New livejournal feature has privacy concern.

[theweaselking]

netdef has the details, but the short version is this:

It's now possible to search for a journal by the registering email address. Your journal is searchable by default. This means that, even if your email address is private, someone entering that email address into a search will find your journal.

This does nobody any good as far as finding your email address from your journal. Finding your journal from your email address, on the other hand, just became trivial, until you change your settings to turn this feature off.

Comments

[corkdorkdan.livejournal.com]

Incorrect. The feature is specifically opt-in, as explained in the recent news post.

http://news.livejournal.com/110919.html

[jerril]

Incorrect. It is not properly Opt-in.

The next time you visit the LiveJournal homepage, you'll see a dialog box that prompts you to set your preference for whether you want your email address to be searchable by the new Find Your Friends feature.

If you have a popup blocker enabled, it does not set you to "No" automatically. You then have to go in and manually change it.

And it treats "Undefined" as yes. ANd it stays as "undefined" until someone tells you to go check your settings.

And if you just plain haven't visited the LJ homepage, it still treats undefined as yes.

[corkdorkdan.livejournal.com]

Then why is it that even though I haven't chosen an option (I'm still undefined), I can't find myself in the email search? Sure looks like it's treating me as "no" at the moment.

[frith]

I followed the same procedure with the same preconditions as Dan and I got the same result: email string did not yield a journal. It would appear to be functionally an opt-in function at the present time.

What are the specs on your system?

[speck.livejournal.com]

I'm trying this on IE in insane mode (lol), Firefox (Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.17) Gecko/20080829 Firefox/2.0.0.17) with noscript set to hate livejournal (my default) and ADBLOCK Plussed.

Tried multiple accounts that had not logged in before the date of this crazyness and with my details set on "normal" for me (LJ used to default show your email addy to everyone) of "do not show anyone email) the undefined did not appear to be treated as yes.

*SHOW* us how you tested this, I cannot reproduce and assume you have quite the edge case computer setup or are not correct in your methodology or assumptions.

[matgb]

I have a pop up blocker, I saw the opt in box when I went to test it earlier.

Given that I'm using my real name, my email is my real name and it's my standard username, I obviously opted in, it's a feature they should've had years ago on an opt in basis.

They have tried to tell people in as many different ways as they can, put it in news, emailed people, etc.

There's not much more they can do, and it is opt in.

[psyco-path.livejournal.com]

I just went to my "home" page and a pop up asked me if I wanted people to be able to find me.

I don't like the new look because I'm cantankerous and hate change.

[sivi-volk.livejournal.com]

Yes.

Bloody facebook, hotmail, lj.

[lafinjack.livejournal.com]

Vista, Firefox address bar, one other I was thinking of the other day but can't remember.

Dude

[speck.livejournal.com]

http://bringvictory.com (http://netdef.livejournal.com/51550.html?thread=77150#t77150)

The new settings are created so that if you don't see the pop-up and aren't able to make a selection that there is no default setting, and you're not opted-in. If you didn't see the pop-up and make your selection that way, no option should have been checked by default.

There's a little more information on that here (http://www.livejournal.com/support/faqbrowse.bml?faqid=291).

Re: Dude

[theweaselking.livejournal.com]

Before I changed the option manually myself, it was not set to "do not allow people to find my journal by searching via my email address".

As such, it is clearly not "opt-in". In order for it to be opt-in, it would have to be set, by default, to BAR searching for my journal via my email address, and allow searching by email address if and only if I explicitly allowed it.

Re: Dude

[speck.livejournal.com]

It was set to "select something" or whatever it was, which in their minds is functionally the same as "do not allow".

I'm not their coder, their info dev, their ui guy or anything else; just because they did it sloppy and according to some kind of insane standard or rules (which is pretty typical for the code base and recent changes this crew has lumped atop the original code from what I've seen and experienced) doesn't mean it doesn't work the way they say it does, whether they choose to call it opt-in or not.

Take it to them; I'm just happy it's not as crappy as a lot of their implementations have been.

...I'm confused.

[athelind.livejournal.com]

The email address that is linked to my livejournal is [livejournalname]@[mydomain].net. Anyone who knows my email address will have NO problem finding my LJ.

I use an entirely different e-mail address for professional and business purposes.

Don't other people practice that kind of partitioning?

Re: ...I'm confused.

[matgb]

No, some people even use confidential work email addresses for anonymous journals on here (and got caught out during one of those rapleaf outbreaks). They then still blame others.