Secret Santa Security

[livius drusus]

For those of y'all who weren't around for the past couple of Christmases, FF has run a Secret Santa program where people send each other stuff they have lying around the house (last year we also allowed inexpensive gifts to be purchased). The way it has worked up until now is whoever wants to participate sends me a shipping addy, I match folks up based on an intricate system of shrouded-in-mystery criteria, then I send everyone a PM with the name/alias and address of their giftee.

Some people have PO boxes and use their aliases, but others provide their real names and home addresses. We've never been entirely happy with this system security-wise, but the late unpleasantness with quiet bear has ramped up our concerns.

So how do we plug the security loophole? Some ideas we had include requiring a PO box for participation, or having everyone ship to vm so he could forward the packages along to the giftees.

Money is a problem with both these ideas: people who don't have PO boxes will have to pay for one in the first scenario, and shipping charges will double in the second scenario. Time is also a big stumbling block for the central shipment plan, since everyone would have to get their shit together way earlier than in the past.

So, let's brainstorm. How do we fix Secret Santa so it's still the great fun it's been, but without putting people at risk of handing out their home addresses to any psychos in disguise, or even just folks they'd hate to share personal info with?

[slimshady2357]

Hmm, I have no ideas. I just wanted to say that I loved the Secret Santa experience last year :cheerful: I didn't join the first year, but I was most pleased that I did last year.

Thanks to everyone for making it such a great experience.

So how do we plug the security loophole? Some ideas we had include requiring a PO box for participation, or having everyone ship to vm.

Hmmm, that second option seems like a good deal for vm! :giggle:

[livius drusus]

Hmm... It was his idea. :para:

[Pinecone]

I haven't been here long enough for a SS so I don't know if getting the actual box of stuff is the fun part? What if somehow people could download pictures of stuff into individual 'Secret Santa' digital 'boxes' and on or about Christmas everyone could 'open' them?

It maybe could be set up for x to fill y's present box, or maybe even everyone who wanted to play could put something in everyone elses present 'box'?

[One for Sorrow]

Good question. I've always been a little wary of giving out my address, but have participated each year anyway. I've also moved each year after Secret Santa, (for completely unrelated reasons, mind you) but my next address will be more permanent. So far, I've just trusted you, liv, not to pair me with anyone who seemed too psycho (I forgive you for that one lapse in judgement when you paired me with vm :wink:) but that can't work every time. Somebody has to end up matched up with the crazies.

I'd be unlikely to get a PO box just to participate.

I dislike the centralized distribution even more, however. I'd only be able to afford to ship much lighter items, and I doubt my recipient would get too excited over a bag of cotton balls.

I don't know. I'm sorry I don't have any suggestions. I'd hate to see Secret Santa die because of the possibility of a few dishonest weirdos, though.

:deepsigh:

[Nullifidian]

So, let's brainstorm. How do we fix Secret Santa so it's still the great fun it's been, but without putting people at risk of handing out their home addresses to any psychos in disguise, or even just folks they'd hate to share personal info with?

Various online retailers like Amazon have wish lists one can buy from without ever having the person's name. That would cut down the problem with both the double shipping fees and the need to get a PO Box. Since I'm new-ish here, never participating in any threads before two weeks ago, I don't know how you run your Secret Santa, and if gifts are a complete surprise or you use the person's own suggestions.

At Finishing the Chat, a Sondheim-related board I participate on, we have a Secret Santa which is based off of the recipient's own suggestions. So as not to make it a complete non-surprise, we always give a list of five cast recordings we'd like, and then let the giver choose.

In a pinch, that's the way I'd go. I'm not sure if it works with used items from secondary sellers.

[livius drusus]

I haven't been here long enough for a SS so I don't know if getting the actual box of stuff is the fun part?
It definitely is. Finding the perfect stuff for your recipient, shipping it, waiting to get your box, then waiting some more before you can open it, then the final opening ceremonies, are key to the greatness of Secret Santa.

Here's (http://www.freethought-forum.com/forum/showthread.php?p=330300#post330300) last year's opening thread, just to give you an idea of the awesome. :xmas:

[ChuckF]

Hm, tough problem. The surprise element is, I think, a vital part of Secret Santa. I'm a bit leery about handing out personal info, but with a few exceptions, I'm comfortable with most people here having my info on a private basis. Plus, I move like every year anyway, so it's really just my real name.

One option for people who wouldn't mind giving out their real name but don't want to give out their address could be general delivery. I think all you need is a name and a zip code, then you go pick it up from the post office. Maybe not even a zip code, you'll just have to go to the big PO. I've never done that before, so I don't know how it works. This of course applies only to American participants.

