Is Flixster Using Deceptive Viral Practices? 190
Talaria writes "The social networking movie review site Flixster is requesting their users' AOL, Gmail, Yahoo and Hotmail passwords, and then using them to access users' address books and send 'invitations' to join Flixster, making them appear to come from the user. The password prompt screen includes the ISP's logo right next to the password prompt. Rather than hiding this little 'feature,' Flixster brags about it in an interview after receiving $2 million in venture funding earlier this year." American Venture Magazine notes: "...such practices are becoming increasingly... common as new and even established web sites look to attract visitors without expensive marketing campaigns and a hefty advertising budget."
Facebook does this too. (Score:4, Informative)
Re: (Score:2, Informative)
Re:Facebook does this too. (Score:5, Informative)
Re: (Score:2)
People will forward these to everyone they know, all the while thinking they have done their part to protect themselves from some superstitious event.
Re:Facebook does this too. (Score:5, Insightful)
Re: (Score:2, Insightful)
Don't give out the password.... (Score:2)
Re: (Score:2)
That's exactly how social engineering works. Ask something incredible enough that people will think you've got a really good reason and have got the right authorizations to ask it in the first place!
It's exactly like walking out of the office purposefully with that very expensive projector. As long as it looks like you know what you're doing, people won't think twice.
Re: (Score:2)
Walk into the lobby of that lovely five star hotel, and into their bathroom. Far more pleasant, and if you look like you're meant to be there, voila.
Re: (Score:2)
Whenever I've been invited to use such a site
Re: (Score:2)
...thereby violating the terms of service of their e-mail provider, and affecting others who didn't make the asinine decision to do so.
I was having an argument with someone the other day about the fact that laws that prevent people from doing stupid things are a good thing. If the only victim were the primary idiot, I'd say go ahead, Darwin away. But, unfortunately, stupidity usually has a wide spla
Re: (Score:2)
Exactly; not new (Score:5, Informative)
sms.ac did exactly the same thing; but didn't ask permission to email people. Whilst you'd think people would know better even Joi Ito got caught by this, what's worse is they spammed before the signup process was complete. Joi immediately quit using the service and blogged a public apology [ito.com], referring to sms.ac as spammers. Next thing you know they sent him a cease and desist [ito.com] demanding Joi stopped calling them spammers.
Re: (Score:2)
Re:Facebook does this too. (Score:4, Insightful)
Think about it, if people never clicked on the links, replied to the emails, or called the numbers these spammers would probably die off. It is the fault of the masses of people to are all too eager and ignorant. Power thru inaction would solve spamming. Well, at least curb it a bit.
So back to the topic at hand, while this is very dasterdly, I have never signed up with facebook, I do not have a myspace page, i don't do that school class reunion site. These sites with their ads also help keep these scary/shady companies alive too. If they do things that are as bad as this publicly, imagine what they're doing behind our digital backs. Let's see, they have just about your entire personal history, background, lifestyle, etc. not mention they probably have every single click on their own respective websites completely tracked. They own you and can probably easily guess all of your secret questions for password reminders on any site such as "Your pets name" or "city your high school was in" or "what is your favorite color", etc.
Sorry for the paranoia and cynicism. I just don't trust these people, especially without some regulatory oversight. I am totally against said regulatory oversight so I just exercise extreme caution and do not generally sign up for these types of sites.
Have a nice day.
Re: (Score:2)
On the flip side it does make for a nice easy business venture to get in the antispam/antivirus market though, even if you just resell one of the bigger guys' platforms like Securence or Postini.
So does Get-Messenger (Score:2, Interesting)
My friend and apparently many others had done so. How do we close down crooks like this?
WRONG - TOTAL FUD (Score:2)
Facebook asks you for your email password so that they can DOWNLOAD THE ADDRESSS BOOK so you can find people in it who ARE ALREADY FACEBOOK MEMBERS.
