LJ stalkeriffic security things they maybe should change

[substitute]

Poking around my account while logged out, I notice:

1. You can always see when someone has updated via the "mode=full" version of the LJ profile, whether you're entitled to see the entry or not.

2. In the archive/calendar view you can see how many entries were made per day whether you have to access to the entries or not. If you click the number of entries for a day on which no posts are accessible to you, you'll get an error that says there aren't any posts that day, but you already know that's not true.

and that's enough stalking myself, i'll go blind etc.

Comments

[kiteflier98.livejournal.com]

Yeah, I noticed that about my account when I was hoping that someone would lose interest in me by not including them in as many filters. Instead I just started posting to a different journal.

[hydrozoa.livejournal.com]

yeah, i learned that from spying on lovecrafty. if he and i happen to have a real-life encounter and he conspiciously doesn't post about it, i check the archive/calendar view, and voilà. there's a post that doesn't exist when i click on it. nine times out of ten.

[sachmet.livejournal.com]

#2 has always been true. I've had to use that fact before.

And another thing...

[sachmet.livejournal.com]

And even if #2 wasn't true, every HTML page has a post number (this one, for example, is 1499836). That post number is generated by taking the actual post number (this is apparently the 5,858th time you've posted in your journal, whether you've kept it or not), multiplying by 256, and adding a random number between 0 and 255.

It'd be easy to do some math to figure out if there's "missing" posts.

Now, I notice, your User Info page says you've made 5,802 posts. So you've deleted 56 posts outright over the years. That's the sort of thing you can figure out if you know how the system works.

[nikolasco.livejournal.com]

These are pretty classic. There's also the good ol' previous and next buttons always working. I vageuly recall come discussions about this sort of thing (exposing the existence of information) and the devs being at best uncaring about fixing it. Sadly I can't recall what it was about, exactly, much less cite a thread.

[mendel.livejournal.com]

It's not so much "uncaring about fixing it" as "declaring it working as designed". Having posted has never been secret, only the contents of posts.

[substitute.livejournal.com]

Yeah, I guess I was just declaring it to be bad design that needed revision.

[frobisher.livejournal.com]

It just so happens that People With Clue are working at 6A nowadays. Something might actually get done about this stuff. Now, if only I could figure out where the hell they're hiding bug reporting...

[annie-r.livejournal.com]

i actually like having those features. since i haven't made a public entry in years, it lets people know that i'm still actively updating, and i've used it to check up on others. i haven't wanted to disappear yet (i'd probably make a separate journal if i wanted to be that hidden.)

[gordonzola.livejournal.com]

I got schooled on LJ by people much younger than me so I knew about #2 since I joined. Not that I really care. My favorite thing I was taught (by someone just out of high school) was that to fuck with someone you can make a filter with just them in it and then pretend you are posting to a large group and talking about them (or even pretend like you think you have filtered them out). I HAVE NEVER DONE THIS. but my appreciation for the sneakiness of high school kids remains quite large.

[trinnit.livejournal.com]

An aside

On AOL you at least used to be able to see if people were online or not with Member Directory Searches. Despite wether they've blocked you.

[catamorphism.livejournal.com]

Yeah, I noticed that years ago. I've always meant to write some sort of little script that exploits #2 to show you all the dates when someone made posts not visible to you.

[substitute.livejournal.com]

I like your criminal brain.