Re:Ask HN: Who really gives your personal info to Intelius, ... by LeoPanthera on Monday March 06, 2017 @01:40PM (#13804942)
Well that seems to imply that if you violate the TOS, it's your fault, not theirs. Seems reasonable?
Re:Ask HN: Who really gives your personal info to Intelius, ... by mehrdadn on Monday March 06, 2017 @01:49PM (#13805010)
It also implies if THEY violate their TOS, it's your fault, not theirs. Seems reasonable?
Re:Ask HN: Who really gives your personal info to Intelius, ... by fanpuns on Monday March 06, 2017 @04:47PM (#13806345)
There was a time (not sure if it's still the case) that the sites that post your info require proof of identity to remove your info
Re:Ask HN: Who really gives your personal info to Intelius, ... by devicenull on Monday March 06, 2017 @02:31PM (#13805327)
SafeShepherd seems like it's dying. They were active shortly after launch, but it's basically been radio silence ever since. I used to have an account with them, and I didn't find much value from them after the initial cleanup wave (they didn't seem to be keeping up with the new sites that came online).
Re:Ask HN: Who really gives your personal info to Intelius, ... by jquast on Monday March 06, 2017 @01:06PM (#13804611)
This service exists, I've used it, can vouch for it. https://www.abine.com/deleteme/landing.php
Re:Ask HN: Who really gives your personal info to Intelius, ... by LeoPanthera on Monday March 06, 2017 @01:12PM (#13804674)
This Reddit comment suggests DeleteMe doesn't work so well.

https://www.reddit.com/r/privacy/comments/3q0cfz/thinking_ab...

Re:Ask HN: Who really gives your personal info to Intelius, ... by dbg31415 on Monday March 06, 2017 @06:17PM (#13806999)
Can confirm... manually went through and opted out of everything I could find... made me feel shitty because I had to provide photos and ID card photos to do it... less than a year later it was all back again. Hired one of the services to do it the second time around... they got maybe 50% of it... and less than a year again it was all back (note I was still paying the monthly subscription to have it all purged). Worse... I had to tell them what sites I found that they missed and waste time dealing with support issues... and let's be honest neither the companies who put the shit up, or the companies who you pay to take it down, are all that honorable. Extortion, pure and simple.

Wish Google would just kill their site rankings, that would largely make the problem go away. Google is allowed to de-list spam sites... why they haven't classified all this crap as spam yet is beyond me.

Re:Ask HN: Who really gives your personal info to Intelius, ... by JoshTriplett on Monday March 06, 2017 @01:44PM (#13804972)
Quoting that comment:

> Your information will show up on those sites sometimes - it'll pop back up after being removed.

That suggests that they're not actually tracking down the sources, just poking the downstream sites that get data from those sources. Much less useful.

Re:Ask HN: Who really gives your personal info to Intelius, ... by justin66 on Tuesday March 07, 2017 @12:09PM (#13812186)
The sources include government agencies at the state, local, county, and federal level. Those agencies are not going to hide public documents with your name and address on them just because you ask them to.

There's a legal process to, for example, expunge a criminal record. On the other hand, most counties aren't going to seal the records associated with your house or other property you've bought just because you would like them to.

Re:Ask HN: Who really gives your personal info to Intelius, ... by jszymborski on Monday March 06, 2017 @06:50PM (#13807174)
I've been recently:

1) Segregating automated email to some @customdomain.com address (Yandex and Zoho host vanity domains for free)

2) Forward all email @ that domain to a common inbox

3) Sign-up with [email protected] (e.g: [email protected])

You no-longer need to unsubscribe using dubious e-mail links, just automatically black-hole emails that come from [email protected]

So, far, so good.

EDIT: List formatting

Re:Ask HN: Who really gives your personal info to Intelius, ... by JoshTriplett on Monday March 06, 2017 @07:09PM (#13807281)
Useful for email, but this is primarily about postal spam.
Re:Ask HN: Who really gives your personal info to Intelius, ... by jszymborski on Monday March 06, 2017 @09:05PM (#13807762)
somehow misread this entire post
Re:Ask HN: Who really gives your personal info to Intelius, ... by o_____________o on Wednesday March 08, 2017 @05:34PM (#13824574)
This also helps obscure the very widespread practice of selling data to third parties that identify you with a stable, cross-purpose ID. (Liveramp, et al)
Re:Ask HN: Who really gives your personal info to Intelius, ... by vonklaus on Monday March 06, 2017 @04:11PM (#13806073)
i think the best way to handle this is exactly the opposite. go on mechanical turk, and pay $500 to have them fill out every single free offer, product trial, social media account, ect with slightly similar but incorrect information. Give each turk 10 different pictures that look very similar to you, or are you in bad lighting, and pay them to upload them to G+, FB, ect.

It is much easier to make your correct info difficult to ascertain, than it is to remove it all.

Re:Ask HN: Who really gives your personal info to Intelius, ... by JoshTriplett on Monday March 06, 2017 @05:20PM (#13806589)
Then they'll just spam all of them. And if you have other reasons to not want to be tracked down, then having 20 or 30 addresses will not help much.
Re:Ask HN: Who really gives your personal info to Intelius, ... by mirimir on Tuesday March 07, 2017 @01:07AM (#13808594)
> junk mail

Back in the day, junk mail often had "Return Service Requested", and senders had to pay return postage. So we would tape address labels to cardboard-wrapped bricks, and mark them as "moved with no forwarding address". But that doesn't work anymore.

Re:Ask HN: Who really gives your personal info to Intelius, ... by fanpuns on Monday March 06, 2017 @04:41PM (#13806304)
Here you go: www.safeshepherd.com

I've been using them since way back when they were on earlibird. It's not perfect, but it has reduced the amount of times I show up in these sites significantly. The only disheartening thing is that most of these operators seem to just dump in batches of data periodically, ignoring any prior requests to remove so it has to be done again (which is fine, that's what you pay their automated search and remove request feature for)

Re:Ask HN: Who really gives your personal info to Intelius, ... by ChuckMcM on Monday March 06, 2017 @07:10PM (#13807284)
https://en.wikipedia.org/wiki/Safe_Shepherd

These guys don't do it for you? Basically it is there business plan.

Re:Ask HN: Who really gives your personal info to Intelius, ... by ams6110 on Monday March 06, 2017 @11:18PM (#13808243)
I have a foolproof plan for junk mail: I throw it away.