@Iszi I would say no. Of course I'm also not a privacy princess, so I'm certainly not as sensitive as some. You could argue that the machineid + urls could be potentially personally identifying, but I think that's a stretch. Certainly more of a stretch than a machineid + geoloc data from a phone, which is the current Whisper situation.
@Iszi So, the difference I see, is that with a subpoena you can generally tie an IP address to a ISP's DHCP log, to a subscriber who is a person. You can't do that with a randomly generated machineid. That said, I think the logic behind calling an IP address PII is relatively weak as well.
Heh I just changed my email address registered at one online shop by requesting the change via (a different) email. I could have easily spoofed that for any other account on their site and request they change it to one in my control, then I'd go to the site and request password change. Step three: profit (get stuff sent to you on account of others LOL). Of course, I'm a white hat so I'll just email them back why what they did is wrong.
@TildalWave it continues pushing through the original transaction but it prevents any further clients from connecting, essentially taking down the server until its done
