Second Life grid protocol leaks avatar locations?
According to Dusan Writer, the Instant Messaging portion of the Second Life grid network protocols contains location information about every avatar who sends an IM to you. It's been known for some time that the fields designed to encapsulate that information were present (though only the estate information was available to the recipient via the Second Life viewer) but it has not been clear that the information about the location of the sender was actually filled in.
Apparently, it is -- and it isn't really that hard to get at, for anyone who can implement the protocol, use an existing library or modify and rebuild the viewer source code. This might be considered something of a faux pas, as a similar information leak a couple of years ago required considerable retooling of protocols to avoid anyone who wanted to know your business from ... well, knowing your business.
The earlier leak of location data was a little easier to exploit, however. In this case, at least, someone has to actually send you an IM (or a busy response) for the information to become available. Nevertheless, we're interested to see just how long this privacy flaw takes to fix -- the previous one was a known issue for quite some months before it was finally corrected.
Certainly last time, the privacy flaw was exploited quite maliciously over a long period. Is this an issue that you find to be of some significant concern? Or is it something you feel you can just walk off?
 | Are you a part of the most widely-known collaborative virtual environment or keeping a close eye on it? Massively's Second Life coverage keeps you in the loop. |