P.S. I've already got at least one Secret Santa gift picked out. If I remember it in December, pretty much any recipient will lurve it.

[Watser?]

One option for people who wouldn't mind giving out their real name but don't want to give out their address could be general delivery. I think all you need is a name and a zip code, then you go pick it up from the post office. Maybe not even a zip code, you'll just have to go to the big PO. I've never done that before, so I don't know how it works. This of course applies only to American participants.

I always figured I am far enough away from most of the weirdos anyway :D

[ChuckF]

Are you kidding? You're right next to Belgium!

[livius drusus]

Good question. I've always been a little wary of giving out my address, but have participated each year anyway. I've also moved each year after Secret Santa, (for completely unrelated reasons, mind you) but my next address will be more permanent. So far, I've just trusted you, liv, not to pair me with anyone who seemed too psycho (I forgive you for that one lapse in judgement when you paired me with vm :wink:) but that can't work every time. Somebody has to end up matched up with the crazies.
Ya, I've paid careful attention to pair people up who I believe would be comfortable with each other, but in the end, that's really not sufficient to ensure participants aren't exposed to shadiness.

It doesn't even have to be a crazy. What if you get into a big ol' fight with your santa from the year before and no longer want anything to do with him or her? I know I'd be pretty unhappy with someone who hates me in that special internet hysteria way having my home addy.

I dislike the centralized distribution even more, however. I'd only be able to afford to ship much lighter items, and I doubt my recipient would get too excited over a bag of cotton balls.
Well, we don't even really know how we'd arrange payment for the extra shipment charges. Via the FF donation system, I suppose.

Various online retailers like Amazon have wish lists one can buy from without ever having the person's name. That would cut down the problem with both the double shipping fees and the need to get a PO Box. Since I'm new-ish here, never participating in any threads before two weeks ago, I don't know how you run your Secret Santa, and if gifts are a complete surprise or you use the person's own suggestions.
They are a surprise, although wei yau always starts a "what I want for Christmas" thread to try to elicit suggestions. Ideally, you're sending something you have that you think your giftee will love, not purchasing stuff, although as I said, we allowed purchases in a pinch last year.

[livius drusus]

One option for people who wouldn't mind giving out their real name but don't want to give out their address could be general delivery. I think all you need is a name and a zip code, then you go pick it up from the post office. Maybe not even a zip code, you'll just have to go to the big PO. I've never done that before, so I don't know how it works. This of course applies only to American participants.
Intriguing notion, Chuck. I thought general delivery only worked for small towns, like the hole-in-the-wall in Maine my parents lived in for a summer. I'll look into it.

P.S. I've already got at least one Secret Santa gift picked out. If I remember it in December, pretty much any recipient will lurve it.
Oh no way, mans! That's way too easy. I'll make it my personal crusade to match you with someone who would hate whatever it is you're thinking of. :muahaha:

[One for Sorrow]

You could always take the position of strongly recommending a PO box, without making it an actual requirement.

[Nullifidian]

I always figured I am far enough away from most of the weirdos anyway :D

Even with the Vlaams Blok on your border?

[LadyShea]

The whole point of the original SS was that the gifts not be boughted...they were either made, found, or dug out of the closet.

Apparently though some people aren't packrats who have a bunch of shit lying around the house just waiting to be sent to someone, so they allowed purchases last year.

I, personally, will not want to participate if it goes 100% purchases (like on Amazon) or 100% digital or whatever because the fun part for me was the "one doodz trash is the other doodz treasure" aspect.

As for crazies having my address, I trust livius' nutjob detector, and I have happily handed my address to quite a few crazies myownself. The Internet being what it is, I really don't have any illusions that my address is safe from being found anyway...I know what can be gleaned in a few short clicks and Google searches.

In a nutshell, my opinion is this; if one is worried then they can get a PO Box for a month, if they aren't worried they can give their address, and if they're really truly scared then they can choose not to participate.

[Uthgar the Brazen]

Meh, with the Jim Dobson Hitler Memorial Compound south of me and the University of Wussy Ass Tree Humpers to the north of me, I don't worry too much about weirdos.

[ChuckF]

Oh no way, mans! That's way too easy. I'll make it my personal crusade to match you with someone who would hate whatever it is you're thinking of. :muahaha:
Good luck! This could melt the hardest heart! (This will be only one part of a multi-gift package.)

