Comments on: Livejournal Done Right: The Case for a Social Network with Built-in Privacy http://33bits.org/2009/09/09/livejournal-done-right-the-case-for-a-social-network-with-built-in-privacy/ The End of Anonymized Data and What to Do About It Tue, 06 Dec 2011 23:45:54 +0000 hourly 1 http://wordpress.com/ By: What every developer needs to know about “public” data and privacy « 33 Bits of Entropy http://33bits.org/2009/09/09/livejournal-done-right-the-case-for-a-social-network-with-built-in-privacy/#comment-1550 Thu, 08 Jul 2010 18:37:17 +0000 http://33bits.org/?p=229#comment-1550 [...] in mind. One major reason why LiveJournal has a “closed” feel — which is a big part of its appeal — is that posts don’t rank well in Google searches, if they are indexed at all. For [...]

]]> By: februaryfour http://33bits.org/2009/09/09/livejournal-done-right-the-case-for-a-social-network-with-built-in-privacy/#comment-1342 Wed, 14 Apr 2010 15:38:56 +0000 http://33bits.org/?p=229#comment-1342 Actually, you can choose to be notified if you are friended (or de-friended). It’s in the Notifications settings. I just choose to leave both options off, but some people actually turn them on because they want to know.

]]> By: Privacy is not Access Control (But then what is it?) « 33 Bits of Entropy http://33bits.org/2009/09/09/livejournal-done-right-the-case-for-a-social-network-with-built-in-privacy/#comment-1023 Sat, 13 Feb 2010 03:03:38 +0000 http://33bits.org/?p=229#comment-1023 [...] Everyone-but-X access control, which I described in an earlier article, shows in a direct way how access control fails to capture privacy requirements. From the [...]

]]> By: charmian http://33bits.org/2009/09/09/livejournal-done-right-the-case-for-a-social-network-with-built-in-privacy/#comment-802 Sun, 08 Nov 2009 23:52:20 +0000 http://33bits.org/?p=229#comment-802 Fascinating.

Although it’s not post data, LJ has been declining in daily visitors, especially U.S. daily visitors. According to Google Trends, there are around 100K daily U.S. visitors, vs. around 100K Ukranian and ~300K Russian visitors. (I posted about this here.

The serial adders are said to probably be bots, brought on by the massive popularity of LJ in Russia. In general, recently the site has experienced huge spambot traffic.

]]> By: Arvind http://33bits.org/2009/09/09/livejournal-done-right-the-case-for-a-social-network-with-built-in-privacy/#comment-681 Tue, 15 Sep 2009 04:22:14 +0000 http://33bits.org/?p=229#comment-681 Ah, it was right there. Don’t know how I missed it. I don’t think I’ve changed those settings since creating my journal around 6 years ago, so I never noticed when they added that feature. Or maybe they always had it and I always missed it. Anyway, thanks.

]]> By: Matthew Skala http://33bits.org/2009/09/09/livejournal-done-right-the-case-for-a-social-network-with-built-in-privacy/#comment-680 Tue, 15 Sep 2009 03:50:45 +0000 http://33bits.org/?p=229#comment-680 If I go to the Livejournal home page, then click “manage accounts” and choose the “notifications” tab, I get a page where I can select a box under “notify me in my LJ inbox when…” “Someone adds me as a friend”. There’s another box next to that for “Also notify me by email.” My account is a “Basic” account grandfathered from before the recent “No more ad-free Basic accounts” change. Your mileage may vary, of course, especially if you’re using a different account class.

On serial adders: bear in mind that people have the option of shutting off their “friends-of” list from appearing at all, and that’s what LJ support usually tells people to do if they object to being friended. I myself have received several notifications from the same serial adder repeatedly adding and removing me within the space of a few days; that’s harder to deal with because turning off incoming friend-notifications is more expensive than turning off the friends-of list. Just for me I can easily filter them, but not everyone has as good email-fu as mine. We probably can’t reliably guess what serial adders are trying to accomplish, though; they don’t exactly publish their motivations in any believable form.

I suspect everyone-but-X may be one of those things that may work better in practice than in theory. You and I can instantly see the holes in it, from a theoretical perspective that assumes adversaries will do everything they CAN do. But when people would actually attempt to use it, it might well work as well as they hoped just because the people being excluded wouldn’t bother making dummy accounts. Especially if they didn’t know they were being excluded. Certainly, no amount of argument is going to convince users who think they want everyone-but-X that they don’t.

]]> By: Arvind http://33bits.org/2009/09/09/livejournal-done-right-the-case-for-a-social-network-with-built-in-privacy/#comment-679 Mon, 14 Sep 2009 08:37:41 +0000 http://33bits.org/?p=229#comment-679 Ah.. the UI actually rings a bell. They must have it for things other than photos as well. Thanks!

]]> By: Ashwin Nanjappa http://33bits.org/2009/09/09/livejournal-done-right-the-case-for-a-social-network-with-built-in-privacy/#comment-678 Mon, 14 Sep 2009 08:35:05 +0000 http://33bits.org/?p=229#comment-678 The UI is surprisingly well done (note the red color on the Everyone-but-X section):
http://dl.getdropbox.com/u/1240675/Misc/2009_09_14_facebook_privacy.png

]]> By: Arvind http://33bits.org/2009/09/09/livejournal-done-right-the-case-for-a-social-network-with-built-in-privacy/#comment-677 Mon, 14 Sep 2009 08:23:19 +0000 http://33bits.org/?p=229#comment-677 How is it worded? Could you send me a screenshot? (I don’t have photos on FB.) Thanks.

]]> By: Arvind http://33bits.org/2009/09/09/livejournal-done-right-the-case-for-a-social-network-with-built-in-privacy/#comment-676 Mon, 14 Sep 2009 08:19:18 +0000 http://33bits.org/?p=229#comment-676 Hey,

I’m familiar with your two essays, and that’s partly where I got the idea for everyone-but-X (the ESORICS paper I linked to also proposed something similar.) I’m sorry I couldn’t remember where I saw it when I made my post; I’ve updated the post now with links to your essays.

I’m thinking of everyone-but-X mainly in a “you must be logged in to see anything at all” context, so your objection isn’t as applicable. Besides, I’m using everyone-but-X as an example of what I consider an entire class of unexplored access control primitives, which I didn’t have time to go into in this post.

“I’m pretty sure Livejournal actually does inform users when they are friended – or at least, that users can set an option to receive such notifications.”

I’m surprised by this — I looked again but couldn’t find the option you’re talking about. I’m also surprised by your description of serial adders: I’ve read about them in multiple places, and the offense mentioned was always that people would be annoyed by the adder appearing on their friend-of list at all. (The reason for the adder then un-adding people seems to be to add yet other users, because of the out-degree <= 750 restriction, rather than to repeatedly harass the same person.)

My talk based on the themes in this post went better than I'd hoped, so I'm thinking of doing a more formal write-up. I'll be sure to cite you if I do.

]]>