internetarchive / iaux

Monorepo for Archive.org UX development and prototyping.
GNU Affero General Public License v3.0
65 stars 86 forks source link

Archive.org exposes uploaders' email addresses #892

Open adakaleh opened 7 months ago

adakaleh commented 7 months ago

[ Not the ideal place to post about this, but I don't know what is. I emailed multiple archive.org addresses and got no reply. ]

I am writing to point out a major privacy issue. Each item uploaded to archive.org has an auto-generated meta.xml file, which contains an "uploader" tag with the user's email address. Example:

https://ia800703.us.archive.org/35/items/SonyPlaystationManuals/SonyPlaystationManuals_meta.xml

The metadata API exposes it as well:

https://archive.org/metadata/xfetch

There is nothing on the website warning users that their email addresses are going to be exposed. I found out after years of using archive.org. This is a betrayal of uploaders' privacy, not to mention the fact that these addresses are easy for spam bots to pick up.

Also, you can search by email address in IA's search engine. For example, here are all uploads made by users with riseup.net email addresses:

https://archive.org/search?query=uploader%3A%28%40riseup.net%29

And if you change your email address in account settings, the address for your previous uploads remains unchanged.

To top it off, help.archive.org falsely states that IA is "unable to release" uploaders' contact info:

https://help.archive.org/help/rights/#how-can-i-contact-the-person-group-who-uploaded-an-item

How can I contact the person / group who uploaded an item?

Internet Archive is unable to release any contact information for patrons. However, it may be worth your while to post a review for the item in question – this automatically contacts the uploader’s account, notifying them that their upload has been reviewed. You could pose queries/requests for information therein.

Here's a post from 2013 pointing out the same problems:

https://archive.org/post/553311/how-can-i-contact-the-person-group-who-uploaded-an-item

I can't believe this hasn't been addressed all these years.

Please fix this. The "uploader" tag must not be added to meta.xml (or to anything else) and must not be searchable.