merig00 ([info]merig00) wrote in [info]no_lj_ads,
@ 2007-05-23 15:18:00
Previous Entry  Add to memories!  Tell a Friend!  Next Entry
Entry tags:sup, third party sites

More gifts from SUP
Hi guys,

I've got more news on SUP. This time it's more serious.

Recently SUP Fabrik announced about creation of a new website WWW.LIVEJOURNAL.RU - a guidebook and directory to the Cyrillic section of LJ. And at the same time online-magazine KOMMERSANT.RU switched it's forum authorization to accept LJ logins. It would be all good, but the problem is that when you open www.livejournal.ru or any article on www.kommersant.ru you see a familiar nick - your lj login. You'll be logged in into the websites with no effort from user. The only way for these two website (and Nosik promised that they will extend the network of sites that use LJ logins) will not get your LJ nick is to logout from LJ every time you use it. In my opinion this is ridiculous and resembles use of online-banking when they recommend to logout, close your browser and clean cookies after every use.

I think I don't have to explain what new opportunities such whitelisting opens up for different advertisement and content-gathering companies. The curious bug makes it evident that the whole thing was made thinking about investors and advertisements and not users:


This what you get when trying to logout from LJ on Kommersant webpage. In red square it says: Authorization error: You left Live Journal. Please login again.
However right above the square it says that you are logged in.

And a general bug from www.livejournal.ru which allows basicly anyone to find out your LJ nick:
LINK

UPD: Here is Nosik's reply on some user remark that he didn't agree for the 3rd party websites to use his login:
Don't want to be recognized by the system, don't log in.
Don't want to be recognized by one of the system sites, don't enter that one site.
Want to enter that site, but don't want to see your login, log out before you enter the site.

This is your free choice as a user.
Nobody can make this decisions for you.

UDP2: What consequences will bring this new lj-only access to www.kommersant.ru comments? Well there are two options. The number of comments on their articles drop significantly and noone wins. That's one option. Another is that we'll see a drastic increase in new but empty LJ accounts created just to use kommersant forum. In this case wins only SUP&Nosik who can scream on every corner how cyrillic sector of LJ growth and that they are transforming LJ into new media-project of 21st century. In any case LJ-user looses since it will put some strain on servers and will take up some cool usernames that noone uses.

UPD3: Some paid users complained that they see ads on official SUP website www.livejournal.ru. Their logic is that since they paid 6A not to see the advertisement on LiveJournal they also shouldn't see it on the LJ-service  websites managed by SUP. Here is official answer from SUP:
As paid LJ-user, who signed contract with company Six Apart, you don't see ads on pages of LiveJournal.com - blog-hosting platform. However, Livejournal.RU - is a media and service project, and all content is generated by company "SUP"
I will not be surprised if SUP will soon start charging people for their own services...

UPD4: It just hit me. Kommersant's server is located on the territory of Russian Federation that means - every person that writes there is subject to russian laws. But they are using LJ authorization. Hence if US citizen writes something illegal by russian law standards on Kommersant website using LJ authorization (and assuming they are still protected by US Constituion since LJ server is in USA) he/she is a subject to extradiction request from Russian authorities. How do you like that?


(Post a new comment)


[info]smackfu
2007-05-23 11:05 pm UTC (link)
Long links break my friends page. :(

(Reply to this) (Thread)

[info]merig00
2007-05-24 01:41 am UTC (link)
My bad, I just wanted to show the way script works.

(Reply to this) (Parent)

[info]ex_shattered767
2007-05-24 01:00 am UTC (link)
I don't see any reason why non-LJ sites should get/know/log you in with your LJ username without your input. All usage of LJ identities on non-LJ sites should be completely, totally, 100% opt-in by the user.

I feel bad for the users who have to deal with this. This SUP thing looks like a bigger mess every other time you turn around, and I seem to remember LJ promising that this would be a great, beneficial opportunity for users.

(Reply to this) (Thread)

[info]merig00
2007-05-24 01:46 am UTC (link)
Well actually it's simple - to make it easy to gather statistics for SUP and their colleges to use in targeted ads.

