Weird Me.com "spam"?

[whooleytoo]

Ever since Apple activated the Me.com domain for mail, I've had a huge increase in the amount of spam I get, all going to "me.com", not the old "mac.com" address.

What's odd is that some of it comes from fairly reputable sites - NY Times, Motley Fool and several others.

Weirdest of all though, I got a shipping confirmation from AT&T for an iPhone, I checked it out (purely to confirm) and it's genuine.

It looks like someone thinks they're using my email address?!? I have a full postal address (in Florida), but not a name. Should I write a letter asking him to STOP GIVING OUT MY EMAIL ADDRESS! :p

Help!!

[whooleytoo]

Well, at least I know one company which has signed me up for spam with legitimate companies, ActiveResponseGroup.com.

From their site:
"Generating 1 million new customer leads per month" :mad::mad::mad:

What do people think? Since some of these sites (NYTimes.com, Philips etc.) are reputable sites that aren't likely to spam, is it safe to cancel all these spam subscriptions, or would that just confirm it's a live email address?

Several of the spammers don't even offer an unsubscribe option.

[DiamondMac]

None for me with Me.com account

[pjac]

It could be the guy has a real email address got into the habit of using xxx@me.com when forced to give an email address (e.g. forum registrations etc). And for a long long time, this was just a defunct email address... but now it comes to you!

[MacBoobsPro]

Delete.

[Peace]

Well, at least I know one company which has signed me up for spam with legitimate companies, ActiveResponseGroup.com.

From their site:
"Generating 1 million new customer leads per month" :mad::mad::mad:

What do people think? Since some of these sites (NYTimes.com, Philips etc.) are reputable sites that aren't likely to spam, is it safe to cancel all these spam subscriptions, or would that just confirm it's a live email address?

Several of the spammers don't even offer an unsubscribe option.

Beware the unsubscribe option from spam. It is often a way to confirm your real email address.

If you get new spam just delete it. Eventually it will go away.

[Pooshka]

The commoner one's Apple ID is, the likelier it is to receive spam.

[whooleytoo]

Cheers, I won't click the unsubscribe link so.

My 'username' is a short, common word, which is in the dictionary so that might be part of it. (I often get seemingly valid emails too by accident.. from the World Health Organisation, from people messing around in Apple Stores etc.) I even received one blank email which occurred when someone pasted a joke into the To: field by accident and it sent to every word! (There@mac.com, was@mac.com, a@mac.com, blonde@mac.com....)

It's just odd that there has been such a big increase since me.com activated, and the volume seems to be growing daily.

And receiving the valid order info from AT&T is odd too.

[MacAhoy]

I posted about this earlier, hoping we can generate some *critical mass* to get Apple to remedy this simple, and inexcusable, security hole -- originally pointed out by a poster on Apple's own discussion forums:

Mobile Me e-mail addresses are vulnerable to being harvested for spamming, or worse, due in part to their being visible to THE PUBLIC -- because they are automatically appended to the URL of Mobile Me web galleries.. for example, Emily Parker's Web Gallery address is:
http://gallery.mac.com/emily_parker#gallery

see thread:
http://forums.macrumors.com/showthread.php?t=529621

- Let's put some friendly viral pressure on Apple (YouTube video clip..?..) to
*PLEASE*
*FIX*
*THIS* - !

[Daveoc64]

I don't think this will get "fixed".

It's the intended functionality of MobileMe (and .Mac before it).

All of your services are accessible from one name.

There wouldn't really be a way to solve this, without making things far more complex than a consumer level product needs to be.

You would need to have multiple identities for each service.

You can't really have a service like MobileMe work unless you accept that certain parts will be accessible by all internet users (both good and bad).

The average user will want to tell someone that their MobileMe gallery is located at http://gallery.mac.com/username#gallery

Same with iDisk.

[MacAhoy]

I don't think this will get "fixed".

It's the intended functionality of MobileMe (and .Mac before it).

All of your services are accessible from one name.

There wouldn't really be a way to solve this, without making things far more complex than a consumer level product needs to be.

You would need to have multiple identities for each service.

You can't really have a service like MobileMe work unless you accept that certain parts will be accessible by all internet users (both good and bad).

The average user will want to tell someone that their MobileMe gallery is located at http://gallery.mac.com/username#gallery

Same with iDisk.

Umm..
this seems like quite a fatalistic view of things.
I don't agree that a service intended for use by the masses *has to* be insecure just because it is meant for use by "average" users.

