That list is enough evidence for us that the DMA isn't acting in good faith on its opt out program, but then Jonathan contacted the organization to ask them to investigate his second account (the one where he received a blank screen and no confirmation as to what happened). In response, a DMA rep did this:
The folks at the DMA to whom I complained about the problems on their site decided that the right way to respond was by emailing me my account passwords in plaintext, thus proving that (a) the people who designed the site don't have a clue about secure Web applications (secure Web applications NEVER store passwords in plaintext!), and (b) the people who support the site don't have a clue about Internet security (NEVER email passwords!).
What makes this so egregious is that people tend to use the same passwords everywhere, which means that if someone manages to steal the DMA's user database (and it doesn't have to be hacker — apparently there are people at the DMA who have access to the data), they can use the email addresses and passwords in it to break into OTHER sites that the DMA users are registered at.
It's a bad, bad scene.
Update, September 25, 2009: It turns out the DMA didn't like our post or Jonathan's complaints, and they sent Ben a lengthy, point-by-point rebuttal. As per his instructions, I'm pasting it below.
1. With regards to the statement that "the DMA doesn't really care so much," DMAchoice (www.dmachoice.org) empowers consumers to easily opt out of mailings that they would prefer not to receive. DMAChoice is intended to aid a consumer on an individual basis, and can aid with family members at the same address. DMAchoice gives consumers the flexibility to choose which categories of mail that they do/do not want, while companies can address the wide array of individual preference requests. Also, DMAchoice allows a consumer to enter up to three variations of their name to ensure adequate and accurate suppression of unwanted mail. In addition, DMA provides for an individual caring for a dependent, allowing him/her to fill out the caretaker form, and those with a recently departed loved one who can fill out the deceased form.
2. With regards to whether names are removed permanently: Names are removed for a period of three years, not permanently, due to change of address, name variations or other data updates needed to facilitate name suppression and ensure that is effective. Unlike other name removal services that simply contact marketers and nothing more, members of the DMA are obligated to accept the requests as a best practice under the DMA's ethical guidelines. If there is a company that is not honoring the request made, an individual can contact DMA by going to http://www.the-dma.org/guidelines/complaintprocedures.shtml. The DMA handles cases against member and nonmember companies, and will contact the company to ensure they honor the request for compliance purposes.
3. With regards to whether you are "notified" when the enrollment expires: Since this is a name removal service, we want to respect that individual's preferences and proceed with caution by limiting the number of email communications sent to the individual. After an individual registers, we do not contact them further except for a service update if they have provided an email address and are allowing us to communicate with them in the future, or if they have a question, concern or comment. Enrollment expiration information for a registered individual is easily obtained by contacting DMA's customer support team via dmachoice.org.
4. With regards to the statement that DMA won't use a "change of address lists" to update your information and that they do for those not opting out proving that is a capability: We are not certain what this is referencing since the DMA is not a company, but is instead a nonprofit trade association that represents for-profit and nonprofit organizations that market to consumers (and businesses). The DMA itself does NOT market to consumers and, hence, there is no need for it to utilize suppression lists intended for companies that market to consumers. However, the DMA does maintain and enforce a set of self-regulatory Ethical Guidelines that its members are obliged to follow as a condition of membership. The Guidelines span all media and cover list management, among many other things. To review the Guidelines, please visit http://www.dmaresponsibility.org/Guidelines/. To learn more about DMA's Ethics Committees which enforce the Guidelines, please visit: http://www.dmaresponsibility.org/Committee/. In addition, the DMA's Board of Directors passed an Environmental Resolution in 2007, which laid out the DMA "Green 15," a set of eco-responsible business practices. Among the Green 15 tenets, companies are expected to run their marketing lists through the National Change of Address (NCOA) system of the United States Postal Service. To learn more about DMA's Green 15 tenets and many other environmental initiatives, please visit www.the-dma.org/environment.
5. With regards to the statement that the DMAchoice system runs only 5 names per account: As noted above (#1), DMAchoice is set up to aid a consumer on an individual basis and allow for an individual to provide his/her name variations. Nonetheless, additional accounts may be created. In addition, DMA makes a special exception for an individual caring for a dependent, allowing him/her to fill out the caretaker form, and those with a recently departed loved one who can fill out the deceased form.
6. With regards to the statement that sometimes the "website doesn't work," and there is a blank screen: If an individual is having a technical issue we are happy to assist the consumer, they can email us at dmachoice.org. Just as any other product or service that is offered to consumers, there will be some technical issues that need to be resolved. We are striving to provide an excellent consumer service and such a technical problem should not lead a consumer to believe that the DMA membership "does not care" as was stated. In fact, members of our organization are committed to honoring consumer preferences (see www.dmaccc.org for more information) and are running the DMAchoice name removal file on a monthly basis. This system has reduced unwanted mail for consumers and improves the relevance of the marketing offers to those consumers that are interested in receiving marketing offers that may save them money or provide services they are seeking.