You can feel bad for yourself also because it has nothing to do with being in SUP. It's just one of the great services SUP provided for LJ users as a whole. If you go to any of kommersant articles you'll see your name right down the page in Java applet. HERE, try it for yourself.

(Reply to this) (Parent)(Thread)

[info]ex_shattered767
2007-05-24 01:55 am UTC (link)
Holy crap.

LJ, hurry up and get OpenID working like it should so I can hurry up and delete my account.

(Reply to this) (Parent)(Thread)

[info]merig00
2007-05-24 01:57 am UTC (link)
You see, they could have done OpenID - I've seen it on other sites and used it. Works like a swiss watch. Here they whitelisted 3rd party websites to use LJ cookies!

(Reply to this) (Parent)

[info]ex_shattered767
2007-05-24 01:58 am UTC (link)
Better yet, I wanna see staff respond to this. My money's on "We didn't know [because we had our heads up our butts], it won't happen again [until 2 months from know when y'all get screwed a 50th time]."

(Reply to this) (Parent)(Thread)

[info]merig00
2007-05-24 02:06 am UTC (link)
As far as I know 6A authorized it. SUP has no access to LJ code.

Also I think this whole thing violates some of the Russian laws about invasion of privacy. I'm wondering if US laws are affected as well?

I mean it follows the same logic as if your banking institution let ebay use your online banking login cookies without asking you first.

(Reply to this) (Parent)(Thread)

[info]ex_shattered767
2007-05-24 02:15 am UTC (link)
That's what I was thinking, that this has to be some sort of privacy violation.

But if that's true, and 6A did authorize this without telling users... ugh. They keep lying to users, they don't give a crap about them. It makes me so mad.


Also, for kicks, from http://www.livejournal.com/legal/privacy.bml and emphasis my own:

LiveJournal lets other entities that show advertisements on some of our web pages set and access their cookies on your computer. Other entities' use of their cookies is subject to their own privacy policies, and not this policy. Advertisers or other entities do not have access to LiveJournal's cookies.

Yep, sure they don't. That's why a Russian website I've never been to knows which account I'm logged in as right now.

(Reply to this) (Parent)(Thread)

[info]merig00
2007-05-24 02:24 am UTC (link)
Hmm, good tip mate. I'll bug Nosik and Co about it.

(Reply to this) (Parent)(Thread)

[info]ex_shattered767
2007-05-24 02:33 am UTC (link)
Poking around the cookies for that page you linked me to, that site sets A LOT of them. Two appear to be related to this particular issue: "chk_whoami" and "ljsid" both list their host as .lj.kommersant.ru.

(Reply to this) (Parent)(Thread)

[info]merig00
2007-05-24 03:20 am UTC (link)
heh...updated the post with quote from Nosik. You'll like it.

(Reply to this) (Parent)(Thread)

[info]ex_shattered767
2007-05-24 05:24 am UTC (link)
And if he doesn't want to receive complaints about his shoddy business practices, he can just, ya know, not have shoddy business practices. That's his choice as a free businessman.

(Reply to this) (Parent)

[info]ex_shattered767
2007-05-24 02:36 am UTC (link)
Just for the recordbooks, a cheezy screencap ala moi:

http://shatteredshards.freepgs.com/photos/badcookie.gif

(Reply to this)


[info]uniquewonders
2007-05-24 05:08 am UTC (link)
There are already two requests at Support (and possibly one more). Let's hope they don't turn these private and we can see what LJ answers.

(Reply to this) (Thread)

[info]uniquewonders
2007-05-24 05:09 am UTC (link)
And both users indicate that they had opted out of SUP.

(Reply to this) (Parent)(Thread)

[info]merig00
2007-05-24 05:13 am UTC (link)
yeap. and i just found email of the manager of the customer support function for Six Apart - Joel Onodera jonodera@sixapart.com.

