Frienditto

[rm]

From several of my friends -- all of this is via them, as I've had NO DIRECT CONTACT WITH THE SITE, but feel this meritted enough concern to repost here:

Watch out for Frienditto.

This site is an archive service that claims affiliation with Live Journal BUT DOES NOT HAVE IT.

There has been some concern over this site and security of LJ accounts. If you provide it with your login information for your Live Journal you give this service permission to archive your friends only entries and ANY locked entries of your friends for which you have access.

Please read the following answer to my support request regarding this site and be informed. More importantly, inform others.

Dear user,

Frienditto is not affiliated with LiveJournal in any way. As such, this website does not have access to any entries which are not publicly viewable. If someone provides them with their LiveJournal username and password, however, it gives this site access to all non-public entries that account would have access to. We can only recommend that you do not provide your username and password to any person or website to ensure the security of your account.

Additionally, if you believe anyone on your Friends list may have provided their login information to this website, we can only advise that you remove them from your Friends list. This website will have access to your Friends-only entries as long as any person on your Friends list has given the site access. If any content is present on Frienditto which you do not wish to be there, you will need to resolve the issue with that website.

Regards,

Scott
LiveJournal Abuse Team

(Emphasis mine)


If you are using this site I will remove you from my friends list. Additionally, I will be extraordinarily cross at you, either for being an idiot, or a malicious little freak.

Comments

[delchi.livejournal.com]

Not I said the Infosec warrior.

I would think that its obvious to anyone that giving away their LJ id/pw grants access to everything , but then again common sense is not all that common.

[eqe.livejournal.com]

No kidding. Even people who're supposedly smart, like Joi Ito (http://joi.ito.com/archives/2005/02/03/apologies_for_spamming_friends_with_smsac.html), apparently have no problem typing their username and password into a website merely based on an email that appears to be from someone they know.

I shake my head over humanity, I really do.

[drstein.livejournal.com]

sweet. Other Marillion fans. ;)

[delchi.livejournal.com]

Absolutely! Think we have enough for a community?

[coyotegoth.livejournal.com]

Yes.

[drstein.livejournal.com]

There isn't one already? There oughta be. I think there's enough. :)

[zibblsnrt.livejournal.com]

The problem isn't that it gives access to the posts/etc of the user supplying the login and password. The problem is that it gives access to other peoples' locked posts by acting like the user's normal LJ usage. If all it did was leave the Frienditto user's stuff wide open, it would only be stupid. However, it's specifically intended to be used to display third parties' private posts.

[delchi.livejournal.com]

The problem is, as I stated, that giving out your user id / password grants access to EVERYTHING that the owner has access to. Included in everything is their normal posts, locked posts, other peoples locked posts, user information , and so on.

Regardless of frienditto or any other 3rd party web site or service , when you give away your user id and password you have given away everything you have access to on that system. It's just plain dumb. This is on line with the survey whereby people gave out their passwords in excahnge for a cookie on the streets of NYC.

[zibblsnrt.livejournal.com]

The problem is, as I stated, that giving out your user id / password grants access to EVERYTHING that the owner has access to. Included in everything is their normal posts, locked posts, other peoples locked posts, user information , and so on.

Yeah. I wouldn't be upset if it was just the original user's information - that would be self-inflicted harm, which I'm not known to be sympathetic over. It's the fact that it also publicises other peoples' stuff - and that is in fact the intent of frienditto - that's the problem.

[delchi.livejournal.com]

Exactly.

Well put.