Heads-up Grouply users: CHECK YOUR FRIENDS LIST.

After joining Grouply, I discovered that I had "friends"
(total strangers to me) on my Friends list that I did not
invite to be on my Friends list, and who had not asked me to
be their friends.

After some dialog with Grouply Support, it was discovered
that they got there through a bug involved with clicking on
the link in a group invite I had sent. It also works
the other way: if you click on the join Grouply link in an
invitation message, you automatically got added to the
Friends list of the person who sent the invitation, and they
to yours.

Here's how it worked until it was fixed a couple days ago:

When you use the group invite routine, the default message
created for you by Grouply says, "You can use this link to
sign up: http://www.grouply..com/register.php?r=nnnnn,"
where "nnnnn" is a number referencing your Grouply
account. If some stranger in the group joined Grouply
by clicking on that link in the invitation message you
posted to the group, they got automatically added to your
Friends list (and you to theirs). Conversely, if you
joined Grouply using such a link in an invitation, the
sender of the link became your Friend and you theirs.

Grouply "Friends" can have special access to personal,
private information in your profile, depending on your
privacy settings. This opened the door to undesirable
and unauthorized access to private, confidential information
by surprise "friends." Depending on your privacy
settings and what information you entered in your profile,
this can include access to your name, email address, postal
address, phone numbers, group memberships, etc.

It has been fixed so that now when you use one of those
invite links, you show up as a Friend *Request* in the
privacy settings page of the person who sent out the link,
and vice-versa: if someone clicks on that link in an invite
you sent out, they then show up as a Friend *Request* in
your privacy settings page. In the list of Friend
Requests, you can click Ignore to deny their joining your
Friends list and gaining friends-only access to confidential
information in your profile.

This problem was fixed a couple days ago, but people who
either joined Grouply via an invitation or sent invitations
out to their groups prior to a couple days ago should check
their profile pages to see if they have unwanted Friends
there who came on board prior to the fix. This can be
especially important if they kept the default privacy
settings upon joining Grouply, and/or if they put any
personal information in their profile, or did not turn off
access to things like their email address, postal address,
phone numbers, etc.

Deleting a Friend also has some troubles.

When I discovered my unwanted friends, I found there was no
facility for deleting them. While viewing the Friends
list on my profile page, there was no button or link for
"delete friend." After reporting this to Grouply
Support, they added it, but not on the Friends list.
To delete a Friend, you have to click into their profile
from your Friends list, where you will find a button to
remove them from your Friends list (and, reportedly,
simultaneously remove yourself from their Friends list).

I have two problems with this:

1) If a Friend has a closed profile (privacy setting
at "only me" visibility), you can't get to that Remove
Friend button in their profile page. You're stuck with
them. When you click on the link to a Friend in your
Friends list, and that person's profile is closed ("only me"
visibility in their privacy settings), you get only their
search listing, not their profile, and no Remove Friend
button. Grouply Support said that they will work on
making a Remove Friend button available there in the search
listing for those people who have closed profiles.

2) When you visit the profile of another Grouply user
(if they have not closed it with the "only me" privacy
setting), your visit is recorded and reported to them in the
"Recent Visitors" box at the lower left corner of their
profile display ... and thus reported to anyone else who
visits their profile page. Deleting a friend who
showed up accidentally or by a bug (or even if you just
changed your mind about the friendship) should not require
you to report to them and to others that you visited their
profile. Grouply Support has not addressed this
concern in my dialog with them about the various Friends
List issues.

I do not understand why one's own Friends list in their own
profile display cannot or should not have a button for
deleting friends right there instead of having to go to
their profile to do it. So far I have not received a
satisfactory answer to this from Grouply Support.

All else aside, my main reason for raising this issue here
is to alert Grouply users that they should check their
Friends list (in the My Profile tab) to see if any
unexpected friends showed up, because Friends have special
access to confidential data depending on what privacy
settings you used, and the default set of privacy settings
does grant them that access.

I felt that Grouply should have reported this potentially
serious confidential data access control problem and its
fix, so that people who joined prior to its fix could be
alerted to check their Friends list if they had not visited
their Profile page since having sent out invitations, or if
they joined from the link in an invitation. I
suggested it to Grouply Support, but they did not respond to
the suggestion. I find that unfortunate. Users
should be notified of an important issue like this.


TAGS: friends,grouply support,security,confidential,access,control,delete friend




________________________________________
Posted through Grouply, the better way to access your Yahoo Groups like this
one. Check out Grouply at: http://www.grouply.com/?code=post

[Non-text portions of this message have been removed]