Privacy Concerns with BBSs? reddit / bbs ---------------------------------------------------------------------- perm2069 · 2020-01-26 21:44 I have started to explore BBSs and overall it looks fun. One thing that I understand is that any information transmitted via Telnet is not secure. I am cool with this up until the point the BBS asks me to register and starts asking for personally identifiable information like first and last name, location, and gender. I suppose I could lie about it, but what if there are meaningful interactions that happen? If I do decide to put my real info in it, the transmission isn’t secure and the information is very likely stored in an insecure way. ​ I know I’ll have to make a decision if I want to participate in anything, but I was wondering if there was discussion about this anywhere (I couldn’t find any)? What are your thoughts on this subject? ---------------------------------------------------------------------- G_Porgie · 2020-01-26 22:23 While you are correct that the information is transmitted in plain text and isn't stored securely on most BBS's, the risk to you is very low to non-existent (as in, you'd probably win the lottery before your information was stolen from a BBS). This is truly the realm of security through obscurity. ---------------------------------------------------------------------- NuSkooler · 2020-01-26 22:56 A lot of us serve our boards via SSH and/or secure WebSockets (TLS). There is also work going into transferring Bink/FTN traffic over TLS. ---------------------------------------------------------------------- TheLimpingNinja · 2020-01-26 23:09 There is likely much more data from a Google search on Perm2069 (and following from there) and a simple user reddit analyzer... not sure why that simple data bothers you on a bus but not elsewhere. Edit: Sure downvote this, but the example with Perm2069 worried about the security of new user sign-up data is what I was questioning. I was able to pull all of that information plus more in about 3 minutes from his posting profile on Reddit and a Google search based on that data. I'm not saying we shouldn't secure data/transport, I'm just questioning whether everyone worried about new user birthdate actually realizes their disclosure surface. ---------------------------------------------------------------------- UnaClocker · 2020-01-27 00:27 Nobody says you have to use your real name and stuff. As for password, you should have a password manager and be using a unique one for each site and each BBS. ---------------------------------------------------------------------- [deleted] · 2020-01-27 00:30 Yeah, I always connect via SSH or a secure web socket if available. If it's a telnet-only board, I'll use all fake info. It would be great if TLS-enabled telnet was more of a thing at this point. As for everyone saying it's not a big deal to transmit this type of info in the clear, can you please respond with your full name, email address, birthdate, and location (city/state) to prove that this is simply an overreaction? ---------------------------------------------------------------------- [deleted] · 2020-01-27 00:31 I agree with this, but I still think it's easy enough to lock a board down to ssh/wss or something like that as a simple baseline added measure for keeping things secure. ---------------------------------------------------------------------- resmungomandinga · 2020-01-27 02:29 Using BBSes is what is called security through obscurity. 😁 ---------------------------------------------------------------------- nevarro · 2020-01-27 03:08 Yeah, I have a huge problem and consider it a significant barrier to signup when connecting to a new BBS and getting grilled for personal information (full real name, birth date, sex, phone number, email address, city, state, etc.). Not only would I be supplying this information to a perfect stranger, it's also often transmitted over an insecure protocol. I always make up this information when signup up for a BBS, but the question is, why require this information in the first place? It's certainly not necessary. More aggravating is, at least for Synchronet, these questions can easily be disabled during the signup process, but most sysops don't bother doing it. ---------------------------------------------------------------------- denzuko · 2020-01-27 04:36 Not true; while yes most boards and sysops wouldn't truly care. Fidonet does. ---------------------------------------------------------------------- denzuko · 2020-01-27 05:02 So elephant in room; What's the difference from any social media platform out there and BBSes? \*cough\* fb/reddit \*chough\* The answer; accountability. If, and that's an if larger than "what's on the other side of a blackhole", one does get their account cracked or data lost via bbs the following is going to happen: A) one's email is out on the internet B) one's password (maybe) would end up on some password list C) one's IP address (may or may not depending on the board's software) could end up getting scanned D) the sysop will have to eat crow if its his entire board was cracked