As well, you have to AUTHORIZE THEM to add the people via checking them off. Absolutely no messages are sent to anyone unless you specifically approve each and every person.
They are very upfront about what they are doing and why they are asking for your passwords. IMO it's a great service, it saved me hours of hunting down people in there when I first
Re: (Score:2)
Re: (Score:2, Insightful)
is that bastards that work like this don't get shut down/prosecuted. Yes, users should not be that stupid.
If a girl gets raped when walking through a park alone at night, or after drinking something that a stranger gave her at a party well perhaps she was stupid. That does not let the rapist off the hook!
Sooo... if I ask you for your password and you give it to me... I'm to blame? Like I go; "Hi, I need your e-mail address and password so I can access your address book and send e-mails in your name" And you say "Sure, sounds good to me."
Some people are just too stupid. They're impossible to protect. They're the people that makes it necessary to have three pages of warnings on a knife, that need to be told that a hammer should not be used to smash insects on somebody's head. It's the people that smokes t
Re: (Score:2)
With computers there is a difference. People grow up from crawling to understand the physics of hitting their fingers with a hammer etc, but computers are very different. It is very easy to pop up a phishing box that looks just like a legit box from within their computer and exploit people's ignorance.
You need to understand that most people don't understand the boundaries betwee
Re: (Score:2)
It would be more like the girl going into a park but having to sign a "By walking through this park you agree to have sexual intercourse with me -- A Rapist" disclaimer.
If they do only what they declare -- send invites to the selected contacts -- and don't use the addresses harvested or your account for any other purposes then fair eno
Re: (Score:2)
That's as maybe (and I'm not saying that I disagree with you) - it was the analogy I was contesting.
Re:Facebook does this too. (Score:5, Insightful)
1) Boycott the scummers that use these tactics
Re: (Score:2)
My Gmail password?! (Score:4, Insightful)
Re: (Score:2, Funny)
If they want to send me some of their shit, I send them some of fucking mine.
Re: (Score:2, Informative)
Re: (Score:2)
Re:My Gmail password?! (Score:4, Funny)
Edit->Preferences
Select the Security Tab
Click the Show Passwords button
Click the Show Passwords button on the window that comes up
Click the Yes button.
Copy your list of usernames and passwords
Paste the list here so I can make sure for you that the username and passwords are valid.
Re: (Score:2)
kazymyr
***************
Not to mention (Score:3, Informative)
There is no way of telling if the password used is provided to a third party without consent or if the site is hacked. Be careful with your personal data, and keep your login to yourself as much as possible.
If you create a site with interactive content - think twice before if you really need your visitors to log in to request the content.
Re:Not to mention (Score:4, Interesting)
Anybody who gets an account on service X will be asked for a password and a contact email address. Chances are that the password will get you right into their email account, because people don't like having 100s of low security passwords.
Of course, I trust slashdot not to take my password and try to get into all my other accounts. Am I justified?
So be smart, don't use the same (Score:3, Interesting)
If you have to re-use passwords, at the very least do something like having half a dozen passwords, one for each category. One for your email, one for web forums, one for work, one for the home computer (but use a firewall anyway), one for PayPal/Ebay/whatever, one for MMOs or whatever. Ok, maybe you don't like having 100 passwords, but you _can_ remember 5-6 passwords, right?
That way if one is compromised, basic
Re: (Score:3, Informative)
Like Claria/Gator? ;) (Score:2)
Re: (Score:2)
Is it me or does this seem really bad if you know... use more then one computer. Is there a .dat or something I can stick on a thumb drive and take with me?
I use Password Safe, originally developed [schneier.com] by Bruce Schneier, now on SourceForge. I keep a copy of the .dat file as well as a copy of the program itself on a USB drive and also email it to my GMail account periodically. Since I use a very strong master password and it uses Twofish for encryption, I'm not worried about anybody cracking it in my lifetime. No AES, I'm guessing due to the fact that it was originally Schneier's program that they stick with his crypto?
