Sedo.com introduces trapdoors to the domain selling floor

Yesterday, I ate lasagna for dinner. I bought two history books from Barnes & Noble. I applied for a home loan. I played Counter-Strike for the first time after two months. I shaved off my goatee.

These are random, daily functions that pertain to me, the person. They are isolated incidents of my life that occur, more or less often, in various forms. Unless you live with me or you have a view through my home windows, they remain private to me or to whoever I decide to disclose them to.

Privacy, in today’s electronic maelstrom of a society, is a commodity as rare as honesty and loyalty. We have somehow been led to believe that if we buy items at the store using a credit card, it’s okay for the store to call or email us with offers of similar products. We have been led to believe that our eating, drinking and partying habits are okay to be shared, in photographs and videos on MySpace, hi5, Facebook and other “social networking” venues.

We have been shown the wrong way of living.

As if Mondays are not *the* worst days of the week alongside Fridays, today Sedo.com announced that a new set of features will be enabling users to conduct sales and business in an easier, transparent manner.

In all reality, what Sedo created today, is the prelude to doomsday as it pertains to privacy of domain transactions on this marketplace, that boasts millions of domains for sale.

Essentially, Sedo stopped short of announcing a “MySpace” type environment, with options such as seniority of sellers, the geographic location that they trade from, a rating system and a display of their tax options fully displayed via a link to any other person logged in the Sedo platform. Other added features that somehow made it past beta-testing without any concern from the management or the programmers, include displaying how long a domain has been listed for sale on Sedo and the option to link to their entire portfolio via the profile of any other domain they have on sale.

Sedo did one thing right and all of the rest wrong.

What Sedo did right, was the *option* to link to the rest of the domains in one’s portfolio – defaulting it to “No linking”. This, is solid programming concept at work. It’s the well-thought design of the programmer who wants to offer options but also respects people’s choices.

What Sedo did wrong, was the rest of it.

To create a Sedo account one needs a few seconds. It’s like signing up for Gmail or registering with Papa John’s pizza online. Once you create a Sedo account, the fun begins. The newly introduced features allow *anyone* with very basic programming skills to scour the live data of Sedo and scrape it.

It’s as if Sedo allows *anyone* with an account to take a long, satisfying snoop into your lounge while you eat. While you order books from Amazon.  Whether your home loan was approved. How many kills you landed at Counter-Strike. If you’re wearing aftershave or not.

It’s all about offering raw data, easy to be mined by anyone.

Sedo programmers need to be fired for a series of fundamental programming flaws. First off, the same suicidal approach that was used with the identification of the auction system is being used again: sequential numbers, ranging – for example – from 000001 to 99999999 and beyond. In order to view and gather transaction details, all one has to do is increase the number of the parameter describing the auction and store the results in a database. No confirmation needed. No session variables. Just full path variables that are exposed and tweaked to reveal the next in line. No captcha used in order to stop a scraper dead in its feet.

Having fun yet?

Sedo’s new profile features can be exploited to store aggregate data, linking each and every auction on Sedo to the person that made it. It’s not just like NameBio storing domains and sales prices scraped off the front page of Sedo; it’s about storing *every* auction’s info, the seller’s profile, their location, their ratings as seller and buyer, how long they have used the Sedo platform and how long the domain has been offered for sale – all IDENTIFIED by a unique, open (not hashed) id number.

Read further to understand how poorly Sedo thought of this new set of features.

Once our rogue scraper guy has created their Sedo profile, they can scrape the entire database of Sedo’s users – all 1.3+ million of it – including their unique id number and their location. Then, that unique id number can be further looked up and store their seller and buyer profile info. Once a sale occurs, the auction’s information can be stored as well.

The problem lies with the ability to link all these three together. It’d be a database containing identifiable information that can very easily be enriched with WHOIS data to fully pinpoint a seller’s achievements, strategies in pricing and time that these sales occured.

Did I mention that a lot of domains have WHOIS privacy protection but once listed on Sedo the seller’s location is revealed?

I will refrain from creating a proof of concept, at this time. But frankly, it takes $50 to pay a programmer from India that’d rummage through the freely available “features” and safely store it all away, without Sedo even being aware of it happening. To them, these are “features” that enable users to conduct business better. To me, it’s a violation of my privacy rights and an open welcome to data miners.

Programmers take orders from project managers. Whoever managed this project needs to go back to college.

I urge everyone who sells domains on Sedo.com to contact support@sedo.com and raise their strong objection to this set of wide open trapdoors on the domain selling floor.

Comments

  1. Well, really what it takes is someone like you to exploit all the exploits to make the point with Sedo!

    Sedo is only going to listen to the chosen few that make them the most revenue.

    Rich

  2. Rich, that’d be like shooting myself, wouldn’t it? I want to use Sedo as my selling platform, all while maintaining the minimum privacy that Sedo proclaims so much. I am not out to make an example of them; I want them to see what a flawed approach they’ve taken down the throat from their marketing team.

  3. Nice writing style. I agree with all of your comments.

  4. Thank you, Rick.

    Apparently, Sedo has now worked towards fixing the database interfacing problem that exposed all user data to sequential scraping. The user info is now displayed using hashed keys instead of a regular long number.

    However, the other half of the problem remains: we should not have to show where our location is, how long we’ve been members of Sedo and how long our domains have been listed for sale on Sedo. All this info can still be scraped and the data stored for any lawful or unlawful use, can expose our sales patterns and identify our sales volume and strategies.

    All these features should have an ON/OFF switch and be left to our courtesy to enable them.

  5. For a price, Domaintools offers a comprehensive list of domains owned by any domainer. No one raised a voice against them. if anyone did, it did not seem to matter.

    I don’t agree with what Sedo did. They sould know better. It amazes me that they are still in business.

    Whose fault is that?

  6. Are you joking about nobody raising their voice against DomainTools? I remember a lot of people being furious and canceling their accounts. But, it wasn’t for us, it was for lawyers.

  7. At the same time Acro … Many of us stopped using Sedo as a Sales platform because there was no way to hold people accountable for backing out of deals. I can surely see your point – But at the same time , It would be nice to out some of the Jerks not following through with offers and bids.

  8. Kevin – nice to see you here 🙂

    Yes, you can buy cumulative reports at DomainTools but their cost is prohibitive. But with one link, you can still see the entire listed portfolio of a person on Sedo, if you know their username, regardless of whether they want it or not.

    Mark, sorry to hear that you had trouble with buyers on Sedo. Personally, I have only positive words to say about it, however this doesn’t mean I cannot be objective and be furious about their latest programming and marketing gaffes.

  9. > It would be nice to out some of the Jerks
    > not following through with offers and bids.

    What do you mean? You always had access to that data anyway on the invoice.

  10. John, unless a bidder makes payment there is nothing on the invoice – the info says “All other info is kept confidential”

Speak Your Mind

*