instead of just one or two accounts because a few users didn't use a good passwords. In all seriousness I've been running bbs's since the 90's and for the most part user data doesn't get stolen. Nor do most put an PII ( personally identifiable information ). Those boards that did require it where operating as an ISP and thus needed it for billing info if there was to be any sort. Now, the telnet thing is less of a concern over the internet than on a lan being that if someone these days are sniffing your lan one has a world of other problems than their bbs account getting stolen. Plus as pointed out one should be able to tunnel it though stunnel/socat and get an encrypted connection if its not already provided by the sysop. The other side of this coin is as SysOps, or at the very lease this sysop, we tend to follow net neutrality and stay hands off on user data while keeping a backup offline on tape, zip, or cd. Myself, I use git to archive the whole board and store that directly to an encrypted s3 bucket. All in all this is a hobby for us so we're not about to sell your info to someone for advert tendies. It's not right nor is there anything we know as a sysop that ad companies would want to know anyways. All we get to know is what you put in and when you log on. ​ As a personal tip from someone whom use to be on hackers haven a lot; if one is needing extra "security" use something like mailinator for anything one sign up for and be reasonable with generating an id via [https://www.fakenamegenerator.com/](https://www.fakenamegenerator.com /) . Its not like we're going to look you up or anything but it is a trust factor kind of thing. We're inviting you into our home as a fellow nerd and potential friend/colleague. Try to be honest with the community we have. Its the reason why fidonet actually does require your real first & last name. ---------------------------------------------------------------------- stone_henge · 2020-01-27 05:52 If you are lucky, security through obscurity may work up to a point. However, if I had reasonable suspicion that I was being explicitly targeted by anyone on the route, I’d be wary even of using obscure protocols and applications that are insecure. ---------------------------------------------------------------------- [deleted] · 2020-01-27 06:27 [deleted] ---------------------------------------------------------------------- [deleted] · 2020-01-27 09:17 [deleted] ---------------------------------------------------------------------- Capitan_Picard · 2020-01-27 11:43 My real name is John Smith My address is 100 Main St Anywhere, CA 90210 (555) 555-5555 At least that's what I tell every BBS ---------------------------------------------------------------------- sacrilegious · 2020-01-27 20:17 Lie about your info, move meaningful interactions to email ---------------------------------------------------------------------- nevarro · 2020-01-27 23:06 >In all seriousness I've been running bbs's since the 90's and for the most part user data doesn't get stolen. Nor do most put an PII ( personally identifiable information ). Those boards that did require it where operating as an ISP and thus needed it for billing info if there was to be any sort. Hi denzuko, There are many BBSes today that ask for personal information during signup. For example, if you connect to any BBS with a near stock install of Synchronet and start to sign up as a new user, you'll see that it asks a slew of questions for personal information. Although I don't have a lot of experience with other BBS software, I've run into this same issue with other software as well during the signup process. I'll add that when asked these questions, there is a subtle pressure to provide real information because some BBSes require validation by the sysop before access is granted. > The answer; accountability. If, and that's an if larger than "what's on the other side of a blackhole", one does get their account cracked or data lost via bbs the following is going to happen: > >A) one's email is out on the internet > >B) one's password (maybe) would end up on some password list > >C) one's IP address (may or may not depending on the board's software) could end up getting scanned > >D) the sysop will have to eat crow if its his entire board was cracked instead of just one or two accounts because a few users didn't use a good passwords. There's more information than just email, password and IP address provided by users during some of these exhaustive new user signup processes. I've recently been asked for real name, city, state, zip code, phone number, sex and birth date. ---------------------------------------------------------------------- denzuko · 2020-01-28 04:36 Oh I'm quite aware of that. Wildcat was notorious for being hard set on getting actual personal data. Syncronet does ask but can accept blank spaces, while if I remember right renegade, WWIVnet, and telegard had to be configured to ask. Been over twenty five years since I've used either of those one (save maybe syncronet) so I could be off a bit. My whole point being though is unless the sysop is really stickler for all the extra PII one's not going to need to enter it nor is a sysop going to actually have anyone put that in. Plus the same concerns one faces with sites like fb/twitter/etc... are not there within the bbs world (not much of anymore, the well I'm looking at you -.