If only we all had access to the Secret Service. Lots of modern games make use of P2P behind the scenes (e.g. for voice chat), which means that maladjusted script kiddie I just sniped already has my IP and might decide to forego DDoSing me and skip straight to calling in a hostage situation at my home address. Being able to easily resolve a concrete address from an IP is certainly a bigger deal than being able to determine its ISP.
The last time I mentioned how disciplined our military was compared to seemingly trigger happy police though someone said quietly to let the military our of the barracks and live in my neighborhood as well as occupy public space everywhere within the country and my opinion will change within a few years. I suspect this is true. I don't have any solutions to this militarization, just wanted to point out that doxxing isn't there real problem but rather the swatting is.
The problem is that SS7 still allows anyone and their dog to spoof phone numbers. Swatting will always work because a (real) hostage situation is among the worst things that can happen for police, the others being terrorist attacks and serial killers.
Swatting can only be prevented reasonably by fixing telephony signalling and throwing the ones doing it into jail for a couple of years.
> Swatting will always work
Because ALSO most forces can't spend the money to train their police in hostage situations. It isn't just giving them big "toys" that they want to play with. It isn't that they aren't trained. It is that it is impractical to train them.
I get that it is impractical for Olathe Kansas to train all it's police force in hostage negotiation and deescalation when most likely none of the force will ever use it but what is the alternative? We can't just bus the same negotiation team across the country every time. If we could, EPA wouldn't have its own armed servicemen, right? Also there wouldn't be a Port Authority Police Department in POrt Authority of New York and New Jersey, right?
Basically, I imagine if you wear the equipment and gear for seat, you must be trained for it and we'll qualified in it. If not, then don't carry the gear. No?
> Exposing information about someone that is largely already public
A home address may be public, but the connection between that address and online activity, like posts on reddit / HN / some forum (political? fetish/porn? extremist? etc etc), is very much not public. Last 4 of social is not uniquely identifiable, but a (partial) home address almost is.
> If you have a specific target, you probably know their name
Not if they're being careful, like anyone would be if they don't want their posts online mapped back to them. But now you can DM them a link (or email them an image if you have an email address or redirect) and turn their IP into a home address. That's very bad.
Doxing someone isn't just exposing an arbitrary address, it's connecting a purportedly anonymous online account with personally identifying info.
Going back to the president, what if you could find out that some angry anonymous person posting racial slurs online was actually the POTUS? That is doxing.
Saying this is a really bad vuln because you aren't as private as you think you are online is like saying lock picking is a really bad vuln because you didn't know door locks could be opened by anyone with a bent piece of metal or a shaved down key. Locks don't actually keep bad people out. They just make people feel safe. Same with this idea that your IP is anonymous. It's really not. It's a literal address.
While I agree with your general sentiment, I hope you appreciate the irony of this particular example.
Still is, depending on the canton. For Zürich you get 5 lookups per day per IP[0]. For other cantons they might charge you a swiss franc or so [1]. Cantons that charge 10-20 CHF and require a reasoning for why you need this data are in the minority.
[0] https://stva.zh.ch/internet/sicherheitsdirektion/stva/de/StV...
Irrelevant, since Comcast already hands this information over to such parties willingly.
I have the President of the United States' address. 1600 Pennsylvania Avenue. Oh no! I done dox'd him!
Exposing information about someone that is largely already public is somewhat bad, but it's not "really, really bad". And it's certainly not worse than exposing the last 4 of their SSN.
There are many ways to dox people. If you have a specific target, you probably know their name; if not, you can phish it, and any other information you want. If you have their IP, you know their ISP. With their name and their ISP, and maybe some extra info gleaned from various sources like social media, you can get pretty much anything you want. Account access, phone numbers, billing information, socials, etc. With their phone number you can take over their phone, and then all their SMS-linked accounts.
Is this scary? Yes. Did I need to slowly extract their home address using a vendor's web form and their IP? No.
The last 4 of the social is much worse. It makes all of this incredibly easy and gives access to much more sensitive information, like medical records, payroll, government service information, etc.