Re: (Score:3, Informative)
Re: (Score:2)
another nasty trick... (Score:5, Interesting)
Re:another nasty trick... (Score:4, Insightful)
That, however, would fall squarely under the category of "cracking". By asking for it, they can claim to have (at least as a pretense) your "permission" to spam your friends and contacts.
I do have to wonder, though, whether this might not count as a DMCA violation for Flixster, regardless of the appearance of having your permission... Virtually all free email hosts have a clause in their terms saying basically that you and only you may use your account. By using it "on your behalf", Flixster has used your password to circumvent an access control mechanism, the magical phrase that triggers a DMCA violation.
Re: (Score:2)
Part of me hopes people will end up getting themselves banned from GMail, AOL, Hotmail &c. because of this, if only in order to generate some publicity and draw some attention. You wouldn't give a shady stranger the keys to your home. Why let them into your email accounts?
Re: (Score:2)
It's also the magic phrase that activates the Hunter-Seeker Death-Robots. I hope you've paid up your robot-insurance premiums...
Non-Issue (Score:5, Informative)
I'm not saying I'm a fan of their scheme, but it's not like they're scamming anyone. You even get to select who you want to invite.
I guess some people feel they have to produce content, even if they have to dress a non-story up in inflammatory language and ignore the facts of the situation. Gotta drive those Adsense impressions.
Re:Non-Issue (Score:4, Insightful)
I recently signed up with Facebook to get in touch with some old friends and generally pretend to be one of the cool kids. They have a similar feature where I was able to provide my login information for gmail or yahoo, and it would automatically dend friend requests to folks in my address books. Sure, it's a bit stupid to provide your login information to a third party. If that information is stored, then yes it could be breached. But, ultimately the facebook feature and the one in this article are apparently very straightforward. A user can choose to share the login information with a third party. As long as that third party does what they say they will, I'm not sure where the issue is.
Ideally, webmail providers would get together with the folks who impliment these sorts of features, and make some sort of easy way to generate a one time use password that can only be used by an IP assigned to the domain that is supposed to use it. Then, you could impliment this sort of thing without needing as much trust. Then, the next time you login to your webmail, it pops up a message saying that "XYZ domain used the one time key you generated on X date to attempt the following actions. Please look over this log and make sure it is what you wanted them to do and click approve or deny."
But, the security issue doesn't even seem to be the main complaint of the article. It's just all huffy about them doing what they say they will, and declaring it deceptive.
Re: (Score:2)
Re: (Score:2)
So people would un-check most of the addresses in the first page, leaing only the ones they wanted to invite, and then hit submit.
This resulted in all of the address book BUT the un-checked entries on the first page would be sent an email.
So even if the software worked exactly as advertised, it might cause people to unintentionally spam many, many people, as it in f
Re: (Score:2)
Sure there is a different security issue regarding providing login information to 3rd parties... a quite serious problem I agree, but that's not the point of the article. That they missed the much more credible and important argument on security policy speaks volumes. Cynical perhaps, but security articles don't bring in nearly as many readers as "OMG SPAMMER!@!!!one!1"
I'll point out again t
Some crazy man's "great business idea" (Score:5, Interesting)
And so it came to be. It's crazy not just because it's deceptive, but because it's a security nightmare. If you give your passwords to random sites even for the nicest purposes (which isn't even the case here) it's guaranteed they'll be leaked, and your accounts abused.
What's next: signing a warrant of attorney so the great Flixster, so they could send your buddies free gifts, funded by your bank accounts and credit cards? It's definitely in the same line of thought as this preposterous scheme here.
Re: (Score:2)
Really? Literally, actually hear them? Unless you work there, they must be screaming pretty loudly!
Seriously though, any developer should not be screaming about this - it's a functional issue with this site, not a technical one. Their boss might "insist" on this being implemented, because it was in the signed off functional spec. which the developer is paid to implement.
