Consumerist
If your company is in the habit of using a "donotreply.com" address in the "From" field of its emails, you might want to forward your IT department this entry from the Washington Post's "Security Fix" blog—when customers don't pay attention and reply to a "donotreply.com" email address, it goes to Chet Faliszek, a programmer in Seattle who registered the domain seven years ago.
With the exception of extreme cases... Faliszek says he long ago stopped trying to alert companies about the e-mails he was receiving. It's just not worth it: Faliszek said he is constantly threatened with lawsuits from companies who for one reason or another have a difficult time grasping why he is in possession of their internal documents and e-mails.
It probably seems obvious that if the email address includes "donotreply," that means you shouldn't hit "reply." Of course, in the real world customers don't pay attention, or figure it's an empty threat and someone will read it. Faliszek said he's received sensitive information from Capital One customers, reports on security vulnerabilities for a New Jersey bank that's now part of PNC, and reports on supplies and locations for troops in Iraq from a former subsidiary of Halliburton.
When the emails are trivial, he deletes them; when they're big topics like the ones just listed, he'll blog about them in order to embarrass the company responsible for such a dumb and lazy policy.
"I've had people yell at me, saying these e-mails are marked private and that I shouldn't read them," Faliszek said. "They get all frantic like I've done something to them, particularly when you talk to the non-technical people at these companies."Instead, he blogs about the most interesting ones. Companies embarrassed by having their e-mails posted online can get him to pull the entries from his blog for a small payment. The normal fee to be removed from the site is proof of a donation to an animal protective league or humane society. So far, Faliszek says his blog has raised roughly $5,000 for local dog pounds.
"They Told You Not To Reply" [Washington Post] (Thanks to Alexa!)
(Photo: Getty)
Comments
If only I had thought about that first...
Oh well, I hope he's honest about it and doesn't use it for personal gain.
isnt the normal donotreply email "Donotreply@companyname.xx"
Seems more of extortion than just charity raising for some dogs. Needless to say, this is an interesting read, but one can only wonder how many secrets this man really knows and if he truly gets rid of the trivial things. I'd bet he makes more on the side and refuses to discuss or acknowledge it because that's tax-free money for him when no one knows...
Use example.com/net/org instead -- they're the three domains withheld from the registry pool for, well, documentation and the like. I use user@example.com when forced to give an email address that isn't actually required.
This is the flip side of the "Your call may be recorded" garbage. How awesome would it be if we routinely and legally recorded our CSR calls and posted the transcripts, or the audio, on the web?
Would it not be the biggest score evah if we were able to contact these rotten companies, who profess that "your call is important to us?," and tell them that we will publish the contents of their lousy CSR unless they coughed up some quid? Maybe they would actually take care of the problem about which we contacted them in the first place?!
A guy can dream, can't he?
@超外人: didn't know I could use asian fonts in my username. sweeeeeeet. 한국어를 사랑해!
Let me get this straight... this guy comes into possession of confidential information (by virtue of accidental disclosure), posts it on the internet, and then agrees to remove it for a small fee.
This sounds like that time I took pictures of that politician/celebrity with the hooker/little boy and promised not to show them to anyone if he paid me ten million dollars.
@Trojan69: call me an idiot, but cant we record the calls legally? Don't see why not, especially if we said, "oh btw we're recording this, so don't screw it up"
@Redwraithvienna: Well, obviously it SHOULD be, but as this story indicates, it obviously is not. That simply remedy, though, would solve this problem entirely. Hopefully, some of the upset companies will take note of that.
These companies should definitely know better. Too many idiots in charge.
I'm pretty amazed by the brazen-ness of his donate to remove policy. I can't comment on the legality of it, but it does seem fairly extortionary.
I should point out that this is the same Chet that was a main writer for oldmanmurry.com (sadly not what it once was) and is still part of portalofevil.com. He also, with another guy from OMM, wrote the dialog for the game "Portal."
The man is a legend, as far as internet legends go, and something like this is the very LEAST that can be expected of him.
@Bladefist-안녕: Depends on the state, but in Indiana as long as one party knows a recording is happening then it's legal. You wouldn't have to tell the person on the other line that it's being recorded.
@m4ximusprim3: in his FAQ he says the donation is merely a request. He'll remove emails even without the donation.
A few years ago we had a spammer exploit a "Letter to the Editor" feature of our site and use it to send out spam. This got us on the spamhaus blacklist. They required a $50 donation in order to get us off the list.
@m4ximusprim3: I think it comes from the fact that since they sent the emails to him, and the company hasn't done anything to prevent this, he has no obligation short of a lawsuit to remove such information as he's been made a party to it.
Now, in return for a small donation (which the company can boast about), the dirty laundry disappears. It's a win-win for all, especially since he's not getting any personal gain from it.
@m4ximusprim3:
@Dr. Chim Richolds:
The difference is that the act is already done (Info posted). In blackmail/extortion, it is do this or I do that, not do this and I'll undo that.
How would anyone have time to comb through millions of email a week? The concept is tremendous -- capitalize on stupidity; just wondering how he has that much free time
Whether it's legal or not to publish the data on blogs, someday some big company with deep pockets is going to come along and smack him. Mind you, I support this guy - some idiot puts a valid reply-to address that's not his own, he should expect someone at that reply-to address to read replies to his mail. But the whole posting it on a blog thing kinda makes me cringe, like watching a auto crash about to happen.
