Privacy FAIL: The New Ning

The vast majority of the individuals who sign up to our sites are new sign-ups with no prior experience of Ning, who have no idea that they are joining the Ning network.

About a week ago Ning launched the "new Ning". Before, my members were mine. Now, all of a sudden, they all have a public page on ning.com, displaying their photograph, a public feed of all their activity across all networks, a list of all of their friends (including those they have friended on private networks), and all of the networks they belong to.

I couldn't believe this when I first found out, so I did a little testing.

It's true. You can find people really easily. All you need is their uniqueidentifier. That's the little code you see when you hover over a link to a member's profile. The link looks something like this:

http://mynetwork.ning.com/xn/detail/u_uniqueidentifier

All you need to do if you want to spy on someone on Ning, is type this:

http://www.ning.com/u/uniqueidentifier

It took me about 30 seconds to figure this out.

I have already used the "new Ning" to spy on troublemakers, parasitical NCs who spam our site, my own moderators, individuals we have banned, real life frenemies, you name it! All you need is that uniqueidentifier and you're away! It's GREAT!!!111!!!1 (note: this is called sarcasm).

I have already found out a couple of people's real identities because when they first signed up to Ning, they used their real names. Was this Ning's intention? Or an oversight? At least facebook only shows people's profiles to people they are friends with! There is a reason for that!

I nearly came a cropper from this myself. I was registered under my real name on one of my networks. My real name was my default name in my Ning profile until I realised towards the end of last year that I simply couldn't trust Ning to keep my personal data safe and private.

I would hate for my network users to discover my real name, or even discover that network! Being an admin is a difficult job, and involves banning people and making enemies. I don't want my real name plastered all over the internet by someone with an axe to grind! I don't want people to follow me to other networks where they can cause trouble for me. I imagine there are other admins in the same situation, who aren't as internet-savvy as I am.

Many of my members are very protective of their true identities. They would be horrified if they discovered their many different network accounts had been linked together on a public page, sometimes with their real names visible.

A number of my members have been banned because they are young teenaged girls whose parents did not know they were using the internet to set up web pages about themselves, and their parents have asked me to ban them to remove their pages from my site. These individuals have also had public pages set up in their name on the new Ning.

I have already had a member leave ALL NING this week because someone has found her from another network and is, I quote, "attacking" her on all of her sites.

This is a stalker's paradise.

How Ning can help:

Set everyone's profiles to private or to be viewable by friends only by default, as they are on facebook. It's not rocket science!