Re: general delivery. It looks like the post office likes zip+4 for general delivery, so you go to that PO to collect. It's not just for homeless people anymore!

I don't think there is a catch-all solution for Secret Santa security. Some element of risk is inevitably involved, especially since Google Analytics was on the server for a couple of days. Personally, I consider it worth the fun. I suppose individuals looking for complete anonymity could make arrangements with you or vm for re-mailing.

I would also be happy to do some re-mailing. If there are several people who would each be willing to re-mail a single package, that would reduce the workload on vm but increase the complexity. There is also the problem of return addresses. ETA: the more I think about this the more I realize what a stupid idea it is. Never mind.

[livius drusus]

I always figured I am far enough away from most of the weirdos anyway :D
Huh. I always figured nothing is weird to Dutch people. :giggle:

In all seriousness, I kinda thought the same thing about our non-US folks. It would take a lot more effort for a crazy to come after you. Maybe I should make a point of matching people who are far away from each other instead of trying to limit shipping charges by matching folks who are in the same half of the globe. :chin:

[viscousmemories]

Some element of risk is inevitably involved, especially since Google Analytics was on the server for a couple of days.
:laugh:

[Watser?]

I always figured I am far enough away from most of the weirdos anyway :D

Even with the Vlaams Blok on your border?

Well actually we have our own weirdos these days. Filip de Winter of Vlaams Belang (new name after Vlaams Blok was banned) actually condemned our own Geert Wilders' (Partij voor de Vrijheid = Party for Freedom) idea to ban the Koran as going against freedom of expression. So I guess he is now officially more crazy. :rughide:

I meant the FF crazies though :innocent:

[ceptimus]

Whenever I buy stuff on eBay or by mail order from Amazon, etc., I have it shipped to my work address. This is not because I'm worried about weirdos but it circumvents the problem of there being no one in at home when the delivery guy requires a signature.

This could work for secret santa too. You could either supply your real name, and your workplace address, or if you're really paranoid you could also supply an alias name (as long as you tell the guys at your workplace in goods inwards what your alias is).

Possible drawbacks:

The potential weirdo would get to know your work address and possibly your real name.
Your employer might have a policy of opening all packages, even if they are marked 'personal'.
The gifts would have to be shipped early enough to arrive before your workplace breaks up for the Christmas holiday.
Some people who wish to participate may be unemployed or self-employed.
Your workplace may have a policy that prevents you from receiving personal items at your work address.


:dunno:

[wildernesse]

I like the idea of suggesting greater security for those who choose it--maybe having that as part of the first post of the SS thread. Discuss PO boxes or general delivery (a good idea, I think) or whatever, and then leave it up to the participants how they want to go about it. After all, some people are less private than others anyway.

[viscousmemories]

That's sounding like the most reasonable option to me, too.

[livius drusus]

:yup:

[Ensign Steve]

I've been living at the same address for 3 years (that's a record for me!) and I've given my real name and home address for both of the last SS's, and I've never had any axe-weilding internet psycho knock on my door yet. One time I did get a surprise present, though, not related to SS at all. That's a benefit of giving up your address. The possibility of surprise presents! All good enough reasons for me to give it again this year. Oh, plus I'm moving in February.

But anyway, yeah, like we do every year. If you're not worried about it, then don't worry about it. If you're slightly worried about it, then give a PO box or work address. And if you're still worried about it, choose not to participate.

[ChuckF]

Or give an unsuspecting friend's address and be like "Oh, yeah, you might get a package with a funny name on it...that's for me..."

[Ensign Steve]

I just realized I said almost exactly the same thing as LadyShea.

In a nutshell, my opinion is this; if one is worried then they can get a PO Box for a month, if they aren't worried they can give their address, and if they're really truly scared then they can choose not to participate.

Also, this part is totally true:
As for crazies having my address, I trust livius' nutjob detector, and I have happily handed my address to quite a few crazies myownself. The Internet being what it is, I really don't have any illusions that my address is safe from being found anyway...I know what can be gleaned in a few short clicks and Google searches.

One time someone posted my home address in a thread (they got it from doing a whois on ensignsteve.com) and I was like, "yeah, so? What are you going to do, come over?" They never did. :shrug:

[Shelli]

I vote that we get qb to come up with a viable solution since he was so kind as to cause this.

Sorry, that wasn't very productive. I really don't have any ideas though. :dunno2:

[livius drusus]

It's not really about qb, per se. Security has been an issue from day one with the system; we just couldn't think of a safer way to do it.

I think a strong statement in the sign-up OP, complete with suggestions for shielded addresses, works with people's different standards and to manage expectations in a responsible manner.