D.
Re: (Score:3, Insightful)
I was only doing my job M'Lud.
Now where have I heard that one before.
Re: (Score:2)
Kinda different if you were being asked to implement features which were in breach of law - but this isn't kinda different like that.
Re: (Score:2, Insightful)
Ok, I know. If I had spent longer I'm sure I could have come up with another analogy.
Re: (Score:2)
Sorry, but you'd need either more experience in a lot of other industries to base that against, or have read a detailed study (which wouldn't need you to have any experience in any industry) - either way, just working in one industry (or two, or three) does not qualify you to make that statement.
And anyway, feature creep is only that if the feature was not part of the initial spec - which it might well have be
Re: (Score:2)
Common sense still beats the logical fallacy I'm supposed to participate in. How often do you believe (and I don't use a study for this, warning) these happen in the real world:
Building a house. Almost done, the cli
Re: (Score:2)
Plaxo, facebook, Taggedmail do it too (Score:2)
I'm just surprised how these guys get funded at all. Anyone will tell you that this practice is unsustainable, not to mention unethical.
Re: (Score:2)
Ethics and sustainability only serve to limit the return on the VC's investment.
Is this guy serious? (Score:2)
"We make it easy to invite your friends. Other sites don't provide good ways for people to spread the word."
What, like calling your friend and saying "Hey, this is a great site" or emailing them and saying "Hey, this is a great site" or texting them and saying "Hey, this is a great site" or walking up to them and saying "Hey, this is a great site"? (Did I make my point?)
From "Blaster.virus.com"- "Hey, we have a great site and we're going to check out you email address list and send ema
Maybe (Score:4, Interesting)
The page in question is formatted to resemble a login gateway page of the various providers (think Microsoft Passport and the like) using the domain part of your email address to decide which provider login to display. Even though I consider myself quite knowledgeable when it comes to security related issues and have done security consulting for various companies, I *might* have fallen for this since it admittedly lowered my suspicions. I doubt Joe Sixpack or even many above-average users would have questioned the purpose of this form.
Worth noting is their elaborate privacy policy [flixster.com] and the cute picture of a monkey in their terms of service [flixster.com]. Also, the footnote "Flixster does not store this information in any way" seems to have been added after the screen shots in TFA were taken and I could not find any information on how they connect to the email services (i.e. via a cryptographically safe link or plain text via a Win98 proxy server in Nigeria)
Phishing made easy (Score:5, Insightful)
As this practice gets more common, people will lower their guards (if they had them in the first place) and become conditioned to give out their password to anyone who asks.
I can already hear them say "... but the website asked me for it... was that wrong?" *sigh*
Re: (Score:2)
Re: (Score:2)
Several swimming pools near my home will give out locker keys but require your car keys as security. Whenever I go along I have this huge argument about it. I will happily give them a fifty dollar note as security. The car is worth a lot more than that to me and a replacement locker key is perhaps 10 dollars. They should be happy with the 50.
But everbody else hands over their keys. Pool staff could be out on the roa
Re: (Score:2)
Re: (Score:2)
No, they require a car key. They have no idea if it belongs to you, fits your car door, or if it indeed unlocks anything. If it's a hassle, go get a duplicate key made, file it down so it no longer works, and give them the dummy key.
In any case, it's not worth your time to argue with the person behind the desk. If you're really annoyed by it, fin
Some people will fill in anything on the web (Score:2)
So the next question would be; if they had a similar page with the Bank Of America/Barclays/whatever logo, would people be just as happy to give their details for them?
Either way, it's scary. Scary that Flixster thinks this is an acceptable way to market themselves, scary that people are letting them
FUD (Score:2, Informative)
Bullshit - this is plain vanilla misrepresentation (Score:2)
In this case it's certainly worth reading the Terms & Conditions - if that 'feature' isn't in there you ought to be able to sue the hell out of them.
