![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
buying ISP domains, a good idea?
Jun. 7th, 2011 02:20 pmSo PrismNet has said it sold off the io.com domain and won't tell us to whom. Doesn't seem like much, right?
Except it is. It is a huge deal. And not just for those who currently have io.com email addresses.
Back in the golden age of a zillion ISPs, you didn't buy your own domain. You hosted on someone else's. Your account was YOURNAME@ispdomain.com, and your website was often www.ispdomain.com/~YOURNAME. This was true for io.com, for erols.com, and continues to be true as a service offered by a number of cable and phone companies, as well as a handful of 90s-era ISPs still out there.
Prismnet acquired io.com (originally owned by Steve Jackson, as Illuminati Online, a spin-off of the BBS that the secret service tried to kill in 1990) sometime in the mid 2000s. Out of my loyalty to SJ, io.com was my first hosting company, and I quite liked how they ran it. When Prismnet came along, they (unlike A Small Orange's acquisition of Drak) changed the pricing structures to things that were horribly out of whack with industry practices. I'd have paid my "lifetime" drak price and only gotten about 2 years, with fewer services and less support. Needlesstosay, prismnet had to go.
BUT that meant going through every single place out there that was legitimately sending me email and changing my email addresses. That took time. And I know I didn't get them all. I know that plenty of them ignore the email change and continued to send to the old one long after I'd said I'd changed it. I also know that plenty of spam services out there have that ancient email, thanks to how public I was with it back in the 90s, particularly in usenet (AFR).
Spam messages tell someone a lot more than just that I'm a guy named Joe who doesn't need viagra. If your email address is sold (perhaps in violation of terms of service, but there you go), it is often sold with other marketing information about your interests, and even perhaps your name and things you've bought from the company that sold you out. The address might also be linkable to other online services and eventually connect to your real address (whois is horrible for this).
While Prismnet was still the owner of io.com, I could trust that they were a legitimate business that would be taking all email messages still floating out there going to acroyear at io.com and routing them into the /dev/null bitbucket. Good riddance.
Except that's no longer the case. acroyear at io.com is no longer trustworthy. The new owners of io.com could configure their email systems to capture all io.com email traffic intended for current and former io.com customers, and perhaps some very personal information being sent by someone who didn't get the memo that your address changed (acroyear at io.com is still in plenty of address books out there I'm sure...). Rather than route it to null, they could be capturing that and selling it to other servers that will use that to connect your old address to your new one and put you in touch with a whole new level of spam hell you never thought possible.
The fact that Prismnet won't tell us who bought it is extremely troubling to me.
For the current customers still living on io.com addresses, its even more troubling to them: they now have less than 3 weeks to get everybody they know to change the email on file. Most probably won't get to them all until its too late and this new company gets serious, and *current*, private information about them.
And the trouble is that this is true for any domain that goes into the "available" bucket - a piece of what was once your identity is now no longer in your control, or in the control of a company you trust. This is a BIG deal...
[update] - I actually described a related problem with the resale of domains and addresses over 2 years ago.
Except it is. It is a huge deal. And not just for those who currently have io.com email addresses.
Back in the golden age of a zillion ISPs, you didn't buy your own domain. You hosted on someone else's. Your account was YOURNAME@ispdomain.com, and your website was often www.ispdomain.com/~YOURNAME. This was true for io.com, for erols.com, and continues to be true as a service offered by a number of cable and phone companies, as well as a handful of 90s-era ISPs still out there.
Prismnet acquired io.com (originally owned by Steve Jackson, as Illuminati Online, a spin-off of the BBS that the secret service tried to kill in 1990) sometime in the mid 2000s. Out of my loyalty to SJ, io.com was my first hosting company, and I quite liked how they ran it. When Prismnet came along, they (unlike A Small Orange's acquisition of Drak) changed the pricing structures to things that were horribly out of whack with industry practices. I'd have paid my "lifetime" drak price and only gotten about 2 years, with fewer services and less support. Needlesstosay, prismnet had to go.
BUT that meant going through every single place out there that was legitimately sending me email and changing my email addresses. That took time. And I know I didn't get them all. I know that plenty of them ignore the email change and continued to send to the old one long after I'd said I'd changed it. I also know that plenty of spam services out there have that ancient email, thanks to how public I was with it back in the 90s, particularly in usenet (AFR).
Spam messages tell someone a lot more than just that I'm a guy named Joe who doesn't need viagra. If your email address is sold (perhaps in violation of terms of service, but there you go), it is often sold with other marketing information about your interests, and even perhaps your name and things you've bought from the company that sold you out. The address might also be linkable to other online services and eventually connect to your real address (whois is horrible for this).
While Prismnet was still the owner of io.com, I could trust that they were a legitimate business that would be taking all email messages still floating out there going to acroyear at io.com and routing them into the /dev/null bitbucket. Good riddance.
Except that's no longer the case. acroyear at io.com is no longer trustworthy. The new owners of io.com could configure their email systems to capture all io.com email traffic intended for current and former io.com customers, and perhaps some very personal information being sent by someone who didn't get the memo that your address changed (acroyear at io.com is still in plenty of address books out there I'm sure...). Rather than route it to null, they could be capturing that and selling it to other servers that will use that to connect your old address to your new one and put you in touch with a whole new level of spam hell you never thought possible.
The fact that Prismnet won't tell us who bought it is extremely troubling to me.
For the current customers still living on io.com addresses, its even more troubling to them: they now have less than 3 weeks to get everybody they know to change the email on file. Most probably won't get to them all until its too late and this new company gets serious, and *current*, private information about them.
And the trouble is that this is true for any domain that goes into the "available" bucket - a piece of what was once your identity is now no longer in your control, or in the control of a company you trust. This is a BIG deal...
[update] - I actually described a related problem with the resale of domains and addresses over 2 years ago.
