Loading ...
Sorry, an error occurred while loading the content.
 

Friends List Issues

Expand Messages
  • Ben D
    Heads-up Grouply users: CHECK YOUR FRIENDS LIST. After joining Grouply, I discovered that I had friends (total strangers to me) on my Friends list that I
    Message 1 of 3 , Feb 25, 2008
      Heads-up Grouply users: CHECK YOUR FRIENDS LIST.

      After joining Grouply, I discovered that I had "friends"
      (total strangers to me) on my Friends list that I did not
      invite to be on my Friends list, and who had not asked me to
      be their friends.

      After some dialog with Grouply Support, it was discovered
      that they got there through a bug involved with clicking on
      the link in a group invite I had sent. It also works
      the other way: if you click on the join Grouply link in an
      invitation message, you automatically got added to the
      Friends list of the person who sent the invitation, and they
      to yours.

      Here's how it worked until it was fixed a couple days ago:

      When you use the group invite routine, the default message
      created for you by Grouply says, "You can use this link to
      sign up: http://www.grouply..com/register.php?r=nnnnn,"
      where "nnnnn" is a number referencing your Grouply
      account. If some stranger in the group joined Grouply
      by clicking on that link in the invitation message you
      posted to the group, they got automatically added to your
      Friends list (and you to theirs). Conversely, if you
      joined Grouply using such a link in an invitation, the
      sender of the link became your Friend and you theirs.

      Grouply "Friends" can have special access to personal,
      private information in your profile, depending on your
      privacy settings. This opened the door to undesirable
      and unauthorized access to private, confidential information
      by surprise "friends." Depending on your privacy
      settings and what information you entered in your profile,
      this can include access to your name, email address, postal
      address, phone numbers, group memberships, etc.

      It has been fixed so that now when you use one of those
      invite links, you show up as a Friend *Request* in the
      privacy settings page of the person who sent out the link,
      and vice-versa: if someone clicks on that link in an invite
      you sent out, they then show up as a Friend *Request* in
      your privacy settings page. In the list of Friend
      Requests, you can click Ignore to deny their joining your
      Friends list and gaining friends-only access to confidential
      information in your profile.

      This problem was fixed a couple days ago, but people who
      either joined Grouply via an invitation or sent invitations
      out to their groups prior to a couple days ago should check
      their profile pages to see if they have unwanted Friends
      there who came on board prior to the fix. This can be
      especially important if they kept the default privacy
      settings upon joining Grouply, and/or if they put any
      personal information in their profile, or did not turn off
      access to things like their email address, postal address,
      phone numbers, etc.

      Deleting a Friend also has some troubles.

      When I discovered my unwanted friends, I found there was no
      facility for deleting them. While viewing the Friends
      list on my profile page, there was no button or link for
      "delete friend." After reporting this to Grouply
      Support, they added it, but not on the Friends list.
      To delete a Friend, you have to click into their profile
      from your Friends list, where you will find a button to
      remove them from your Friends list (and, reportedly,
      simultaneously remove yourself from their Friends list).

      I have two problems with this:

      1) If a Friend has a closed profile (privacy setting
      at "only me" visibility), you can't get to that Remove
      Friend button in their profile page. You're stuck with
      them. When you click on the link to a Friend in your
      Friends list, and that person's profile is closed ("only me"
      visibility in their privacy settings), you get only their
      search listing, not their profile, and no Remove Friend
      button. Grouply Support said that they will work on
      making a Remove Friend button available there in the search
      listing for those people who have closed profiles.

      2) When you visit the profile of another Grouply user
      (if they have not closed it with the "only me" privacy
      setting), your visit is recorded and reported to them in the
      "Recent Visitors" box at the lower left corner of their
      profile display ... and thus reported to anyone else who
      visits their profile page. Deleting a friend who
      showed up accidentally or by a bug (or even if you just
      changed your mind about the friendship) should not require
      you to report to them and to others that you visited their
      profile. Grouply Support has not addressed this
      concern in my dialog with them about the various Friends
      List issues.

      I do not understand why one's own Friends list in their own
      profile display cannot or should not have a button for
      deleting friends right there instead of having to go to
      their profile to do it. So far I have not received a
      satisfactory answer to this from Grouply Support.

      All else aside, my main reason for raising this issue here
      is to alert Grouply users that they should check their
      Friends list (in the My Profile tab) to see if any
      unexpected friends showed up, because Friends have special
      access to confidential data depending on what privacy
      settings you used, and the default set of privacy settings
      does grant them that access.

      I felt that Grouply should have reported this potentially
      serious confidential data access control problem and its
      fix, so that people who joined prior to its fix could be
      alerted to check their Friends list if they had not visited
      their Profile page since having sent out invitations, or if
      they joined from the link in an invitation. I
      suggested it to Grouply Support, but they did not respond to
      the suggestion. I find that unfortunate. Users
      should be notified of an important issue like this.


      TAGS: friends,grouply support,security,confidential,access,control,delete friend




      ________________________________________
      Posted through Grouply, the better way to access your Yahoo Groups like this one. Check out Grouply at: http://www.grouply.com/?code=post

      [Non-text portions of this message have been removed]
    • netbud
      ... Since I posted this prior message, Grouply Support said that they would change the Friends list functioning so that when you click on a Friend they will be
      Message 2 of 3 , Feb 25, 2008
        --- In GrouplyImprovements@yahoogroups.com, Ben D <netbud@...> wrote:
        > 2) When you visit the profile of another Grouply user
        > (if they have not closed it with the "only me" privacy
        > setting), your visit is recorded and reported to them in the
        > "Recent Visitors" box at the lower left corner of their
        > profile display ... and thus reported to anyone else who
        > visits their profile page. Deleting a friend who
        > showed up accidentally or by a bug (or even if you just
        > changed your mind about the friendship) should not require
        > you to report to them and to others that you visited their
        > profile. Grouply Support has not addressed this
        > concern in my dialog with them about the various Friends
        > List issues.

        Since I posted this prior message, Grouply Support said that they would
        change the Friends list functioning so that when you click on a Friend
        they will be displayed as a search listing instead of opening their
        profile page. As I understand what Grouply Support told me, on the
        search listing page there will be a Remove Friend button or link. When
        this is accomplished, it should resolve the problem of being unable to
        delete a Friend whose profile is closed ("only me" visibility), and
        enable you to delete a Friend without visiting their profile page and
        having that visit recorded and displayed to all others who visit that
        person's profile.
      • Rich Reimer
        Ben, I would have posted this, but we were going back and forth on changes (which we have made very quickly) so I did not want to confuse people. Per my email
        Message 3 of 3 , Feb 27, 2008
          Ben,

          I would have posted this, but we were going back and forth
          on changes (which we have made very quickly) so I did not
          want to confuse people.

          Per my email to you, we have fixed it yesterday so you can
          delete a friend by going only to the search listing
          page. Please try it out.

          Rich





          ________________________________________
          Posted through Grouply, the better way to access your Yahoo Groups like this one. Check out Grouply at: http://www.grouply.com/?code=post

          [Non-text portions of this message have been removed]
        Your message has been successfully submitted and would be delivered to recipients shortly.