Frienditto and Online Security.

[swestrup]

I have mentioned, once or twice in the past, that my truely private thoughts never leave my skull. I don't write them down and I certainly don't put them in a LiveJournal post. Now, I have occassionally confided them to another person that I trusted. Only once has this had disasterous results, but once bitten, twice very shy indeed.

That's not to say that I am completely unable to open up to someone, only that I keep my innermost thoughts and feelings very close to my chest. In a situation where I'm talking one-on-one to someone and a level of trust has had time to build, I'll drop some of my barriers.

This never happens in groups though. If I'm in a group of people and someone asks me why I'm looking glum, then they are unlikely to hear more than the least thing that is bothering me, regardless of how much I trust that person individually.

Since LiveJournal is all about the groups, my most secret thoughts never end up here. As a result, I am not as dismayed as many by Frienditto and its breaching of the LJ security barriers. For those that haven't heard about this, you can check out this article on Websnark. In a nutshell, what's been happening is that folks sign up for a free Frienditto account and give it their LJ name and password. Frienditto then downloads all of the LJ posts from that account and all posts visible from that account!

So, if you have posted something that only a half-dozen folks can see, and one of them signs up for a Free Account on frienditto, then it gets downloaded. What's worse is that there is no security on free frenditto accounts, so that post is now visible to everyone on the internet. To say that this is upsetting folks is an understatement.

Now, I can understand how this can upset people, but I never really believed that LJ had a strong security model in the first place. Then again, I'm an IT professional and so I KNOW that typing in my LJ password on another system is not only letting the tiger out of the cage with respect to any security I might think I have, but it is also a violation of the trust of everyone who has friended me.

Sadly though, passwords and computer security 101 is not a required course in todays world, and the vast majority of folks who've signed up for Frienditto had no idea of the havok they were about to cause. I'm sure that many of them are probably blaming Frienditto rather than themselves for having betrayed their friends.

All I can say is that the LJ Drama Llama is going to be burning the midnight oil tonight!

Comments

[sps.livejournal.com]

Your comments about security levels notwithstanding, I honestly suspect we need to make deliberately divulging a password a criminal offence in and of itself. Nothing seems to make people wake up....

People can be so dumb it makes my head explode!

[xipetotec.livejournal.com]

I've seen corporate networks where everyone was logging on with a single sign-on ... Had to put and end to THAT quickly!

[sps.livejournal.com]

Actually, there is something simple that might help a bit; that's to add good old-fashioned 'last login from...' lines to all the websites we make. I'm pretty sure that most people don't go to the trouble of generating a new password for every site they visit, so I'm pretty sure that the content of that 'last login' message would be quite surprising to many users. The web is full of sites that I would be amazed to discover not to include phishing in their business model....

[tjernobyl.livejournal.com]

A recent study revealed that most users will divulge their passwords in exchange for chocolate.

[chickcurious.livejournal.com]

Thank you for the article on frienditto. And thanks for the reminder to be more careful about what i put in my lj.

[vyxle.livejournal.com]

Isn't this old news?

[swestrup]

Possibly. *I* only know about it because it affected someone on my friends list (robont), and he certainly acted as if he thought everyone would know about this already. Evidence from other folks on my friends list is that this is the first they've heard about it as well.

[thebabynancy.livejournal.com]

well that's just silly... who would fill in that kinda information off site of LJ... for fear that something like that would happen?!

not I.

[swestrup]

Ah, but I have the advantage that *my* friends are SMART!

[kishiriadgr.livejournal.com]

The LJ Drama Llama carries personal computers in its baskets. It's led by a computer literate weary Inca man.

[skjalm.livejournal.com]

Very well written article, especially the bit at the end about "informed risk." I guess it's sort of like leaving the key to your front door under the door mat or, if you want to be really secure, under one of the plants next to the door ;-)

One thing not mentioned is that the login to LJ (and most likely all other blog sites) is not encrypted. Or maybe I just haven't found the option yet ;-)
This basically means, that passwords can easily be snatched from the network by e.g. the sysadmins at a workplace...