Saturday, April 3, 2010

Appalacian Identity Management at Myspace

What do you think about when you hear the word Appalachia? Beautiful mountains and trails? Poor, inbred communities? Its all there. And weirdly, it all relates to this blog entry. Sort of.

This post is actually about poor (shall we say, inbred?) identity management on But it starts on the Appalachian trail.

My cousin's son Mason is taking the summer off to hike the Appalachian trail. As I write, he and his friend "Swamp Yankee" are somewhere in Tennessee. They are posting accounts of their travels whenever they reach a suitably high peak or civilized valley boasting cell phone signal. The trail is beautiful, but what they find most interesting about the hike is the community of people out there. (Isn't it great how everything always comes back to people, to identity?)

Mason's posts are on - another strange community. To send Mason a message, my wife (Ginny) had to join myspace too. But when she typed in her email address, myspace said somebody already had it! Her proprietary instincts aroused, Ginny clicked on "forgot password" and sure enough myspace sent the password. Ginny used it to login and found she had become "Amanda" - a Pennsylvania girl with a lot of rapper talk in her profile.

Amanda's gone now. Ginny took control of the account keyed on her email address. Fortunately, the account had hardly been used and there was only one friend named "Tom" (who seems to be everyone's friend.) Most likely Amanda forgot her password and could never get it back because she had (accidentally?) misappropriated Ginny's email address and could not successfully invoke "forgot password." But it could have been much worse. There could have been a lot of information there, and ethical vagueness about who owns the account and what should happen to it.

The real fault lies with Myspace's inbred identity management, and this could have turned out worse. Myspace has failed to fully protect the identity and privacy of their customers.
I know because I also created an account with Myspace. While I did get email from myspace, they do not verify that had access to the email address I claimed.

Myspace has already been ravaged by the Samy worm, and judging by the quality of its identity management, there are more problems ahead before that community gets out of the woods.