pseudomonas (![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png)
pseudomonas) wrote2010-07-15 10:26 am
pseudomonas) wrote2010-07-15 10:26 am
Entry tags:
PSA: LJ, purged accounts, and OpenID
Livejournal announces that they're going to have a round of purging and reselling account names of people who've deleted their journals, suspended journals, and "inactive" journals*.
ETA: I misread that - they're currently purging deleted accounts as before, what's new is that they'll also be purging suspended and "inactive" ones, and purging the deleted ones only 30 days after deletion, not 60.
As I understand it, if you have an LJ and have one of these accounts as your friend, you do not need to do anything, they will automatically be removed from your friendslist.
But on other sites, like, for instance, Dreamwidth, if you have granted access via OpenID to an account whose name is then resold, whoever buys it will gain access to your locked posts.
If you don't want that to happen, the only way to prevent it (short of the ideal of getting people not to delete their accounts even if they stop using them) is to remove access from the OpenIDs of such journals. Note that if you used the Dreamwidth importer, you might have granted OpenID access to a large number of people - you can manage the details here.
Please feel free to copy/link this around the place.
Note also if you buy an account name and the previous owner has gone round getting the OpenID of the account banned in lots of places, you're stuck with that too
*An inactive LJ journal is apparently one with only one post that's not been logged into for 24 months. If you have any placeholder accounts on LJ, you may want to check that this does not apply to them.
ETA: LJ is taking steps to disable OpenID on resold names as an interim solution (thanksandrewducker). This is a big improvement (unless you've bought one of these names, in which case it's a PITA), but I'll be interested to see how they deal with this long-term.
ETA: I misread that - they're currently purging deleted accounts as before, what's new is that they'll also be purging suspended and "inactive" ones, and purging the deleted ones only 30 days after deletion, not 60.
As I understand it, if you have an LJ and have one of these accounts as your friend, you do not need to do anything, they will automatically be removed from your friendslist.
But on other sites, like, for instance, Dreamwidth, if you have granted access via OpenID to an account whose name is then resold, whoever buys it will gain access to your locked posts.
If you don't want that to happen, the only way to prevent it (short of the ideal of getting people not to delete their accounts even if they stop using them) is to remove access from the OpenIDs of such journals. Note that if you used the Dreamwidth importer, you might have granted OpenID access to a large number of people - you can manage the details here.
Please feel free to copy/link this around the place.
Note also if you buy an account name and the previous owner has gone round getting the OpenID of the account banned in lots of places, you're stuck with that too
*An inactive LJ journal is apparently one with only one post that's not been logged into for 24 months. If you have any placeholder accounts on LJ, you may want to check that this does not apply to them.
ETA: LJ is taking steps to disable OpenID on resold names as an interim solution (thanks
andrewducker). This is a big improvement (unless you've bought one of these names, in which case it's a PITA), but I'll be interested to see how they deal with this long-term.
no subject
Also, I don't think there's any record kept on Livejournal accounts of what it would have access to. The person buying the account would need to know whose journals it would have access to in order to log into them. It's hard to see how that could be predicted.
no subject
no subject
The person buying the account will, the first time they log in to DW with OpenID, find out what they have access to, and it'd be surprising if they didn't have a poke around for the sake of curiosity.
I'm not saying this is likely to be used by attackers, but if I wanted to attack an account, it'd be pretty easy to go through their access list (if public) and find out which usernames to buy. As an example, if I deleted my LJ and you bought it, this is what you'd get access to.