This just crossed my desk : a web site trashing their reputation one address book at a time. In essence, it raises the issue of when someone grants you permission to their data what will you do with it. If you are going to email everyone - it had better be pretty clear you will be doing that (both from your Privacy statement and in clear UX) - the line gets blurry on what is clear enough or what isn't clear enough, and this is a case where a company has now tainted their reputation.
From: <redacted>
Sent: Sunday, May 11, 2008 7:46 AM
To: <redacted>
Subject: PLEASE DO NOT RESPOND TO AN EMAIL ASKING YOU TO JOIN <redacted>
I apologize if you received an email asking you to join <redacted>.com recently. I did not send it.
The way it works is 'you think' another friend has sent you an invite to connect with him/her via <redacted>.com and when you go to their website and join - that's when it happens. Unbeknownst to me, the site automatically (without my permission) went out to my address book and grabbed ALL my addresses. It then sent the following message out:
Hi,
I looked for you on <redacted>.com, but you weren't there. I use <redacted>.com to search for lost friends and contacts, and to stay connected with people I know, so please connect with me.
and they sign your name.
If you joined, please let your address book individuals know of this spam scam. Again, I am so sorry that you received this type of email - Please report it as spam and delete.
So I reached out to them, wondering how long until I get a response:
From: Angus Logan
Sent: Monday, May 12, 2008 10:35 AM
To: support@redacted.com
Subject: Engineering or Product Management contact re. Invites
Importance: High
Hi,
I’m Angus Logan, the Senior Technical Product Manager from the Windows Live Platform team. I’d love to have a quick chat with an engineering or product management contact regarding the invite friend functionality on your web site.
You may not be aware that in March we announced the Windows Live Contact API is now in Beta and you can use it commercially under these terms. The Contact API is the preferred way to access a person’s address book as it provides a richer set of information such as preferred email address, and the user never shares their credentials with your web site (currently you are collecting these credentials over HTTP so anyone could sniff them).
Can you please drop me a line on my cell +1 425 753 7987 or email back so we could discuss the use of this API.