Re: (Score:2)
I know of lots of websites that do something similar, but the important difference would be that;
- they only spoof your address, the email does not actually come from your email account
- they don't need your password
- you supply the addresses, they don't rifle your address book
Or so I thought, I'd never use such a thing. If the website was that good I'd tell my friends myself, not fire spam at them. Real friends don't spam you.
Re: (Score:2, Informative)
Re: (Score:2)
Imagine a Porn website using this capability? You may think you know your friends and they may think they know you (and maybe they do) but do you really trust them not to let porn emails get sent to you?
Here's the bigger problem:
Mod Parent Up (Score:2)
Marketing IS deception (Score:3, Funny)
Re: (Score:2)
Re: (Score:2)
If someone who can read Japanese would translate that I could pick it appart.
But since I don't read Japanese, I can only go by the guy named Jeramiah on the bottom who thinks he's a bullfrog.
Jeramiahs' shoulders aren't that big, they used that to decieve the potential customer into believing either, they would be big & strong, or that the advertiser was.
Convenience, not abuse (Score:2)
I can't understand why this is a problem. You already trust these networking sites with pretty detailed information on your own preferences, tastes, friends, location etc., so your e-mail password is not much of an asset to them. Any abuse would obviously lead to people changing their passwords.
The feature is really useful, and presented properly it is not abusive at all. What it does, is log in to your e-mail account and grab your address book. Then you are able to check off people you want to invite and
Abuse, not Convenience (Score:3, Insightful)
But to give you the benefit of the doubt:
There is absolutely no reason, security or otherwise, for a user's password to be anywhere but between the user's ears or typed in to the one correct "password" box where it applies. Even the company who provides the password-protected service has no need of it, unless they have a severely damage
Here's how to stop these scams (Score:5, Insightful)
-Section 2. Personal Use: "The Service is made available to you for your personal use only."
I see two violations here. First of all, they are giving the use of the service to someone other than themselves, violating the word "your". Secondly, they violate the word "personal" - this is clearly a business application
-Section 3. Proper Use: "... Your use of the Service is subject to your acceptance of and compliance with the Agreement, including the Gmail Program Policies
Violations of the program policies include:
- "Generate or facilitate unsolicited commercial email ("spam"). Such activity includes, but is not limited to
-Additionally in Section 3: You shall not "(i) use the Service to upload, transmit or otherwise distribute any content that is unlawful, defamatory, harassing, abusive, fraudulent, obscene, contains viruses, or is otherwise objectionable as reasonably determined by Google;" Again, I find spam harassing.
Given these violation, Google would be well within their rights to terminate the accounts (actually, according to the Terms of Use, they can do that whenever they feel like it, but lets assume they don't want to look too evil). Alternatively, They could send out notices that they will terminate any accounts that have been violated if they don't change their password in the next 10 days. Since so many people would lose, or face impending loss of their email accounts, services such as Flixster would suddenly have to find a new business model.
While I didn't check, I would bet hotmail, yahoo mail etc. have similar terms of use.
Even if Flixster decided to keep being an ass and collect passwords anyways, that would just mean that people stupid enough to give out their passwords would no longer have email accounts. Either way, I see no loss. Get to it Google et al.
Re: (Score:3, Insightful)
Re: (Score:2)
Sending these messages violate several points in gmail's Terms of Use and Program Policies. [..] Google would be well within their rights to terminate the accounts
As I said elsewhere [slashdot.org], Flixster themselves may also be open to legal action- if not "hacking" charges- because they aren't authorised to access these systems. If this was just one individual accessing another's account with permission, I don't see that it would be treated too seriously. But although Flixster weren't the ones who agreed to the TOSs, they are likely *more* aware of them than the account owners, simply because any normal business would have a lawyer look into that sort of thing first. (Or at le
Hilarious. (Score:2)
Why don't Gmail block them? (Score:3, Interesting)
Re: (Score:3, Insightful)
1) There's nothing to prevent Flixster from sending employees out to Internet cafés to send the mails, or getting them to do it from home, etc. Sure, it's an inconvenience, but if they're truly determined they could do it. Alternatively, just buy a bunch of modems and get some free dial-up accounts, or use proxies, etc.