..makes me think of those "Dumb & Dumber" movies... which I truly don't believe is Apple's ambition! (sorry, no flaming intended -- but I don't think we should just assume that we "have to" follow THAT model! ;-)

Part of the success of an information-services company like Apple is to accomplish skilled, educated, intellectual work "behind the scenes" that the average user CAN'T do, so PAYS for. Certainly Apple consistently markets itself as capable of innovatively solving "complicated" software problems elegantly and effectively.
(which is why so many people are indeed surprised and dismayed by the recent inelegant launch of MobileMe.. )

As I recall, this same username security issue was raised in connection with Google's online photo-album service, "Picasa Web Albums" -- so it's hardly the first time this has come up. (I can't remember what the outcome of the Picasa username controversy was, though.)

[Daveoc64]

Umm..
this seems like quite a fatalistic view of things.
I don't agree that a service intended for use by the masses *has to* be insecure just because it is meant for use by "average" users.

..makes me think of those "Dumb & Dumber" movies... which I truly don't believe is Apple's ambition! (sorry, no flaming intended -- but I don't think we should just assume that we "have to" follow THAT model! ;-)

Part of the success of an information-services company like Apple is to accomplish skilled, educated, intellectual work "behind the scenes" that the average user CAN'T do, so PAYS for. Certainly Apple consistently markets itself as capable of innovatively solving "complicated" software problems elegantly and effectively.
(which is why so many people are indeed surprised and dismayed by the recent inelegant launch of MobileMe.. )

As I recall, this same username security issue was raised in connection with Google's online photo-album service, "Picasa Web Albums" -- so it's hardly the first time this has come up. (I can't remember what the outcome of the Picasa username controversy was, though.)

It's not really fatalist because I don't see it as a very big issue.

If you think about it, .Mac and iTools have been doing the exact same thing since 2000. There may or may not have been a spam issue as a result, but it's not really new to MobileMe.

The way I see it, your MobileMe name is your identity across several services and devices.

There's no logical way to have different names for different parts of MobileMe (which is the only way you could solve this issue).

[MacAhoy]

It's not really fatalist...

There's no logical way to have different names for different parts of MobileMe (which is the only way you could solve this issue).


Perhaps I should have been more specific..

What I meant is that (in general) usually there IS more than one way to solve this sort of problem. Your view struck me as being "fatalistic" because you claimed that there is only one way to handle this particular problem.

Of course, having multiple names for different parts of the Mobile Me service *would* be clumsy & not worthwhile; but I doubt that this is the "only" way to make the username more secure, in this situation.
I freely admit that I don't personally want to spend a lot of time figuring out these alternatives -- that's what Apple gets money for doing for me!

[Sonicjay]

It could be the guy has a real email address got into the habit of using xxx@me.com when forced to give an email address (e.g. forum registrations etc). And for a long long time, this was just a defunct email address... but now it comes to you!

hehe, that's a good point; I used to regularly put "me@me.com" in email fields when blasting through some stupid registration to download a patch or some other extraneous file from a site I'd not need to go back to. This was long before it was a real domain.

[Daveoc64]

Perhaps I should have been more specific..

What I meant is that (in general) usually there IS more than one way to solve this sort of problem. Your view struck me as being "fatalistic" because you claimed that there is only one way to handle this particular problem.

Of course, having multiple names for different parts of the Mobile Me service *would* be clumsy & not worthwhile; but I doubt that this is the "only" way to make the username more secure, in this situation.
I freely admit that I don't personally want to spend a lot of time figuring out these alternatives -- that's what Apple gets money for doing for me!

You just can't look at things like that.

At the end of the day, one of the key points of how this service works is that your username is used in various places. The ONLY way to solve this would be to have a different name on your gallery.

It's not fatalistic to say that:

Right now I can tell my Mum who can barely use a computer, that my gallery is at gallery.me.com/username

She can remember this because my e-mail is username@me.com

If I were to introduce her to Public iDisk, she could also get there from my username.

It's a core part of the service's design.

I just don't see how you can change it without the service being degraded.

Apple isn't being paid to solve problems for you, you are paying for MobileMe in its current state. Apple probably doesn't see this as an issue, due to how long its actually been around (since 2000).

[whooleytoo]

If you think about it, .Mac and iTools have been doing the exact same thing since 2000. There may or may not have been a spam issue as a result, but it's not really new to MobileMe

In which case, that may not be my issue - since I've had a massive increase in spam since the move to MobileMe; plus as I've mentioned, the spam is odd in that much of it is from reputable sites/companies who wouldn't normally do so.

