Re: [Full-disclosure] MySpace e-mail importer rasies security concerns

On 7/29/07, "HACK THE GOV" <hackthegov@xxxxxxxxxxxxxx> wrote:
"we've recently noticed the functionality of myspace in respect of the
e-mail importer raises privacy and security concerns.

Yea, it would be a dumb idea to use that feature. Although, if you
really really really want to use it, it would be wise to temporarily
change your password, use the feature, and then set it back to
minimize the abuse potential. Still a bad idea.

LinkedIn also has this functionality...
https://www.linkedin.com/secure/uploadContacts?displayWebMail=&trk=inv_webmail

e-mail address for their myspace account, instead of using an unknown
throw away e-mail address to login to their myspace account. you would
normally associate this kind of tool with the hacker underground, but
today folks its brought to you by design of the myspace team, who
obviously don't have the bigger picture of privacy and security in
mind.

LinkedIn at least uses HTTPS by default, which should deter sniffing.
I don't think MySpace gives you the same luxury...
--
Kristian Hermansen

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages

  • For Tex, (Listening & Watching)
    ... "No Place to Hide might just do for privacy protection what Rachel ... We live in an ever more convenient society. ... O'Harrow unveils a modern world riddled with seemingly innocuous private ... Department of Homeland Security aggressively sought access to these ...
    (rec.arts.poems)
  • Re: For Tex, (Listening & Watching)
    ... "No Place to Hide might just do for privacy protection what Rachel ... We live in an ever more convenient society. ... O'Harrow unveils a modern world riddled with seemingly innocuous private ... Department of Homeland Security aggressively sought access to these ...
    (rec.arts.poems)
  • Risks Digest 23.93
    ... ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS ... US-VISIT ... Security, Privacy & Ethics Track ...
    (comp.risks)
  • Re: For those "National ID Card" supporters
    ... I apologize for the length, but it may answer a number of your questions. ... The danger is that an ID system may give a false sense of security and that may be worse than what we have now. ... Not everyone, of course, believes that privacy is a right assured by the Constitution, but there are certainly many who are concerned that the technology would be abused. ... Security -- Protect “private information” from unauthorized third parties, implies exchanging parties do know each other and authenticate. ...
    (soc.retirement)
  • Re: For those "National ID Card" supporters
    ... The danger is that an ID system may give a false sense of security and that may be worse than what we have now. ... Not everyone, of course, believes that privacy is a right assured by the Constitution, but there are certainly many who are concerned that the technology would be abused. ... If the government takes no action, individual companies will compete for market share based largely on proprietary systems. ... The government can be very effective in establishing the development of standards for both the level of security and data standards in order to assure efficiency, effectiveness and confidence in the overall technology. ...
    (soc.retirement)