(Reply to this) (Parent)

[info]merig00
2007-05-24 05:14 am UTC (link)
As I said before - this has nothing to do with unique SUP services to cyrillic users. They just let those two site use LJ cookies.

(Reply to this) (Parent)(Thread)

[info]uniquewonders
2007-05-24 12:23 pm UTC (link)
Oh sorry I hadn't got that. It sucks even more then.

Have you gotten an answer from Support?

(Reply to this) (Parent)(Thread)

[info]merig00
2007-05-24 01:57 pm UTC (link)
I didn't get anything yet, but one of my friends did:

This service is authorized by LiveJournal, and while we do authenticate you to that service, all data remains stored and served out of our San Francisco data center.

Regards,
LiveJournal Support Team

I'm not sure what exactly was he asking in the request but this has nothing to do with Privacy Policy. I'll be waiting for reply on my request.

P.S. Just updated post with more explanation.

(Reply to this) (Parent)(Thread)

[info]uniquewonders
2007-05-24 03:58 pm UTC (link)
Nice of them to inform us that this site is authorized by LJ.

And now I've just seen a request from a Paid user asking why they see ads on livejournal.ru. Since they're automatically logged in there, they must assume that the same rules apply. *shakes head* What a mess.

(Reply to this) (Parent)(Thread)

[info]merig00
2007-05-24 04:06 pm UTC (link)
heh...yeah i was just about to post about it. Livejournal.ru is SUP's website so one would assume that SUP as representative and basically extention of 6A in cyrillic sector will honor 6A agreement with paid users on advertisement on their LJ-service websites.

BTW. I just checked livejournal.ru and can't find a field where it said that i'm logged in. though i saw it yesterday.

(Reply to this) (Parent)

[info]merig00
2007-05-24 04:09 pm UTC (link)
never mind: the login field is back, probably took it down for maintenance. They also fixed the bug on Kommersant where it didn't allow you to logout from LJ.

(Reply to this) (Parent)

[info]merig00
2007-05-24 05:10 pm UTC (link)
Check UPD3 and UPD4 ;)

(Reply to this) (Parent)(Thread)

[info]uniquewonders
2007-05-24 05:13 pm UTC (link)
UPD4: OMG.

(Reply to this) (Parent)(Thread)

[info]merig00
2007-05-24 05:16 pm UTC (link)
There's something really wrong with 6Apart...

(Reply to this) (Parent)

[info]ex_shattered767
2007-05-24 05:21 am UTC (link)
Heck, I'd open a ticket just to prove it has nothing to do with SUP so that they have to think up a new answer to give me.

(Reply to this) (Parent)(Thread)

[info]merig00
2007-05-24 05:26 am UTC (link)
So do open one! :) The more, the merrier!

(Reply to this) (Parent)(Thread)

[info]ex_shattered767
2007-05-24 05:28 am UTC (link)
I suppose it would be an "official" complaint, proof that it's not SUP-related, because honestly, I can see it getting brushed off as SUP at first.

(Reply to this) (Parent)(Thread)

[info]merig00
2007-05-24 05:34 am UTC (link)
So just do it :) BTW I just sent an email to 6A "manager of customer relations Joel" :) Hopefully he'll respond tomorrow.

(Reply to this) (Parent)(Thread)

[info]ex_shattered767
2007-05-24 05:53 am UTC (link)
Done.

(Reply to this) (Parent)

[info]sqrfruit
2007-05-24 05:03 pm UTC (link)
I did. It was moved to the private catagory "SUP Services" and hasn't been answered yet.

(Reply to this) (Parent)(Thread)

[info]ex_shattered767
2007-05-25 12:03 am UTC (link)
Hahahahahaha!

Mine's been moved too, no response yet.

(Reply to this) (Parent)

[info]merig00
2007-05-24 05:11 am UTC (link)
One of them is mine ;)

I know of at least 2 more that were turned private. I also posted question about this practice contradicting LJ Privacy Policy to Nosik's journal. Now I'm looking for 6A representative email. I think his name was Joel. Maybe you have it? I'd love to hear what 6A has to say about it.