I think it might just be people typing in random/junk addresses when they don't want to enter their own, and given that my address is a short and common word just meant I'm getting a lot of random junk now that address has been activated.

I might just send everything addressed to ...@me.com to the bin and keep using mac.com. Seems the only option.

[Macsterguy]

Dont forget that with the online Me mail, you have the option to "report as Spam" option... I use this with every spam email I get.... Seems to work!

[cwedl]

It could be the guy has a real email address got into the habit of using xxx@me.com when forced to give an email address (e.g. forum registrations etc). And for a long long time, this was just a defunct email address... but now it comes to you!

Why don't you get up an alias for signups, that way if it gets too bad, delete it and start again.

[MacAhoy]

You just can't look at things like that.

At the end of the day, one of the key points of how this service works is that your username is used in various places. The ONLY way to solve this would be to have a different name on your gallery.

It's not fatalistic to say that:

Right now I can tell my Mum who can barely use a computer, that my gallery is at gallery.me.com/username

She can remember this because my e-mail is username@me.com

If I were to introduce her to Public iDisk, she could also get there from my username.

It's a core part of the service's design.

I just don't see how you can change it without the service being degraded.

Apple isn't being paid to solve problems for you, you are paying for MobileMe in its current state. Apple probably doesn't see this as an issue, due to how long its actually been around (since 2000).

Don't worry, your Mum should still be able to use this service to reach you even if Apple DOES improve username security ... :-)

Indeed, Apple *is* paid to solve "problems" -- i.e., to figure out how to program software that will provide valuable services (this is what I mean by a "problem" .. until a programmer comes up with a software "solution.")
(It's been a long time since I myself have done any programming, but in my experience such "problems" are actually fun for programmers. :-)

As I said, I don't have energy or time to spend on finding an answer to this particular "issue" (if you prefer to call it something other than "problem")... but what I imagine is something that would be done on the server side of things, not on your Mum's (or my) side of things: i.e., yes, we need to be able to use our usernames as a sort of master key to Mobile Me services -- but Apple could employ any number of other software actions on its part to prevent universal access to accounts. Password-protecting a Web Gallery is just one example (and by no means the best, I suspect).

So yes I think that there probably ARE multiple ways of addressing this -- probably at least a few that we as users would have a difficult time dreaming up since we are not programmers.

[MacAhoy]

.. you are paying for MobileMe in its current state. Apple probably doesn't see this as an issue, due to how long its actually been around (since 2000).

Sorry, forgot to add that as of yet I am *not* paying Apple for MobileMe in its current state, primarily because its current state doesn't seem to be worth the fee so far......... :-(

I agree that Apple probably doesn't see this username security hole as an issue -- which is why I think it should be brought to their attention, since I truly believe that it is actually not a hugely difficult thing to address. (Of course, right now they're no doubt busily working on other MobileMe items that ARE hugely difficult.........)

[MacAhoy]

I might just send everything addressed to ...@me.com to the bin and keep using mac.com. Seems the only option.

Just wanted to check -- by "the bin," did you mean the ..um.. trash?

[Daveoc64]

Don't worry, your Mum should still be able to use this service to reach you even if Apple DOES improve username security ... :-)

Indeed, Apple *is* paid to solve "problems" -- i.e., to figure out how to program software that will provide valuable services (this is what I mean by a "problem" .. until a programmer comes up with a software "solution.")
(It's been a long time since I myself have done any programming, but in my experience such "problems" are actually fun for programmers. :-)

As I said, I don't have energy or time to spend on finding an answer to this particular "issue" (if you prefer to call it something other than "problem")... but what I imagine is something that would be done on the server side of things, not on your Mum's (or my) side of things: i.e., yes, we need to be able to use our usernames as a sort of master key to Mobile Me services -- but Apple could employ any number of other software actions on its part to prevent universal access to accounts. Password-protecting a Web Gallery is just one example (and by no means the best, I suspect).

So yes I think that there probably ARE multiple ways of addressing this -- probably at least a few that we as users would have a difficult time dreaming up since we are not programmers.

Passwords would not work.

You'd still have your gallery at:

gallery.me.com/username

The public gallery being public isn't the "problem", it's the fact that the username is in the URL for every MobileMe user.

If you password protected the gallery, it would still exist at gallery.me.com/username - that would be just as open to abuse by spammers.

As a programmer, I understand the concept of solving a problem with a technical solution, but when the problem is actually a benefit in another area there isn't a lot you can do.

[d21mike]

Passwords would not work.

You'd still have your gallery at:

gallery.me.com/username

The public gallery being public isn't the "problem", it's the fact that the username is in the URL for every MobileMe user.

If you password protected the gallery, it would still exist at gallery.me.com/username - that would be just as open to abuse by spammers.

As a programmer, I understand the concept of solving a problem with a technical solution, but when the problem is actually a benefit in another area there isn't a lot you can do.

It seems to me that USERID's have been used for this type of thing for a very long time (easy to implement). So it is not new. It is just that the bad guys have gotten a lot more persistance over the years.

However, they could follow the way Google Calendar works. When you create your Google Calendar you are provided with a VERY LONG URL to give out to people that want to share your calendar and it does not have your USERID as part of the URL. Maybe they could offer both options. A simple (but less secure) URL and the Longer more secure URL.

[MacAhoy]

Passwords would not work.

You'd still have your gallery at:

gallery.me.com/username

The public gallery being public isn't the "problem", it's the fact that the username is in the URL for every MobileMe user.

If you password protected the gallery, it would still exist at gallery.me.com/username - that would be just as open to abuse by spammers.

As a programmer, I understand the concept of solving a problem with a technical solution, but when the problem is actually a benefit in another area there isn't a lot you can do.

Right, it would still exist at that URL -- but the URL itself could be protected by password, no? (I haven't utilized this feature myelf so don't know how it works at present). As I remember, this same controversy arose when Google first offered its "Picasa Web Albums" service -- Sergey Brin's photos were being accessed by persona non grata, because they were able to easily guess the URL for his albums. Seems to me that this was resolved (or, maybe not..) by establishing an alias that could be utilized for the URLs in question.

In any event, the main security issue has to do with the ease with which usernames could be located by search engines -- not so much to do with the "guessability" of usernames, which is always possible (but less of a concern than harvesting via Google searches, for instance).

What sort of programming do you do?

[Daveoc64]

Right, it would still exist at that URL -- but the URL itself could be protected by password, no? (I haven't utilized this feature myelf so don't know how it works at present). As I remember, this same controversy arose when Google first offered its "Picasa Web Albums" service -- Sergey Brin's photos were being accessed by persona non grata, because they were able to easily guess the URL for his albums. Seems to me that this was resolved (or, maybe not..) by establishing an alias that could be utilized for the URLs in question.

In any event, the main security issue has to do with the ease with which usernames could be located by search engines -- not so much to do with the "guessability" of usernames, which is always possible (but less of a concern than harvesting via Google searches, for instance).

What sort of programming do you do?

I'm currently doing a Computer Science degree, so a large part of it is programming.

The problem is not anything to do with the security of the gallery.

The OP (and others) were concerned that people could simply look at the name of every MobileMe gallery and automatically gain access to a huge amount of guaranteed to work e-mail addresses for SPAM purposes.

If http://gallery.me.com/emily_parker is a valid gallery (i.e. the user is paying for their MobileMe subscription), then emily_parker@me.com (or @mac.com) is a valid address that could be spammed.

[MacAhoy]

It seems to me that USERID's have been used for this type of thing for a very long time (easy to implement). So it is not new. It is just that the bad guys have gotten a lot more persistance over the years.

However, they could follow the way Google Calendar works. When you create your Google Calendar you are provided with a VERY LONG URL to give out to people that want to share your calendar and it does not have your USERID as part of the URL. Maybe they could offer both options. A simple (but less secure) URL and the Longer more secure URL.

Thanks for this suggestion, d21mike!

I had forgotten that is what was done with Google's Picasa Web Album service, actually. (in fact I posted a very lengthy slideshow on that service a couple of years ago, and I now recall that the URL for this was indeed extremely long... quite a good slideshow service, as it provides much larger images than Yahoo slideshows, for instance.)

So there is some hope that MobileMe usernames could be made less vulnerable in similar fashion..?
(Would make me feel much more willing to hand over my credit card info, if I weren't worrying about someone potentially gaining access to my MobileMe account via an insecure username -!)

[MacAhoy]

I'm currently doing a Computer Science degree, so a large part of it is programming.

The problem is not anything to do with the security of the gallery.

The OP (and others) were concerned that people could simply look at the name of every MobileMe gallery and automatically gain access to a huge amount of guaranteed to work e-mail addresses for SPAM purposes.

If http://gallery.me.com/emily_parker is a valid gallery (i.e. the user is paying for their MobileMe subscription), then emily_parker@me.com (or @mac.com) is a valid address that could be spammed.


Hmmmm..
1. I'm not the OP (whooleytoo is), but I am the person who first raised this particular issue of username insecurity in the present thread. (see my first post above, on page 1.) Your description of the manner in which spammers could obtain valid MobileMe addresses by simply looking at Web Gallery URLs is the same as what I wrote about in my first post.

2. I did not say that the problem was "anything to do with the security of the gallery," so I guess we are in agreement there.

[Daveoc64]

2. I did not say that the problem was "anything to do with the security of the gallery," so I guess we are in agreement there.

You suggested a password.

That would not be possible to protect a URL.

e.g. http://gallery.me.com/emily_parker

[MacAhoy]

You suggested a password.

That would not be possible to protect a URL.

e.g. http://gallery.me.com/emily_parker

Actually the password was not a suggestion of mine; it is mentioned in Apple's .Mac support documents -- but not for protection of URLs, though.

http://docs.info.apple.com/article.html?artnum=306162

I think mike (above) had a good suggestion, which has already been implemented by Google to address this issue.

[Daveoc64]

I think mike (above) had a good suggestion, which has already been implemented by Google to address this issue.

It's one possibility, but it seems to complex for MobileMe.

[jessica.]

I too have experienced an influx of spam under my .mac/me account in the last few days. I usually file junk in a junk folder so I can try and figure out what rules to set up. In June I received a total of 10 junk e-mails. This month, this past 5 days actually I've received 18 pieces.

[MacAhoy]

It's one possibility, but it seems to complex for MobileMe.

What is complex about it?
I think the way this was implemented on Picasa Web Albums functioned no differently than the current
MobileMe style of URL ... in other words, not different
for the average user, who just clicks on a longer URL, that is too long to be useful for spammers.
(oh, you wanted a short, memorable link for people such as your Mum... wouldn't an alias accomplish that?)

[Daveoc64]

What is complex about it?
I think the way this was implemented on Picasa Web Albums functioned no differently than the current
MobileMe style of URL ... in other words, not different
for the average user, who just clicks on a longer URL, that is too long to be useful for spammers.
(oh, you wanted a short, memorable link for people such as your Mum... wouldn't an alias accomplish that?)

Well no, but at the end of the day Apple is pushing features that are very public and not at all complex.

My website would be at web.mac.com/username

You can't turn that into a long link without it being annoying.

You'd have to seriously change how the service is designed to eliminate the issue.

[MacAhoy]

Well no, but at the end of the day Apple is pushing features that are very public and not at all complex.

My website would be at web.mac.com/username

You can't turn that into a long link without it being annoying.

You'd have to seriously change how the service is designed to eliminate the issue.

Dave,
your reply begins: "Well no..."
meaning no *what*??...
Is this your reply to my question about use of aliases?
(i.e., a shorthand substitute for a lengthy URL)?

It seems that you're repeating things you said above, so I don't know how to dialogue about this further with you. Perhaps if you have a look at the Google examples mentioned (Google Calendar, Picasa Web Gallery) you could see what you think of this particular solution.
Although (as I said earlier) I don't think that there's only one way to deal with this issue... I realize you don't agree with that, so I'll leave it there for now.

[Daveoc64]

Dave,
your reply begins: "Well no..."
meaning no *what*??...
Is this your reply to my question about use of aliases?
(i.e., a shorthand substitute for a lengthy URL)?

It seems that you're repeating things you said above, so I don't know how to dialogue about this further with you. Perhaps if you have a look at the Google examples mentioned (Google Calendar, Picasa Web Gallery) you could see what you think of this particular solution.
Although (as I said earlier) I don't think that there's only one way to deal with this issue... I realize you don't agree with that, so I'll leave it there for now.

Google Calendar and Picasa Web Gallery aren't the same as MobileMe.

MobileMe offers:

1 name for you (to login)
1 name for your web page(s)
1 name for your e-mail
1 name for your public iDisk
1 name for your MobileMe gallery

The problem with using 1 name is that you must accept that people can access all the parts of the system if they know it from using just one of them.


Google Calendar's toggle of making the calendar "public" or not is an interesting idea. I don't really think it would work with MobileMe's services. An individual calendar is totally different to a space designed for sharing with people. I don't want people to see my calendar, but my public iDisk is just that - public. I see no way to make it truly public without revealing the username.

Looking at Picasa Web Albums, their solution isn't all that great. It could easily be ignored by a spammer.

Oh and sorry, I wasn't very clear. I did mean the "well no" to be in response to the alias thing.

[MacAhoy]

Google Calendar and Picasa Web Gallery aren't the same as MobileMe.

MobileMe offers:

1 name for you (to login)
1 name for your web page(s)
1 name for your e-mail
1 name for your public iDisk
1 name for your MobileMe gallery

The problem with using 1 name is that you must accept that people can access all the parts of the system if they know it from using just one of them.


Google Calendar's toggle of making the calendar "public" or not is an interesting idea. I don't really think it would work with MobileMe's services. An individual calendar is totally different to a space designed for sharing with people. I don't want people to see my calendar, but my public iDisk is just that - public. I see no way to make it truly public without revealing the username.

Looking at Picasa Web Albums, their solution isn't all that great. It could easily be ignored by a spammer.

Oh and sorry, I wasn't very clear. I did mean the "well no" to be in response to the alias thing.

OK -- so "well no.. in response to the alias thing":
would you mind explaining *why* no?

And regarding the Picasa Web Albums solution "not being all that great... easily ignored": so what does this ignoring accomplish? or what risk is there to the user if a spammer "ignores" ... what? :-o

I do understand the point you have been repeating, that a "1 name" sort of master key is by nature "public." I'm sure you're aware of the entire sub-specialty of computer science that deals only with security of "public" keys, & such... so I continue to assume that some security could be overlaid (if you will) on top of this "master key" sort of scheme.

In any event -- the *specific* thing that DOES need protecting is access to a user's actual MobileMe account data... so surely there are ways of enhancing the security of this one item, even if the username itself is publicized. (I seem to remember there is also a password access feature that is applicable to the Public iDisk, for instance..)

[DiamondMac]

Stop signing your name up at porn sites ;)

[MacAhoy]

Stop signing your name up at porn sites ;)

Have you seen someone named "MacAhoy" at porn sites, OrleansMac? ;)

[DiamondMac]

Have you seen someone named "MacAhoy" at porn sites, OrleansMac? ;)

I plead the 5th

[Daveoc64]

OK -- so "well no.. in response to the alias thing":
would you mind explaining *why* no?

And regarding the Picasa Web Albums solution "not being all that great... easily ignored": so what does this ignoring accomplish? or what risk is there to the user if a spammer "ignores" ... what? :-o

I do understand the point you have been repeating, that a "1 name" sort of master key is by nature "public." I'm sure you're aware of the entire sub-specialty of computer science that deals only with security of "public" keys, & such... so I continue to assume that some security could be overlaid (if you will) on top of this "master key" sort of scheme.

In any event -- the *specific* thing that DOES need protecting is access to a user's actual MobileMe account data... so surely there are ways of enhancing the security of this one item, even if the username itself is publicized. (I seem to remember there is also a password access feature that is applicable to the Public iDisk, for instance..)

I think you're turning MobileMe into something it's not.

It's a service aimed at consumers. It's not designed for top secret data. A username on it is not a "public key".

It's not a key at all. It's a way of locating data - associated with a person. That is also why aliases would not work. Your MobileMe user name is your name on the web, having different names for different parts of the service would make that experience fall apart. I know that I can find my friend's MobileMe iDisk, Gallery, Web Page etc. just by knowing their user name. Aliases would make that experience inconsistent.

As for Picasa's security being "ignorable", as far as I can tell it just places a robots file in your gallery which stops automated systems (like search engines) looking at such a site. These can be ignored and I'd imagine anybody looking for e-mail addresses for SPAM would just do that. On closer inspection, it seems to just remove the link from Google search engines.

The issue with all of these sites is that the username is used for authentication and as an identity. It's one of their strongest points, but also a big flaw in many ways - but there's very little you can do to overcome the issue of spammers abusing the system.

[MacAhoy]

I think you're turning MobileMe into something it's not.

It's a service aimed at consumers. It's not designed for top secret data. A username on it is not a "public key".

It's not a key at all. It's a way of locating data - associated with a person. That is also why aliases would not work. Your MobileMe user name is your name on the web, having different names for different parts of the service would make that experience fall apart. I know that I can find my friend's MobileMe iDisk, Gallery, Web Page etc. just by knowing their user name. Aliases would make that experience inconsistent.

As for Picasa's security being "ignorable", as far as I can tell it just places a robots file in your gallery which stops automated systems (like search engines) looking at such a site. These can be ignored and I'd imagine anybody looking for e-mail addresses for SPAM would just do that. On closer inspection, it seems to just remove the link from Google search engines.

The issue with all of these sites is that the username is used for authentication and as an identity. It's one of their strongest points, but also a big flaw in many ways - but there's very little you can do to overcome the issue of spammers abusing the system.

So far I haven't turned MobileMe into anything.. haven't got those kind of Harry Potter skills ;)

(I used the terms "public key" in a rather non-technical fashion, by the way -- as a shorthand for the way in which you described it, as basically a locator of data.. sorry if this muddied things.)

Of course MobileMe is aimed at consumers. So is every banking website. If a bank can securely prevent unauthorized access to its customers' data, I would assume & expect that Apple could do so as well. Being oriented to consumers doesn't relieve Apple of reasonable responsibility to prevent abuse of customer data -- especially sensitive financial data that might be obtained through unauthorized access to customer accounts. (By that I'm referring to the actual webpage which displays customer data such as name, contact info, etc.)

In any event, the *specific* thing that DOES need protecting is access to a user's actual MobileMe account data... so surely there are ways of enhancing the security of this one item, even if the username itself is publicized.

Since I'm not a MobileMe customer -- yet -- I haven't seen a MobileMe account webpage.. but it appears from your signature that you are a current MM customer, so perhaps you can tell us: if an unauthorized person were to gain access to your MM account (yes, I know that is a big assumption, so stay with me here) -- is there any possibility of such a person editing or revising your financial data, such as your credit card #? Could they establish false contact info for "you"?

[d21mike]

Since I'm not a MobileMe customer -- yet -- I haven't seen a MobileMe account webpage.. but it appears from your signature that you are a current MM customer, so perhaps you can tell us: if an unauthorized person were to gain access to your MM account (yes, I know that is a big assumption, so stay with me here) -- is there any possibility of such a person editing or revising your financial data, such as your credit card #? Could they establish false contact info for "you"?

Like most sites, the billing information shows the last 4 of your credit card number. But it also shows you billing address and other somewhat private information.

Of course this is pretty much that same as any site if they can find out your userid/password. In this case they would know your userid but not your password.

[MacAhoy]

Like most sites, the billing information shows the last 4 of your credit card number. But it also shows you billing address and other somewhat private information.

Of course this is pretty much that same as any site if they can find out your userid/password. In this case they would know your userid but not your password.

Thanks, Mike -- I quite appreciate being able to know what is shown on that page.
What other private info is displayed? (obviously I'm not asking you to specify your particular details -- just the nature of the info: i.e.: phone numbers? what else is obligatory?
(I use a mailing address for my credit card, so at least I don't reveal my physical address when using my card.)

Do you think there is any risk at all of someone unauthorized, who knows your username from MobileMe's public services, to gain entry to your account -- AND to change your private info? (for example, replacing your contact info woukd be quite harmful...)

I'm asking because another poster suggested (on a different thread) that obtaining passwords is not actually that hard to do... What do you think about that, also?

Thanks!

[Macsterguy]

Don't forget to turn on that iTunes "1-chick shopping"

[d21mike]

Thanks, Mike -- I quite appreciate being able to know what is shown on that page.
What other private info is displayed? (obviously I'm not asking you to specify your particular details -- just the nature of the info: i.e.: phone numbers? what else is obligatory?
(I use a mailing address for my credit card, so at least I don't reveal my physical address when using my card.)

Do you think there is any risk at all of someone unauthorized, who knows your username from MobileMe's public services, to gain entry to your account -- AND to change your private info? (for example, replacing your contact info woukd be quite harmful...)

I'm asking because another poster suggested (on a different thread) that obtaining passwords is not actually that hard to do... What do you think about that, also?

Thanks!

That's about it. Your billing address, phone number. Not sure of anything else. I am not sure how much damage could be caused by logging into my account and changing my CC Number and address and then say adding additional storage on a bad CC. Also, maybe logging into iTunes and buying movies and and music. I think I would be able to challenge that activity like I would if someone stole my cc and used it to buy something. Of course it would be a hassel.


REVISION: Maybe should not have mentioned iTunes. I use a different login for that. However, maybe others here would be using their MM Account for iTunes as well.

[MacAhoy]

That's about it. Your billing address, phone number. Not sure of anything else. I am not sure how much damage could be caused by logging into my account and changing my CC Number and address and then say adding additional storage on a bad CC. Also, maybe logging into iTunes and buying movies and and music. I think I would be able to challenge that activity like I would if someone stole my cc and used it to buy something. Of course it would be a hassel.


REVISION: Maybe should not have mentioned iTunes. I use a different login for that. However, maybe others here would be using their MM Account for iTunes as well.

So it seems that your CC # is stored online, actually.. kinda surprises me since it's only billed once a year -- you wouldn't have any reason to need frequent access to it in your MM account, I would think..

As I recall from the first page of the MM sign-up website, you do have to supply an existing e-mail address, too.. is that listed on your MM account info, along with your phone # & so forth?

I don't really worry so much about unauthorized purchases as I do about simple ID theft -- anyone who gets to see all this info in one place can then pretend to be me in other places.

So what's your opinion (if you have an informed one) about the risk of password theft? Could a person who knows your MM identity also get your password, or is that just not possible?

[d21mike]

So it seems that your CC # is stored online, actually.. kinda surprises me since it's only billed once a year -- you wouldn't have any reason to need frequent access to it in your MM account, I would think..

As I recall from the first page of the MM sign-up website, you do have to supply an existing e-mail address, too.. is that listed on your MM account info, along with your phone # & so forth?

I don't really worry so much about unauthorized purchases as I do about simple ID theft -- anyone who gets to see all this info in one place can then pretend to be me in other places.

So what's your opinion (if you have an informed one) about the risk of password theft? Could a person who knows your MM identity also get your password, or is that just not possible?

Not sure you should rely to heavily on my opinion but I will give it anyway.

1. I am registered on a number of sites and they all seem to store my CC number but only show the last 4 as I said earlier. However, when they do the auto re-new they usually tell you in advance (not sure MM will do that). However, you can go in and change your CC at any time (not sure about MM). If your CC expires then you would be required to update it.

2. Yes, your email address is in your Profile.

3. If you use a STRONG PASSWORD (which is recommended) then it would be hard for someone to guess and get into your records. However, if someone got a hold of the MM Account Database then of course we would all be exposed. But this would be the same for pretty much any site. This is very rare but I have seen it in the news.

However, I think you are coming from the standpoint that in this case they have 50% of the information (your USERID). So in this case I would think it more important that you have a STRONG PASSWORD. Which I think would make your information pretty safe.

[MacAhoy]

Not sure you should rely to heavily on my opinion but I will give it anyway.

1. I am registered on a number of sites and they all seem to store my CC number but only show the last 4 as I said earlier. However, when they do the auto re-new they usually tell you in advance (not sure MM will do that). However, you can go in and change your CC at any time (not sure about MM). If your CC expires then you would be required to update it.

2. Yes, your email address is in your Profile.

3. If you use a STRONG PASSWORD (which is recommended) then it would be hard for someone to guess and get into your records. However, if someone got a hold of the MM Account Database then of course we would all be exposed. But this would be the same for pretty much any site. This is very rare but I have seen it in the news.

However, I think you are coming from the standpoint that in this case they have 50% of the information (your USERID). So in this case I would think it more important that you have a STRONG PASSWORD. Which I think would make your information pretty safe.

Thx Mike.
Where is a good place online to get "STRONG PASSWORD" guidance? I have seen it at Yahoo Mail & similar sign-up pages, but I don't need to sign up for anything else just now..... ;)

Also --
I just realized why a gift card may not work at any point in this process: gift cards don't have a billing address, do they? (or security codes?)

[d21mike]

Thx Mike.
Where is a good place online to get "STRONG PASSWORD" guidance? I have seen it at Yahoo Mail & similar sign-up pages, but I don't need to sign up for anything else just now..... ;)

Also --
I just realized why a gift card may not work at any point in this process: gift cards don't have a billing address, do they? (or security codes?)

Not familiar with Gift Cards.

Search Google for more help. But here is a free web page from MS.

http://www.microsoft.com/protect/yourself/password/checker.mspx

Also, last night I was reading on the App Store for the iPhone about SplashID (sure there are more) and it has a feature to create a STRONG PASSWORD for you. Not sure I will use them but I am looking into something like it to store confidential information. PASSWORD creator is extra.

http://www.splashdata.com/splashid/index.asp