-) since we're hobbyist not corporate cash cows for lobbyist. Overall it still doesn't stop one from putting lorem ipsum text in place or signing up for a p/h board that does anonymise users. Though it is good practice to use real names and at least city of calling as part of being a good member of the greater bbsing community and out of tradition from HAMs and old message nets like Fido. ---------------------------------------------------------------------- DVinson68 · 2020-01-28 08:33 And this account would be deleted from any of my boards because it is false information. ---------------------------------------------------------------------- DVinson68 · 2020-01-28 08:49 Exactly. I don't ask for any information that is not already in the public domain. REAL First and last name (required by Fidonet) Handle (How you are identified on the board and most other networks) City/State Gender (for certain message bases) DOB (For certain message/file areas) Valid Email address (So that I can let you know when your account has been upgraded, and/or if you forget your password so that I can send you a new one.) In the vast majority of boards, only the sysop will ever see your real name (unless you participate in Fidonet echoes) as well as everything else other than your city state, which might show up in the recent users list (ie: Lupine Furmen from Huntsville, AL). Your DOB, Gender and Email are never displayed to any of the other users unless YOU post them in a message board. Just one of the reasons why FIDO requires real names in most of its echoes is because, frankly, people tend to be less of an ass when they are not hiding behind a pseudonym. \--- Currently in the process of moving all services over to a machine, so the addresses may or may not work, depending on how seen to try to connect. :) \--- Furmen Family Internet Services. ​ BBS': Furmens Folly (FIDO 1:123/257) - telnet: [loybbs.net:23](https://loybbs.net:23) SSH: [loybbs.net:23222](https://loybbs.net:23222) Before the Web - telnet: [loybbs.net:23232](https://loybbs.net:23232) Legends of Yesteryear (FIDO 1:123/256) - telnet: [loybbs.net:23322](https://loybbs.net:23322) Sound Source \]|\[ - telnet: [furmenservices.net:2323](https://furmenservices.net:2323) ​ Other Services: IRC: [furmenservices.net:6667](https://furmenservices.net:6667) Furmen MUSH: Returning soon (?) Furmen Family Services WWW: [furmenservices.net](https://furmenservices.net) ​ My Personal Contacts: ICQ: 3582844 Hangouts: dallas.vinson Skype: dallaswv Discord: [dallas.vinson@gmail.com](mailto:dallas.vinson@gmail.com) Telegram: L\_Furmen Twitch: lupinefurmen FaceBook: [dallas.vinson@gmail.com](mailto:dallas.vinson@gmail.com) ---------------------------------------------------------------------- Capitan_Picard · 2020-01-28 09:22 But why? There is no reason why a BBS should collect this information. ---------------------------------------------------------------------- DVinson68 · 2020-01-28 14:25 Yes there is, which I outlined in my other post. ---------------------------------------------------------------------- nevarro · 2020-01-28 22:42 Ok, I see what you're saying. Thanks for clarifying. ---------------------------------------------------------------------- [deleted] · 2020-01-30 17:01 [deleted] ---------------------------------------------------------------------- SqualorTrawler · 2020-02-06 19:06 A better strategy is to make up a less generic sounding, plausible name, find an actual apartment complex in any city, use that as your address (make up an apartment number), with matching ZIP code. The address should be plausible, like if someone uses Google maps to look it up. As for phone numbers, I have a throwaway anonymous number for this sort of thing; there are a few options (VoIP, Google Voice, etc.) Google Voice is good because in the highly unlikely scenario that someone wants to actually talk to me I can forward it to my actual number. No one is getting my actual number, full stop. Once you set this up you can just continue to use it anywhere: a kind of "paper man," to borrow an old term. The reality is, people are only going to try to verify information which looks obviously false. Because of geolocation software, it is best to create an address in your own city so if your IP address is geolocated, it makes sense. In my case I use a VPN for all of that so it's the city where my VPN exits from. Periodically I mention this to someone and they say it sounds paranoid. To me it's just habit that is, in bits and pieces, decades old. I don't really think too much about it. As for Fidonet's idiocy, I have sincere doubts that most people (other than the sysops -- and even then it's questionable) use their actual real name. I've never seen anyone question or bring it up unless someone causes problems. Not causing problems is key here.