Created
March 8, 2011 04:48
-
-
Save mala/859854 to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
>> | |
Hi, | |
We apologize, but the only way we will be able to verify ownership of this account is if you reply to this email with an attached color image of your government-issued photo identification confirming your full name and date of birth. Rest assured that we will permanently delete your ID from our servers once we have used it to verify the authenticity of your account. | |
Please note that we will not be able to process your request unless you send in proper identification. We apologize for any inconvenience this may cause. | |
Thanks, | |
<< | |
私は日本で働いているプログラマで、UI設計やセキュリティリサーチなどを行っています。 | |
私のアカウント停止に関する問題ですが、お前じゃ話にならないからセキュリティ担当者と話を変わってくれないか。 | |
「ご安心ください」だと?だいたいメールで送れと言っている時点で戯言だ。 | |
Ma Laというのは私が実生活で使っている名前ですが、あなた達はどうやらlegal nameを求めているようだ。 | |
ユーザーオペレーションチームの「誰か」が私の存在を検証するために、私の政府発行の写真付き身分証明書を送ることには抵抗がない。 | |
しかしFacebookにlegal nameで登録しろ、というのであれば、それを確実に非表示にするためのプライバシー設定が必要です。 | |
私はFacebookのサイト設計上の欠陥を把握しています。 | |
Facebookにlegal nameを登録するということは、Facebookにログインしたまま悪意のあるサイトを訪問した際に、誰かにlegal nameを把握されうるということだ。 | |
私はそれを許容することができない。ひょっとするとあなた達はそれを「仕様だ」と言うかもしれない、しかし私は「欠陥」か「脆弱性」と表現するだろう。 | |
私は脆弱性の詳細を把握していて、プライバシーに関する不適切なデフォルト設定や、セキュリティに配慮されていない設計を理由に、あなた方のサイトを信用していない。 | |
だから安心出来るまで「政府発行の写真付き身分証明書に記載されている名前」でFacebookに登録することを望まない。 | |
Facebook内のルールは、あなた方のポリシーの問題でしょう。 | |
しかしあなた方は、Facebook外のサイトでも常に「政府発行の写真付き身分証明書に記載されている名前」を使い、 | |
それが不用意にサイト運営者に把握されても問題がないと考えていますか? | |
添付ファイルがないと見てくれないかもしれないから写真を添付する。もちろん政府発行のものではない。 | |
繰り返しますが、あなたが判断せず、セキュリティ担当者に転送してください。 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
こんな感じかな。
Dear Sir,
I'm a programmer working on UI design and security in Japan.
Before talking about the account deletion,
I would like you to pass me on to someone from the security team
because this is a serious security problem and
I don't think you understand the seriousness of the problem.
I have found a vulnerability of the site design on Facebook.
This is not a bluff or FUD. I am ready to show you a proof-of-concept video.
The name "Ma La" is a "real name" that I use in real life. But you seem to want my "legal name".
I don't hesitate to send my legal name and my government-issued photo ID for my existence proof to someone in user operation team.
(Facebook is not a government so I think you should not require a government-issued ID, but accept a credit card.)
However, I don't want to use my legal name on Facebook because of the said problem.
If I register my legal name to Facebook, it means that any malicious site that exploits the vulnerability
can know my legal name just by me visiting their site.
Since I can't accept that, I want you to create privacy settings to hide my legal name.
You may insist "it is spec", but I consider it as "bug" or "vulnerability".
I've grasped the details of the vulnerability and have not trusted your site
because the default settings about privacy is not appropriate, and because of the design that is not considered for security.
Therefore, I don't want to register to Facebook with my legal name on government-issued photo ID until I can feel secure.
I'm not only talking about Facebook's policy.
What do you think about security, privacy and vulnerability?
Malicious site can get your legal name by Facebook's vulnerability, there is no matter?
Would you consider that it is not a problem that any site can get your legal name by abusing Facebook's vulnerability?
Even if you delete my personal ID from your server, sending it by email itself is insecure.
SMTP is Simple Mail Transfer Protocol, not Secure Mail Transfer Protocol.
Please stop saying "It's secure", "It's safety", "Please trust me", "You can control your privacy everything always", etc.
I'm attaching a photograph because you may not see this without an attachment.
Of course, it is not certified by government.
Again, please DO NOT judge it by yourself.
Please forward this mail to the security team.
thanks.