Honestly, he could probably get away with charging a direct fee to the idiots for "processing". If they aren't smart enough to keep this from happening, they should have to pay someone for it. The companies in question are putting people's security at risk...from our personal info to US soldiers' lives...
@humphrmi: Sue him for what exactly?
@超外人: How is it extortion? He registered the domain *eight years ago.* All the companies that use "donotreply.com" in their e-mails are trespassing on his chattel--using his property without his permission. If they are too lazy to set up a black hole e-mail address at their own domain, I have no sympathy for any of them. I can just imagine the heavy-handed approach some of those lazy companies take, too, to try to beat him up with bluster over their lack of due diligence. While blogging about the messages seems like he's just inviting the Death Star to target his Alderaan, he does say:
Corporations helping needy animals to cover their laziness and stupidity seems like a reasonable exchange to me.
@Hossofcourse: He's a programmer, and a pretty darned good one. I'm sure he's got a crawler that only puts the juiciest ones in his inbox, or at the very least a good set of filters set up.
D
@超外人:
How it is extortion when they are using his domain? No one forces them to do that; they do it out of their own stupidity or lack of interest in customer privacy.
He pays for his domain; other companies have no right to use his domain for their own purposes.
It's definitely good to know that this domain is in the hands of a guy with some scruples. This story could be a whole lot worse.
When I was in college majoring in journalism, I was told that so long as one party knows that a two-party call is being recorded, then it's a-ok, and you don't even have to give them a disclaimer, at least within my state. It's considered bad form, and likely to piss people off, but nonetheless legal.
It's important to note that warrantless wiretapping is still illegal under this doctrine, because the government is NOT a party to every phone call ever made.
@marsneedsrabbits: Hell, they are even making him incur a cost. They are using up his bandwidth, storage space, and hell, maybe even using up his allotment of email filters.
If you're calling a company and you hear "this call may be recorded for quality and training purposes" where does it say which side is recording? doesn't it say that you can record the call for quality purposes? as in the quality of service you are receiving? does anyone if this has been challenged legally?
@socritic: Essentially, they are saying THEY are recording for non-court related issues. Legally, they are notifying you that they are recording to satisfy the need to know for 2 and 2+ party states. What you do with a legally recorded conversation is limited to legal uses. Posting it, using it in court, etc.
It's not just businesses who are dumb. Based on the registration info I see on my site, whoever owns nospamplease.com and noneofyourbusiness.com must have access to about 900 usernames on every website known to man. Whoever owns asdf.com also owns quite a few more Chowhound accounts than they likely know what to do with.
@ trojan69 and bladefist:
The term you're looking for is "Single-party Consent". Check your state's legal code to see if they allow for it in recording conversations. If they do, only one party involved in the conversation needs to be aware of it being recorded. I'm no lawyer, but I think you can probably get away with recording all your conversations anyway, provided you do so only for your own personal use (You can't actually use the conversation itself against anyone, but it can help your memory in dealing with them later). But if you're going to do that...man, you're paranoid!
"companies who for one reason or another have a difficult time grasping why he is in possession of their internal documents and e-mails"
Classic!
Hmm, example.com seems like a better domain to use than donotreply.com ;-)
If you go to his website he explains that the donation is entirely optional. No one is extorting anyone.
Shazbot!
@humphrmi: I hope the company that does that Googles Streisand Effect first!
He can charge as much as he wants to remove the emails, he chooses to be a 'good guy' and direct the people to donate. I guarantee you most other domain owners wouldn't be so kind.
IT IS NOT EXTORTION
While he may be donating to charity, he's still an ass. I can understand no wanting to bounce the emails (traffic, spam, ect), but why not just silently send them into oblivion? Its not hard, it may break RFCs but I'm sure they'll make an exception.
Even better donate the domain to the IETF, and let the modify the current RFC to drop any email to the domain. Someone respectable (as far as the net goes, they're pretty much godly) gets the domain, your data stays safe.
This is one of the things I really wish I'd thought of first.
@Dr. Chim Richolds: If you actually read the blog, he redacts all the sensitive information.
I got a new hobby -- every time I see a donotreply, I'll write and ask Chet how he's doing. Got a new buddy too
@dodonnell:
I am adding that phrase for my personal use. Genius.
@超外人: Dog fundraising requires extortion. It is well known that dogs are very poor negotiators.
@Khabi: Why do you hate dogs?
@marsneedsrabbits: "How it is extortion when they are using his domain?"
It really doesn't matter how the domain owner acquired the information -- threatening to reveal information that would cause harm to reputation (i'm bloggin' your embarrassing story) or person (i'm bloggin' ur troop movements) unless money or services are provided is extortion.
@SuperJdynamite:
Go ahead and reveal troop movements. One day an injured vet will grab his handy 9mm and use on your ass.
@SuperJdynamite: Thank you, counselor. Could we please have a short memo outlining the elements of extortion? You can limit it to whatever state you're admitted in.
@apex:
Oops. Guess I should have followed the link. Oh well... as long as the confidential information is deleted, I'm not too upset... still seems a bit rougeish to me, but it could be a whole lot worse.
Anyone thinking extortion needs to consider he's not preying on innocent emailers -- in fact he's taking extra steps not to reveal personal information. He's outing extremely stupid major businesses. If he purchased a house on "One Acme Way" and Acme Corp sends out notices that say send all complaints to One Acme Way knowing that they don't have an mailbox there -- is it extortion to agree not to publish the fact that this company was this stupid in exchange for a small donation to the dog pound? Seems to be a small consulting fee about how to conduct business