Kitz - Broadband Information Site

Notification to members that emails to any of the following domains are being bounced -  Yet again!

@live.com
@outlook.com
@hotmail.com

This is affecting the registration confirmation for new forum members and notifications for subscribed topics & personal messages.
Yet again we appear to be an innocent victim of Microsoft's 'Smart Filter' despite following all their rules.
The domain is clean and definitely not on any blacklists - See MX Toolbox Blacklist check.

------------

This is the third time this has happened.  Both times in the past Microsoft admitted it was an error on their part and we should not have been blacklisted and agreed to mitigate the domain.   
We are not the only reputable site this is happening to and its becoming an irksome routine for many other websites too.

See here and here

TBF I do not have time today to spend the hours that it takes chasing MS and am so fed up of their ridiculously broken system that I am considering blacklisting all their email addresses if I can find a way which doesn't affect existing members accounts.

As our service provider is based in the UK and we serve individuals within the European Union (including, for now, the UK), we will, from 25 May 2018, be bound by the General Data Protection Regulations (GDPR, Regulation (EU) 2016/679). The GDPR will apply to kitz.co.uk as a Data Controller.

Our lawful basis for processing data is consent. We provide a cookie notice at first contact to the site and all forum users are required to agree to terms and conditions prior to registering for the forum.

Following the GDPR, each individual has the right to: be informed, access, rectification, erasure, restricted processing, data portability and object. This post will outline how we intend to allow members to exercise their rights under this Regulation.

    The right to be informed

The right to be informed encompasses our obligation to provide ‘fair processing information’, typically through a privacy notice. It emphasises the need for transparency over how we use personal data.

In terms of personal data, the only data we collect is data in which you supply, with the exception of your IP address, hostname and your most recent click. As we are an anonymous forum, little personal data is collected and we do not require you to provide any additional personal data, with the exception of your email address. We also collect your IP address/hostname (in the event of a ban needing to be placed on your account, for the purposes of dealing with hacking, and if we are required to contact your ISP), and your username (for post identification). Further, the forum automatically uses a cookie, a text file containing bits of information (such as your username and password), in your browser's cache. This is ONLY used to keep you logged in/out. The software does not collect or send any other form of information to your computer.

Any formal requests should be made to forum @ kitz.co.uk. All emails must come form the email associated with your account.

    The right of access

The right of access means you have the right to: confirmation that their data is being processed and access to your personal data.

Your data is being processed. Any personal data we have is accessible via your profile.
If you want us to provide you with additional information (such as your IP address), then please use the contact email above. 

    The right to rectification

This gives you the right to have your personal data rectified. Personal data can be rectified if it is inaccurate or incomplete.

    The right to erase

The right to erasure is also known as ‘the right to be forgotten’. The broad principle underpinning this right is to enable you to request the deletion or removal of personal data where there is no compelling reason for its continued processing.

On the forum, this can be dealt with by requesting to delete your account. A deletion will have to be approved by an administrator (to protect against accounts being deleted maliciously). We will deal with this by transferring your username to a Guest account which has no user associated profile and all posts previously made will be attributed to the Guest account.

Blanket removal of individual posts is not seen as a compelling reason as it breaks up the thread and seriously affects readability and continuity of technical information data for our other members.  We may also consider a change of username if this is preferred.

    The right to restrict processing

You have a right to ‘block’ or suppress processing of personal data. When processing is restricted, we are permitted to store the personal data, but not further process it.

Our data processing is as restricted as possible. Processing generally requires you to act on our website, therefore not using the website will cease such processing.

    The right to data portability

This allows you to obtain and reuse your personal data for your own purposes across different services. This allows you to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, without hindrance to usability.

Ultimately all posts you make, unless made in a restricted forum where you have lost access, and other information you provide are all accessible. If you wish for us to send you the data we hold, a request should be made to the email above.  There will be an administration fee of £10 for this service. 
Please note that if your account has been anonymised to a Guest account, we have no way of tracking which posts have been made by you and will be unable to identify which posts you have made.   

    The right to object

You have the right to object to processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling), direct marketing (including profiling), and processing for purposes of scientific/historical research and statistics.

We do not generally process data for these purposes.

More information on your rights can be found here

Data breaches

In accordance with GDPR, if we become aware of a data breach, we are obliged, within 72 hours, to notify any users involved. As we do not believe such a breach would result in a risk to the rights and freedoms of individuals, breaches will not be reported to the supervisory authority.

Children

The GDPR contains new provisions intended to enhance the protection of children’s personal data. As we do not identify individual's beyond their IP address, username and email address, we do not believe any action is required.

Other provisions

As our data processing does not possess a high risk to the rights and freedoms of individuals, we are not required to undertake a Data Protection Impact Assessment (DPIA), nor are we required to appoint a Data Protection Officer (DPO). We reserve the right to reveal information we hold about you (or any other related information collected on this service) in the event of a formal complaint or legal action arising from any situation caused by your use of this forum, in accordance with the laws of the United Kingdom.

Administration Fees

As a user you have direct access to your profile information and can yourself search for any/all posts you have made using the Profile > Show Posts section. This facility is available free of charge.  Under the GDPR we are allowed to charge a "reasonable fee based on administrative costs” for further copies which is how we treat manual requests.  We are also within our rights to refuse to act on a request if it is "manifestly unfounded or excessive, in particular because of their repetitive character"

We will consider on an ongoing basis all other requirements.

I'm making some changes to the site.   If things go a bit wonky for a while, please bear with me.   
I'm anticipating that it may mostly impact the forum.

According to a white paper published this week by Akamai over 65,000 home routers are proxying bad traffic for botnets.

Akamai reports that it has detected over 4.8 million SOHO routers which are vulnerable by exposing UPnP services via the WAN interface and of these have identified over 65,000 devices which have already been compromised.

The simple explanation of the vulnerability that lead to NAT injections, is that these devices expose services on their WAN interface that are privileged and meant to only be used by trusted devices on a LAN. Using these exposed services, an attacker is able to inject NAT entries into the remote device, and in some cases, expose machines behind the router while in other cases inject Internet-routable hosts into the NAT table, which causes the router to act as a proxy server.

A list of vulnerable routers is listed in the report, but notably a lot of ASUS models are affected including the DSL-AC68R, DSL-AC68U, DSL-N55U, DSL-N55U-B, RT-N66U etc

Refs:-
Akami
Bleeping Computer

Due to server maintenance, the site is likely to experience some downtime at around 3am on 30/03/2018.