Slashdot Mirror
New Messenger Has Same Old, Gaping Privacy Holes
An anonymous reader writes "Microsoft released the beta of the new 'Wave 4' Windows Live Essentials last week. The new beta of Windows Live Messenger 2011, while plugging some privacy holes and shoring up the user interface, fails to tackle the one biggest privacy-buster of all. Say you use Messenger to IM your wife. You also use Messenger to IM your old girlfriend. The next time your wife logs on to her Hotmail account — not Messenger, Hotmail — she will see that you and your old girlfriend 'are now friends.' It all happens without your knowledge or permission, and it happens even if you tell Messenger you want your personal information to be 'Private.'"
..we can all relate to
I understand the privacy implications, but maybe they could have chosen a better example.
If your Wife has some huge issue with you talking to your Ex-girlfriend, there are probably other underlying things.
Communication should be open, like this:
"Oo, she has a nice ass"
[girlfriend turns]
"yeah, you're right"
All the lack of privacy and cliquishness of the tiny little towns that people ran like hell to the big city to avoid; but with the systematic asymmetry of information that only modern technocratic corporatism can provide... Just lovely.
Lack of encryption is a pretty egregious offense; but a vulnerability that consists of making possibly-compromising disclosures specifically to people with which you have some sort of prior relationship, no matter where they are on the internet, is quite arguably more salient, for the vast majority of people, than a vulnerability that exposes their communications to technically savvy individuals within wireless range(if the wireless is unencrypted or weakly encrypted, or those individuals have the keys).
Plus, lack of encryption is something that you can, with minimal effort(and the cooperation of whoever you are talking to, which is the harder part), solve on your own. Pidgin+OTR. Done, instant encryption that even the provider can't do jack about for any protocol supported by libpurple. The provider telling everybody you know who you have been talking to lately, on the other hand, is an unsolvable problem from the client side(barring the old "uninstall that fucker like a bad habit that owes you money and never touch it again" solution).
And, ultimately, except in the case of financial matters, or malware that renders a computer unusable(where the damage is pretty much fungible, and it really doesn't much matter who inflicts it, it hurts the same), security vulnerabilities and privacy disclosure issues that specifically aim at people you know in real life hurt more than ones where random strangers can get the same data. Random malefactors on the internet can certainly steal your money, and a few hardcore sociopaths with nothing better to do might torment you just for giggles; but the people immediately around you are a large part of your life. Disclosures to the former are unfortunate. Disclosures to the latter are potentially devastating.
Hang on a second here. Did you just point out that MSN works kind of like Facebook, and then insinuate that this means the privacy is fine?
DRM: Terminator crops for your mind!
So basically it's like what Google did with Buzz and Gmail contacts. You didn't learn from others' mistakes on this one did you Microsoft?
Can't you turn this off in the Windows Live privacy settings (not the Live Messenger privacy settings)?
I'd go so far as to say that if Facebook does it, it's probably wrong.
End of Line.