Opt-in Accelerator Warning – Security Risk – Read This First!

Hey Andy… while I respect your views on these tell a friend scripts I personally think viral inviter rocks…

In the past week I have been using it i saw a crazy jump in traffic so that’s good for me… But yeah the risks are certainly there – more so on the users side than the person running the script

All the best
J

Thanks for the heads-up.

I don’t think it is a matter of trust. If people enter their information, that means they trust my site enough to let me handle the work, perhaps there should be a privacy policy.

I may trust Facebook or MySpace, but what if the recipients don’t? Isn’t it the same problem with Optin Accelerator on my site?

Facebook has permission but not your site, that’s the difference.

It is more a problem of terms of service too. If the mail account providers disallow it, and also Aweber, then I want to stay on the safe side.

This is interesting. I’d never considered the security issues involved with TAF technology.

I’ve always used Viral Friend Generator. Perhaps you can review that one in the future if you touch on this subject again.

Thanks for an interesting post.

I think it’s another phising form, that using opt-in program :)

Great timing for me. I had bookmarked the page from an email two days ago. The email was from a very well known marketer and he tossed in an endorsement from an even bigger-named marketer. This shouldn’t matter but I guess those of us that know nothing about programing tend to trust certain recommendations without a little research. I don’t hold the marketers at fault, I’m sure they were unaware of the potential risk. Another reminder that we shouldn’t just blindly trust a product based solely on the reputations of those that promote it. Nice post, I appreciate the way it was explained so that anyone can understand.

There is no call for that level of programming laziness. All this is doing is putting users in danger. Just one Cross Site Scripting Attack or an SQL injection attack would potentially unlock the entire database and even if it does not it could:

(a) Phish the email owner to a “new site”
(b) Capture new sign-ups and steal passwords
(c) Spam the snot out of all the jucy addresses inside

It is on point C that these sites become a spammers wet dream. As such it’s not the script kiddies you will need to look out for but the profesional guys. The same guys that only need the hashed version of the password (if they store it) and some time alone with a pass word cracker – rainbow tables make the job of years into the work of seconds.

I get freaked out about people wanting my twitter login data.

Now what happens if the domain expires and some evil person takes it over?

OUCH!

Those API are there for our protection.

This script is a child’s toy (as evidenced by the lazy way it was coded). You want to make a site with a REAL address importer script like Myspace, Facebook, Tagged, Multiply, Mahalo etc. are using? Call your VC firm (the ones who funded companies major social networking companies) and be prepared to open your wallet.

I think it’s insane to give away your email password to some third party. Even if someone knows nothing about programming, they should understand that the password provides complete control over their email account.

I think this approach of wondering if you can “trust” a particular person/site is also flawed. One should worry about the webmaster’s tech-savvy first. For example, I might completely trust my hypothetical grandma who’s running a knitting tips website, but I sure wouldn’t want to let her maintain a database of credit card data.

Hey Andy, I never looked at it that way. It seems these types of scripts are a hot topic and everyone either has one or is working on one.

I don’t have one, I can’t say I never thought about it in passing, but having read your post, I will need to start paying more attention to the scripts and softwares being offered.

Thanks for writing about this. I always wondered about the security aspects these ‘inviter’ scripts.

Andrew

Far out. Andy, it seems to me that every time the less computer literate population gets a little closer to trusting the Internet (with the appropriate degree of discrimination against scams and spam, of course), someone has to go and do something stupid and it leads to yet another big moral panic and suddenly nobody wants to buy stuff of eBay. Don’t know how that works, but I do blame these fellas ;)

Ya know Ive seen these before on other sites when I was signing up for something and it always made me curious about the safety issues. I mean even if the site says its secure how do you really know for sure. Your giving them YOUR password! I dont trust stuff like this so I usually just “skip” it.

Another thing Ive always worried about was those automatic scanners. Im sure everyone has run into one at one point or another. Your on a webpage minding your own business and a second later a popup says its scanning your computer. And it really is because I can see MY files being scanned by each name. How do people get away with this crap?!?

Wow. You’d think people would choose a little more carefully before releasing something.

How damaging is this to their reputation? Hope they made enough to pay for lawyers.

Thanks for the heads up!

This is truly a disturbing post.

However, I remain grateful that I took the time to read and become informed.

This information is very practical and good to know. Thanks for providing the information.

The thing that I am worried about is that they may be violating certain Terms of Service contracts. Most email providers forbid members to share their login information with any third party entity, and the so-called “Opt In Accelerator scam” does just that. Fortunately, very few email providers actually enforce their TOS to that point, in fact, have you seen Multiply or Facebook get into trouble with a major email service provider?

Dear,
U remember the issue with gmail archiver? it also had similar issues lik opt-in accelerator! I think people are there still using gmail archiver! (pss… i got that free with a computr magazine)

The best way to keep your paypal safe is use a separate email just for paypal and nothing else.

Also sorts all those spam mails about paypal problems too.

The other problem with these invite scripts is that people (like me) see them as spam. OK they have my mates name on them but they’re nothing less than a spammy sell sell sell message and make me disinclined to join a site that sends them.

Are there any offers of this kind that are well protected?

If they are secure, are they a good value?

This is a great post. Personally I do not optin any place if I think the information I receive is really required. With all the hackers and programs in cyberspace, everyone should be very careful before giving out any personal information that opens door for disaster.

That’s a very exhaustive and informative review of optins. I think people should think twice before giving away some information. This can be a spam bait for some!

I have a good read, thanks for the information and insights you have so provided here. I will certainly bookmark your blog for future reads. Thanks!

Thanks for the heads up Andy.
Lord Matt – that’s the first thing I thought of as a security concern “SQL Injection Attacks”. Once someone has grabbed that huge database who knows what will happen next. In our virtual office and serviced offices we’re very conscience of security with clients personal information, it’s about time others follow suit.

Hi Andy,

Thanks for the post! I had no idea that entering your password into a form like this could make it possible for someone to unlock everything from your Gmail account to all you domain names.

It sounds like we should all be using security certificates on all our membership sites.

All the best!

Ouch! Luckily I came across this as we were just discussing adding this to our website.

Not any more! Thanks!!!

Dr Andrew

Andy, when do you get back from your sabbatical?

Shoot i wish i would have found this out yesterday.

I just used this script or a similar one.
BUT i changed my gmail password before and right after.
But the script was flawed and didn’t show me all my 2000+ address, to uncheck the ones i didn’t want to send to, so i ended up spamming a TON of people.
And got 700 bounce backs or Mail delivery failed, as the address books a bit outdated, my gmail address was blocked & the server was blacklisted…

boy what a mess.
I am so glad i didn’t use my domain to send emails from, that could have been a disaster.

This is really risky, I would not want such sensitive data in a poorly made application.

It’s incredible how easy people give away this infromation not thinking at all. I have a secondary mail adress that i use on all unsafe sites.

Thanks for the great post!