7. With regards to the statement that there was a potential security risk when the individual that ran into a blank screen was provided his account passwords in plain text by a customer service rep: We appreciate the concerns raised and will follow up immediately with our team to verify what happened in the process and ensure that we are following the appropriate security protocols.
"DMA's Mail Preference Service: Once a fraud, always a fraud" [Something better to do]
"DMA site is not only broken, but insecure" [Something better to do]
@crunchberries: optoutprescreen.com is for just what it says -- opting out of prescreened credit-card offers, the kind where it says "You're already approved!" and in some cases encloses the credit card with the offer. Regular credit-card offers, where you have to apply and be approved, are not opted out. Putting yourself on the DMA MPS will stop some of them, and contacting the individual credit-card vendors taht write to you and asking them to stop will stop the others. It's a lot of work, but there is some satisfaction in knowing that you're helping the environment.
]]>Best, Chuck
]]>Easy solution:
On every addressed or unaddressed junk mail you receive, remove your name and send it to the DMA "Receiver pays" by DHL or COD through the USPS. The more it costs them to deal with it, the more it hurts them.
]]>(I like the temporary boycott because it gives companies incentive to change, and it's less of a burden on people: it's easier to avoid a company for a month than forever.)
]]>@vastrightwing: Most charities will, in fact, remove you from their lists if you ask, although a few of them are stubborn about it. I've been trying for almost two years to get charities and others to stop sending me junk mail. You can read about my efforts at [blog.kamens.brookline.ma.us] (search for "junk mail").
]]>@maztec: You are confused. While you're correct that dmachoice.org does offer links to the Web sites of individual DMA member organizations, there is also functionality for adding oneself to the DMA's MPS list, which (supposedly) tells DMA members they aren't supposed to send you junk mail.
As obnoxious as the DMA is, the MPS list does actually work, at least to some extent. If you are getting a lot of junk mail from companies you've never dealt with, and you add yourself to the MPS list, you *will* reduce the amount of junk mail you receive.
And I say that as the author of the guy who wrote the blog entries linked to in this article, so you can believe it ;-).
]]>A junk mail story:
In the pre-interwebz days, I transfered from an urban area college in NJ to a rural college in the Southeastern US. At the end of the summer before starting at my new college, I took the time to sign up one of my more nerdish, city-raised, former roommates for every free rototiller, soil turner, tree stump grinder, and bush hogger info package I could find. And this guy would never have a green thumb either for plants. It helped also that he had an odd name too so it would be apparent that it was spelled correctly when people who didn't know usually spelled it wrong.
I raided the Old Farmer's Almanac and think I remember even sending brief letters asking for info in his name. I had all of these sent to the dorm mail box which each of the 4 people in that apartment could get.
I went back to visit (and consume alcoholic beverages) at the college on Christmas break and told one of the cool roommates what I had done. He fell over laughing as he said each time he got a rototiller/etc catalog came to the mailbox, he would give it to the nerd roommate who was bewildered on why he was signed up for these farm equipment mailings to an urban college dorm.
When the cool roommate and I got back to the dorm later that evening the nerd roommate was still awake so I drunkenly asked him "How are you doing in the the garden with your new rototiller?" at which I got the "You SOB! I'll kill you!" as he jumped up and jokingly tried to wrestle me. He did say he thought it was funny too when he learned that it was my joke on him...
]]>@treimel: Anyone remember the guy in the 1970s' who first used junk mail to heat his cabin with a wood stove. He basically made paper logs out of the mail by slurrying the paper, molding it, and then drying the logs out. His attitude was it was free and delivered right to his driveway...
]]>@vastrightwing: Yes, those organizations actively sell their lists to others like them.
My experience:
I rented a PO box in the town I went to college since I knew I would be moving around during 4 years. I donated $10 once to one organzation like that and then started getting scads of donation solicitations using the "we send you pretty picture return address label gift to guilt you into donating" angle. Never donated again but I personally loved getting the labels as I used the labels for free whether or not I gave a darn about the picture. Occasionally I would send the donation form back (without anything being filled in) just to mess with them and maybe have them think I was a senile senior who forgot to put in his check... FREE LABELS!
I suspect this will be an impossible task since it's likely that once she makes a donation, her name and address becomes very valuable and is then sold as a willing donor to other charities. This is the only way I can explain the stunning number of solicitations she is getting. The charities are also giving my wife a difficult time when she asks to have her name removed. You can imagine the charities do not want to remove active donors from their lists! I believe they will not actually remove her name or her name will simply be re-added when her name is sold again.
I advise you to talk to your parents and ask if they are giving money to charity and how often they do this. If they are doing this and they're fine doing it, OK. Then make sure they are keeping track of the money and are at least getting a tax write-off for them. Otherwise, check your parent's mail and start having their address removed from the lists today!
]]>I'm sorry, but I do not see that this site has any purpose other than as a redirector. Perhaps someone should farm all the links off of it and post them up in a free location - free as in you don't have to give away your personally identifying information in consideration to obtain the info?
