Hacker News Reader

Comment by anilshanbhag | Hacker News Reader

People data labs's data is pretty accurate. Here is mine: https://api.peopledatalabs.com/v4/person?api_key=9c6a1382204...

You can try it for yourself by changing the email. All of the information is public, so I don't mind. They are basically doing data integration.

View on HN

Haha, when I was a kid and scared to use my real name for things, for some reason I used my email... which had my real name in it, to open a Github account with a fake name

So the api knows me as the famous architect, Art Vandelay

There is a way to get every developer’s email on github thanks to git commits adding it :))

In your github account you can add a new email address that doesn't even exist or have a valid TLD, like "name@mail.fake". Don't use it as your primary email and it won't require confirmation. You can now set your git user.email to this fake address and any commits you make will be attributed to your account without exposing your actual email address.

You can use yourgithubusername@users.noreply.github.com instead of adding a fake email, and your commits will still show up on your contribution graph and be linked to your username.

That must have been a long time ago, Boorish Bears.

Reminds me of when I used to get free magazine subscriptions (and the subsequent junk mail/robocalls) addressed to Santos L. Halper.

Wow.. I checked with an email address I use for disposable purposes. The only thing they had on it was a blank LinkedIn profile -- meaning that LinkedIn cancer has trawled some pretty questionable sites, harvesting email addresses as placeholders for their accounts. WTF.

Ah, looks like everyone's using that API key, I got 2 queries for my addresses and got a "rate limit exceeded" message.

Strangely it only says I work in real estate (no I don't) when I looked up the email address I use for LinkedIn...

You, and others can use my api key, just signed up.

e75ac28b25480e60071b24d819d4692a0b315c037046b9ff6ec9dfb1e99a895c

Status 429, Rate limit error.

yours gone too now. very curious about this API lol

Try changing v4 to v3 in the URL.

Yup, that worked for me.

Indeed they do have a profile on me - a bare minimum, scaped from GitHub. That makes sense, since that's about the only social platform I use, aside from HN.

EDIT: My GMail address has the most amount of information gathered, which makes sense. It's gathered Facebook, LinkedIn, Pinterest, GitHub..

It lists my skills as: firefighting and emergency planning/management/services. I suppose, with a stretch of imagination..

Here's mine eaca37c25ca1a9c5d85efb8cbaf1742b4fbfeee0054d713961176ab9500c2f2b

It returned a 404 for my personal email account, so that appears to be sufficiently protected.

More surprisingly it had data such as my name, title and work email address which was connected to old work email account (Okta managed - GSuite) that I never associated with external services, and absolutely never used on a social networking site like LinkedIn.

That API key is now public, too! Rate limited.

Yeah no kidding. Though if you wait until it flips to a new minute and refresh, that helps. Though it takes all of a minute to register a free key, so probably no big deal.

Your api key is now permanently in public. After few days, people will still be able to use this for their own usage.

a few days? its already hit its limit :)

I'm actually a bit surprised at how little data they have on me. They've associated my main email with an old junk email, they've got my first and last name, and know that I'm male, but there's little more.

Nothing for most of my accounts, except one which somehow was falsely attributed to someone else. Odd given I do have a LinkedIn profile; Their scraping must be far from perfect.

Wait, so is this mostly just Linkedin data in JSON form?

My personal email seems to be based on Github and Gravatar, while my job search and work emails got linked together and appear to be based on LinkedIn.

This seems exceptionally unethical

Displaying public information publicly, or sharing your API key?

It would be really surprised if this were compliant with the GDPR. I live in the US but I tried email accounts of relatives in Europe and they had data in there.

It looks like it's a US-based company without enough of a European presence to fall under their jurisdiction.

https://gdpr.eu/companies-outside-of-europe/ it looks like it would? I'm no expert though.

Right, they can say it applies... but if a company does no business in Europe, how can a judgement be enforced?

I’m also not an expert, but my understanding is that it applies but would be hard for the EU to take action against them

A law isn't a law if you can't enforce it, so "applies" has kind of a strange meaning in this context then, doesn't it?

A law always has a jurisdiction. EU laws generally don't apply to the US, even if the EU wants them to. There are exceptions, of course.

Theoretically, if it were egregious enough, the EU could say to the owners or management of the company that if they went to the EU they would be arrested. That’s enough of a threat that it might convince them.

> The whole point of the GDPR is to protect data belonging to EU citizens and residents. The law, therefore, applies to organizations that handle such data whether they are EU-based organizations or not, known as "extra-territorial effect."

They can say this all they want, but if you have no presence in the EU, and your jurisdiction does not have any agreement to apply GDPR regulations to you, then this is at most a strongly worded request.

Barring explicit agreements to the contrary (treaties, extradition agreements, etc), by definition a country's laws are only enforceable there.

If PDL has no business in Europe, no plans to expand there, and there's no treaty or other agreement making the provisions enforceable against them, the EU can say whatever it wants but PDL has no legal obligation to do anything about it.

One obvious answer in that case would be to establish who is buying the data from them and treat any PDL data as potentially tainted. If you find a downstream customer who does have a presence, then investigate accordingly. You might not be able to fine PDL directly, but you could certainly make the offending data risky or unprofitable...

Sure, but how do you propose doing that? Send another strongly worded letter to PDL demanding their customer list?

Usually you'd either track known errors in the dataset (implying that the companies had either bought it from PDL or copied the leak), or you'd ask the banks (who do have a presence) which accounts were paying them and who owned the accounts. If Bitcoin's involved at all, you assume there's something fishy going on and investigate accordingly.

(Assuming anyone were bothered enough to actually do this, of course.)

Legal jurisdiction is a separate matter than the specific text of laws. The "this applies to non-European companies" things just means that if you fall under the jurisdiction of European courts, you can't absolve yourself of responsibility of complying with this law simply by being a foreign-registered company.

On the other hand, if you never fall under European jurisdiction in the first place, you're free to ignore them, just as you can ignore Thai laws against insulting their king. One very important thing to note is that setting foot in European soil will expose you to their jurisdiction, so you've significantly limited your freedom of movement, but if GDPR compliance is a bigger deal than that then "just never go to Europe" can be a viable strategy.

So... if the owner is known, it will be quite costly ;-)

It's no secret who is behind that website [1].

Good luck to the EU on enforcing their law against an American company, though.

[1] https://angel.co/company/peopledatalabs/people

Oh yes, I'm going to try and see if they have data on me and send a number of GDPR requests if they do. For others from the EU, it's very easy to do using: https://www.mydatadoneright.eu/request

I don't know how accurate the coordinates of your address in India are, but it's 5 minutes away from me. Small world, huh?

I'm glad they don't have jack shit on me besides my email, is there a list of their data source(s) ?

Reply on news.ycombinator.com