2) My company, like probably the vast majority, NATs its LAN. To the outside world, almost every single desktop appears to be behind the same IP a
Re: (Score:3, Insightful)
Your idea will fail because:
most of the time it's the same password anyway (Score:2, Insightful)
This is just asking permission. Nine out of ten times, they've already got the information.
Still don't like it. The real solution is for the mail providers to provide a secondary authentication measure to provide information from a users' acco
RTFA (Score:2)
This is just asking permission. Nine out of ten times, they've already got the information.
NO, they don't have the info - that's why they're asking for it. They put up a display that borders on phishing (some would say it IS phishing), without explaining what
I saw this recently at Google Video. (Score:2)
You click the 'add to myspace' button and google video asks for your myspace username and password so that it can login and add the video.
I lol'd pretty hard at the idea that people would actually do that. But I see it is pretty common.
Who needs security when nobody actually cares enough about their data to protect it.
I'm imagining a future of malware infested web applications. fun fun fun!!!
In the case of Myspace this almost makes sense (Score:2, Informative)
Hell, Blogger (which is google) has a "feature" that will let the service p0wn your FTP server by posting directly to the server.
Re: (Score:2)
2. Click on the 'Email - Blog - Post to myspace' button in the frame on the right(it's a big blue button, you can't miss it.)
3. Just under it you will now see 'Post to: myspace - blogger - live journal - typepad'
4. Click myspace.
Some are much worse (Score:3, Informative)
This is by far not as bad as what wayn.com does (or at least used to do). They were just sending out their spam through your account without your knowledge. See "WAYN - Where Are You Now? Warning [misterorange.com]" or Wayn.com : phishing alert, ne vous faites pas couillonner ! [pingouin.be] (the last one in French). (found these at the end of a French blog post about other deceptive practices of Wayn.com [alma.ch])
Lol. (Score:2)
Even if it says somewhere in the fine print the fact that she provided her login information allowing this worm to hi-jack her address book says a lot about what's deceptive. Not everyone is a paranoid system admin or computer savy.
RIAA (Score:2)
How about their TOS? (Score:2, Funny)
not only address books (Score:2)
This happened to a good friend of mine (Score:2)
For weeks following this he was constantly being angrily confronted by the same "Can you stop sending me those invi
Comments from a Flixster founder (Score:2, Interesting)
I am one of the co-founders of flixster - a friend pointed me to this discussion. I would like to clarify a few things:
1. We DO offer the ability for users to select friends from their hotmail/yahoo/etc address books. This is a very common practice on social sites like ours - LinkedIn/Yelp/Facebook/MySpace/StumbleUpon/etc all do exactly the same thing. Its an optional convenience feature for users and we are not deceptive or misleading about it in any way.
2. We do NOT store anyone's us
Re: (Score:2, Funny)
Unethical behavior = SUED FOR $$$?? (Score:2)
If you give a website your password to your email account, you are to blame. If the company is hacking into your accounts to send out its viral invites...that's when the crap needs to hit the fan.
The users are partly to blame for being stupid, but the use of the logos in the article's screenshots *could* reasonably be taken to imply Hotmail/AOL's endorsement. Even simply asking for an AOL/Hotmail password could lead some to assume that there's an association.
Yes, they shouldn't assume; but that's the way things normally work. Flickr asks for your Yahoo account, because they're associated, so this is the same thing? Wrong, of course.
But I think that this is a whole world of legal pain for Flixst
I trust you! (Score:2)
Re: (Score:2)
You are mistaken. The "victim" in this case is the person on the contact list who gets spammed because their "friend" decided to turn their contact list over to these idiots. Both Flixter and the "friend" would end up on my blacklist.