May 30, 2009

Potential Privacy issue with XStreet SL dropboxes

... and for that matter with any other dropboxes, be it Hippo, Apez, Deliverator, Subscribe-o-Matic, DSN or similar dropboxes. Whenever an object sends inventory to an avatar who is offline, the system sends a message along those lines:
The object 'Xstreet SL Magic Box v3.0.10' in Second Life has offered you inventory.
Log in to accept or decline this inventory.
= Xstreet SL Magic Box v3.0.10 is owned by Xxxxx Yyyyyy
= http://slurl.com/secondlife/MyFancySim/129/70/2004
As you can see, the location of the dropbox itself gets shown in that message. In this (faked) example the dropbox is on the sim "MyFancySim" at the coordinates 129,70,2004. A dropbox in an altitude of 2004 meters will most likely be on a skyplatform used as personal home or workshop. I know some (designer) friends carefully guard the locations of their homes and workshops in the sky, mostly because of the wish for privacy, but also as security measure against prying eyes regarding the things they work on. As normal as it may seem to place your dropboxes at your personal place, as much devastating is it for your privacy.

If you turn this around, there is a good argument to be made to place your dropbox(es) into your shop. With the same information someone could find out about your personal skyplatform, they can also find out about the location of your shop. Also most dropboxes give out a weblink when touched by someone else than the owner.

Finally, it should be noted that some dropboxes can be placed multiple times. You can take a full Xstreet dropbox to inventory and place a second copy on a different sim. That way, one acts as backup for the other, and deliveries can still be made when one box should be inaccessible.
Post a Comment