[Petra]

Poste Restante (http://en.wikipedia.org/wiki/Poste_restante) is a good option, though in order to collect you need positive ID, so real names would have to be used. For some of you, your real names are no problem, because there are lots of, for example, John Smith's in most given postal areas. For someone like me, who is the only one in the Whole Wide World with my name, that would be more of an issue, though like Watser? I'm too far away for that to bother me, and I phone number and address can't be found through the normal channels because I have a confidential number with Telecom. Only the police can get those details. :cool:

[LadyShea]

I think a strong statement in the sign-up OP, complete with suggestions for shielded addresses, works with people's different standards and to manage expectations in a responsible manner.

Yep, agreed

[viscousmemories]

For some of you, your real names are no problem...
Tell me about it! I just did a Googlefight (http://www.googlefight.com) between my real name and "Bob Smith" (which is not my real name) and there were twice as many hits for mine.

[Ensign Steve]

Try John Smith.

[viscousmemories]

John Smith FTW!

[Stormlight]

One option for people who wouldn't mind giving out their real name but don't want to give out their address could be general delivery. I think all you need is a name and a zip code, then you go pick it up from the post office. Maybe not even a zip code, you'll just have to go to the big PO. I've never done that before, so I don't know how it works. This of course applies only to American participants.

I always figured I am far enough away from most of the weirdos anyway :D

:glare:

[Watser?]

:whistles:

[Plant Woman]

I run a little contest on a web site. I stipulate by participating in this contest you agree to the following rules: blah blah blah.

So in the introduction maybe you can stipulate that in participating in the Secret Santa you understand the following:

1. We highly encourage you use a PO box or general delivery if your PO allows it.

2. If you use your home address we are sending Chuckie over on Christmas eve and will not be held responsible for whatever he may do. Or that he may be an eye sore dressed in animal prints with a tiara on his head.

3. Participate in Secret Santa at your own risk.

Actually use what's been discussed before, and stipulate that in participating they understand the possible risks involved.

I use a PO Box for my own comfort. AND my real name is plastered all over the web.

[livius drusus]

Well-stated, PW, thank you. It's simple, clear, and effective. :thankee:

(Although ChuckF might have plans this Christmas eve. :giggle: )

[seebs]

My home address is so easy to find that I just plain don't care.

[MonCapitan2002]

For some of you, your real names are no problem...
Tell me about it! I just did a Googlefight (http://www.googlefight.com) between my real name and "Bob Smith" (which is not my real name) and there were twice as many hits for mine.
I did a similar fight with my name. While my real name lost there were still quite a few results. At least my name lost to "Virgin Sacrifice". It would be awkward if it won.

[Ymir's blood]

For some of you, your real names are no problem...
Tell me about it! I just did a Googlefight (http://www.googlefight.com) between my real name and "Bob Smith" (which is not my real name) and there were twice as many hits for mine.OMG, you're bigger than the CURE!!! :bow:

[viscousmemories]

Not really (http://www.googlefight.com/index.php?lang=en_GB&word1=The+Cure&word2=viscousmemories) :(

[Novowels]

Perhaps you could set up two tiers, one for people worried about safety and the other for throw-it-in-the-wind types. The safety people could go through liv or vm (or another trusted type) and that could at least cut things down.

I don't know, I probably won't participate anyways, but not because of safety concerns, I'm just a scrooge like that.

My first and last name, place of work, and city/state is pretty easy to find, if not my actual street address. I'm not super crazy about my privacy, but I'm not going to have my full name and street address on the bottom of my blog, either (one of my friends does that!).

[Ymir's blood]

Not really (http://www.googlefight.com/index.php?lang=en_GB&word1=The+Cure&word2=viscousmemories) :(Oh, ok. Being bigger than Bob Smith probably wouldn't be healthy anyway.

[MonCapitan2002]

Not really (http://www.googlefight.com/index.php?lang=en_GB&word1=The+Cure&word2=viscousmemories) :(
If it makes you feel better, they kicked my ass as well.

[ChuckF]

Well-stated, PW, thank you. It's simple, clear, and effective. :thankee:

(Although ChuckF might have plans this Christmas eve. :giggle: )
I will make the time :pimp:

[InTheServiceOfZeke]

these folks might have some ideas:

Department of Homeland Security | Preserving our Freedoms, Protecting America (http://www.dhs.gov/index.shtm)

:P

[ms_ann_thrope]

General delivery sounds brilliant, but I wonder if you have to show ID when you pick up your items? :hm: