Or are they really going about their sign-up process wrong? Connect.me touts itself as a social media connector. Their "about" link on the connect.me page talks about security as does some linked posts about the project and concept behind the website. But the real question lies in the marketing methodology. No real information or privacy policy if given regarding your information that is made available to connect.me.
When you sign up for a banking account, you trust your money to a bank that has to follow certain regulations as determined by the government. The rules ensure that there is oversight and a certain amount of trustworthiness inherent to the banking institution. The internet is not regulated this way, and for good reason, but this is not about regulating the internet.
Who can you trust with your personal information? It is all too often on the internet, and Facebook in particular, that people, companies, and mysterious web applications ask for access to your information. Users give away access to their accounts and their information for the ability to see how many people are accessing their profiles on Facebook even though these applications cannot really provide this information. They are displayed some information and assume that it is correct and trustworthy. Never do they take into account that it could be totally randomly generated.
Never do they actually think about what access they are giving to the application to their account. They know nothing about the entity that they are letting into their lives. Connect.me may not be malicious at all. It could be the best thing ever created for social media security. It could simply be a hoax built to be a wake-up call for us all. I believe that some of us need such a wake-up call.
Filed Under: Featured, Law & order, Privacy, Social networks, Spam
Graham Cluley's recent article about stealth-mode social networking newbies connect.me has stirred up a lot of controversy.
This site has exactly two pages - at least, it does if you don't sign up. The main page simply invites you to Reserve your username and get early access; this page takes you to a second page which simply says Login with [Facebook] [Twitter] [LinkedIn]. That's how you login, even if you're an existing user.
Oh. There's a link on the main page which opens up a half-screen of About text. The important part of this is: "We believe privacy, control, and portability are requirements, not features." The highlighted words look as though they're links to further information, but they're not.
Graham's article provoked numerous comments agreeing with us - some said that a site which asks you to sign up with no indication of (indeed, which deliberately suppresses) its proposed business is Just Plain Wrong. But others roundly said that we were unfair, and ought to have given these newcomers time to show us what they were all about before expressing an opinion.
Well, we've finally had a response from someone called Drummond Reed, claiming to be from connect.me.
I'm going to continue the controversy on Graham's behalf, by quoting and responding to Mr Reid.
Then I'll ask you, our Naked Security readers, to vote on the issue.
Here we go.
Hi Graham, this is Drummond Reed from Connect.Me. Great post! We couldn't agree more about the need to address privacy concerns around social sign-in.
Hi, Drummond.
If you agree, why don't you make a point of showing that you agree, and that you care, on your site itself? (Your site now has a privacy policy - and not much else about what it's up to - but you added it only after the controversy broke.)
Your post seemed to have help fuel the sign-up rate at Connect.Me today.
That's nice for you. Ironic, of course, but nice for you. In return, could we ask you to return the favour by saying something meaningful on your site about what you plan to do with the information you collect?
What will you store? Where will you store it? How do you intend to use it in future? Most importantly, how do I contact you to withdraw my permission to keep it? And how long will you take to delete it?
It will be great fodder for conversation at SXSW this weekend.
Have a good time, Drummond. (I'm sincere with that wish.) But talk is cheap. And SXSW isn't about security, privacy and on-line identity, is it? It's about musical and filmic content - creating it and publishing it.
How about coming to a security conference as well, and throwing yourself into the conversations you get at that sort of event? If you can make it to Infosec in London, England, in April (or to AusCERT in Queensland, Australia, in May) I'd like to invite you to the Sophos stand.
We'll love to have someone from connect.me take part in a panel discussion on our stand - and we'll buy the beers.
To put any fears to rest, we're not scammers. We're people from the Internet identity and privacy space working to help make a better, safer social web.
Thanks. That makes me feel better. I think.
But I've read words that are equally earnest, and which sound just as sincere, from Advance Fee Fraudsters, from peddlers of fake anti-virus, and from those call centres which say they're from Microsoft and they've phoned especially to help.
The point is that if you really care about privacy, you shouldn't ask people to enter into any sort of on-line social contract without explaining who you are, what your intentions are, and what mechanisms you have in place - now and for the future - to protect that privacy.
In fact, it'll almost be worse if you guys really do turn out to be legitimate. Because the tens or hundreds of thousands of users who've taken a risk on you and got away with it will be more inclined to take risks again. Next time they do, it probably won't be Drummond Reed, Nice Guy of the Net.
Please be more open and less marketroidistic! I suspect we agree about the end result. But not about how you have gone about reaching it.
And now, Naked Security readers, what do you think? Please vote in our poll:
No comments:
Post a Comment