Potential RL-identity exploit with Avatars United

For those of you using their RL-email for their SL-avatar, using the default settings of Avatars United might pose a risk of unintentional exposing the address!

Snickers Snook posted an insightful article about "Spam via Avatars United", where she explained that since joining AU she receives significantly more spam on her supposedly undisclosed email address. She dug a bit into the settings and found that the default is that even non-installed AU-widgets can access certain data and send emails.

While Snickers primarily saw the spam problem, my friend Zonja Capalini pointed out that while being spammed is a nuisance, the bigger threat lies in the unsolicited disclosure of a potential RL email address and thus disclosure of the RL identity.

So if this concerns you, do two things:

1. Read Snickers article and adjust your Avatars United settings
2. Go and finally get a GMail/Yahoo/Hotmail/whatever address for your avatar

Potential Privacy issue with XStreet SL dropboxes

... and for that matter with any other dropboxes, be it Hippo, Apez, Deliverator, Subscribe-o-Matic, DSN or similar dropboxes. Whenever an object sends inventory to an avatar who is offline, the system sends a message along those lines:

The object 'Xstreet SL Magic Box v3.0.10' in Second Life has offered you inventory.
Log in to accept or decline this inventory.
= Xstreet SL Magic Box v3.0.10 is owned by Xxxxx Yyyyyy
= http://slurl.com/secondlife/MyFancySim/129/70/2004

As you can see, the location of the dropbox itself gets shown in that message. In this (faked) example the dropbox is on the sim "MyFancySim" at the coordinates 129,70,2004. A dropbox in an altitude of 2004 meters will most likely be on a skyplatform used as personal home or workshop. I know some (designer) friends carefully guard the locations of their homes and workshops in the sky, mostly because of the wish for privacy, but also as security measure against prying eyes regarding the things they work on. As normal as it may seem to place your dropboxes at your personal place, as much devastating is it for your privacy.

If you turn this around, there is a good argument to be made to place your dropbox(es) into your shop. With the same information someone could find out about your personal skyplatform, they can also find out about the location of your shop. Also most dropboxes give out a weblink when touched by someone else than the owner.

Finally, it should be noted that some dropboxes can be placed multiple times. You can take a full Xstreet dropbox to inventory and place a second copy on a different sim. That way, one acts as backup for the other, and deliveries can still be made when one box should be inaccessible.