(Reply to this) (Parent)
Official Answer from LJ
[info]sqrfruit
2007-05-29 12:33 am UTC (link)
"LiveJournal whitelists specific partner sites, so that it is not necessary for you to authorize them via OpenID. These sites do not have access to your LiveJournal account, nor do they receive any of your private information. You are simply authenticated as a username. If you do not want to allow OpenID authorization to these sites, you can log out of your LiveJournal account before visiting these sites.

Regards,
LiveJournal Support Team"

A very polite way of saying "tough shit". I'm not happy with this answer, but I doubt any amount of complaining from me is going to change this.

(Reply to this) (Thread)
Re: Official Answer from LJ
[info]ex_shattered767
2007-05-29 05:08 pm UTC (link)
It's a cookie-cutter "tough shit," too - I got the exact same thing.

(Reply to this) (Parent)(Thread)
Re: Official Answer from LJ
[info]sqrfruit
2007-05-29 05:49 pm UTC (link)
And they closed the request on me less than 24 hours after giving me that answer. Also, the request was moved to the "Webmaster" category, which is still private.

I've reopened it, asking for a list of "whitelisted" sites.

(Reply to this) (Parent)(Thread)
Re: Official Answer from LJ
[info]ex_shattered767
2007-05-29 06:01 pm UTC (link)
Generally they're supposed to wait a couple days, at least, before closing a ticket themselves.

Somehow I highly doubt that policy changed after I quit volunteering on the board.

(Reply to this) (Parent)(Thread)
Re: Official Answer from LJ
[info]sqrfruit
2007-05-29 06:07 pm UTC (link)
That was the impression that I had, which is why I was surprised to see the request had been closed when I went to reply to it today.

The way my question is being handled makes me feel like they don't really want to help, they just want everyone asking about it to shut up and go away.

(Reply to this) (Parent)(Thread)
Re: Official Answer from LJ
[info]ex_shattered767
2007-05-29 06:11 pm UTC (link)
"The way my question is being handled makes me feel like they don't really want to help, they just want everyone asking about it to shut up and go away."

They probably do.

(Reply to this) (Parent)
Re: Official Answer from LJ
[info]merig00
2007-05-29 06:49 pm UTC (link)
Heh...the two requests i published in When SUP attacks 2 were closed right after they replied to me. So I had to re-open them. As far as I know requests stay open for a very long time until an admin sits down and goes through all the old requests closing them one by one.

(Reply to this) (Parent)(Thread)
Re: Official Answer from LJ
[info]ex_shattered767
2007-05-30 02:07 am UTC (link)
They closed them right after?! WTF?! Policy was that they only went to close tickets when it was obvious that the user had forgotten to or wasn't going to close it themselves. Within 24 hours ain't the definition of obvious.

I didn't think it was possible for them to give even less of a damn about users. But then again, once upon a time I also thought they wouldn't lie to us.

(Reply to this) (Parent)
Re: Official Answer from LJ
[info]syarzhuk
2007-05-31 03:53 am UTC (link)
I got pretty much the same reply. My answer to that (which I posted in my own support ticket):

It is very easy to link a LiveJournal username to a real person's identity.
The mere fact that someone visited a web page could be and already was used in court.
There might be people who do now wish their identity disclosed to some sites, yet still want to visit those sites.
This especially concerns sites outside United States, as they may be governed by different laws.
The http://www.livejournal.com/openid/options.bml page clearly shows the sites that the LiveJournal user trusts. You are saying that LJ whitelists 'specific partner sites', which would be fine if a) the list of these sites was made public; b) each user had an option to distrust specific sites. Without these two options this becomes a privacy issue.

(Reply to this) (Parent)(Thread)
Re: Official Answer from LJ
[info]merig00
2007-05-31 04:16 am UTC (link)
great idea! I'll drop it into suggestions box:)

(Reply to this) (Parent)

Create an Account
Forgot your login or password?
Login w/ OpenID
English • Español • Deutsch • Русский…