]]>@treimel: I have three main irritations:
1. The frequency of the junk mail. If it's a once-per-quarter mailer, it doesn't bother me as much. It's the stuff I get on a weekly (and sometimes daily) basis that gets on my nerves.
2. The fact that I have a mail slot on my apartment door, so it all piles up behind my door. If I go on vacation for a week, I seriously have a hard time opening the door when I get back. The opening of the door usually scatters all of the individual glossy pages from those coupon circulars all over my entryway.
3. The fact that my apartment complex only offers 6 small recycling bins for about 500+ residents; therefore, even if I take the long walk to the bins on the other side of my complex, they're usually overflowing anyway. I can't bear to throw paper into the garbage; I WANT to recycle it, but it's difficult to do so where I live. I would kill for curbside.
]]>@AllanG54: That is why the Post Office has been spending millions of $$ on ad campaigns for flat-rate shipping.
]]>I was looking at that site not too long ago and was thinking about "opting out". I am certainly glad that I did not do it.
]]>@sqlrob: Thanks, but...you mean this one?
For "unwanted sexually oriented advertising" in my mail? I would have to check a box that says I believe the mailing is "erotically arousing or sexually provocative". I do not find local contractors, Kraft Mac & Cheese, or window replacement companies to be erotically arousing.
]]>Around 2001 I signed up any and every DMA personal name and generic email address I could find for spam email offers and contests. Within a couple of years the DMA was coming out against spam emails. Unknown if this was connected but it made me feel better.
]]>@zacox: The chances of that happening from the DMA are exactly zero. If you live in America, there's a 99.9999% chance DMA member companies know your name, address, names of people in your household, phone number, and general income information. They can probably also tie that to an email address that you use. The DMA is actually a legit organization. There are other groups out there doing exactly what you describe, but the DMA isn't one of them.
]]>Yes, that sounds like a reasonbable approach--I'm already using "base" passwords in a few categories, but I've not been modding consistently, and it's been frustrating not having an easy-to-remember approach.
]]>I opted out of pre-approved credit offers about 4 years ago. I average 20 pieces of mail per week, of which 6 are solicitations. All of those are from local vendors, or are addressed to "household".
I followed the instructions on the back of a Visa card offer and mailed a request to be taken off the mailing list. Worked like a charm. Usually this information is located on the back of credit card offers, middle of the page, in the small print.
]]>But I have it comparatively easy: I can make those bundles, take them downstairs, and the city deals with it. My girlfriend's nearest paper recycling is a third of a mile away, which means either significantly more time, or using up gas as well as time.
]]>if I am logging on to gizmodo, i use 42gP@$Sw0rdODO42
That way all my passwords start and end with same numbers, making it harder for someone to get a clue.
Also, the base password, I keep 4 of those. one gets used in banking apps, the other in email and other personal services like, one more in utilities and online logins to meatspace entities, for general purpose use, and the last one for all the recreational stuff - consumerist, disqus, wordpress, and such. There is also a throwaway password I use for one time logins, based off the song that i am listening to recently.
]]>I guess I'm in the minority, but I have to say, junk mail really doesn't bother me. Maybe it's because my mailbox is essentially at my front door, but it never seems to inconvenience me in any way--I recycle it and that's it. To those who find it annoying (and you have every right to your preference--I'm not judging) what's the main irritant? The wastefulness/ecological concern, the time suck? the weight? (if mailbox is distant? I really do wonder.
]]>salting with cues from the site itself sounds like a plan--thank you!
]]>For example: let's say your current primary password is "cuddles". Of course, that doesn't have much uniqueness to begin with, so let's do a little hacker 133t work on it and change it to "C^dd1es". Isn't that pretty. Easy to remember too. But we aren't done; we don't want to go Sarah Palin and use the same password at all those sites, so we begin to "salt" our password with information from the site itself, so it is easy to remember in the future. So let's say we're going to Consumerist to put in our password, we'll take the first three letters of the domain, throw in our password, then complete the domain: "ConC^dd1essumerist". Ta-da! a unique password that should be easy to remember.
Using that method you can have MILLIONS of passwords, all different, all will hash different (for the sites that do kinda the right thing ((the "Good Thing" is to use salted hashes)), and even if a plain text spills out on the net, it'll take a human to decipher it.
Or you can use SuperGenPass which is all kinds of cool, unless you use an iPhone or some other device whereby you then must remember the awfully long passwords that it will generate.
]]>Does anyone else here get DM from RedPlum? You know, all sorts of local store circulars wrapped up in a RedPlum cover sheet? I've tried to opt-out with them via their website, but the junk mail just keeps on coming. When you try to opt-out via phone, they simply direct you right back to the website. I'm stuck.
]]>At some point, it really is, though. I don't have ten or twenty passwords, I need more than 60--that's alot of modding.
]]>Of course, asking people to keep different passwords at different sites by making minor easy to remember modifications to a base password is just too much to ask, right?
]]>