Since there's still a few of you over on LJ who have no ties to volunteering/working for LJ
Support (former or current) and who may not have heard about this yet: there appear to be ongoing problems since the latest release with people finding themselves appearing to be logged in as other users, with the attendant ability to see [and possibly act on? this part is still unclear] data meant for that user, not themselves.
Long story short: regular LJ users *not* on your LJ friendslist may have been able to read your locked entries or access [though probably not modify] your other nonpublic LJ data at some point in the past few days, and this problem may still be going on.LJ says:
"while updating the configuration of our internal caching system, Varnish, for a few minutes the system began to issue cached pages from the users who most recently visited the same page, as the system considered this the most relevant source of data. Thus, for 3 minutes, some users may have seen pages which appeared as though they were logged in as another random account, but it was actually just a snapshot of the page of the last visitor. It had no effect on security, as it was not possible to perform any actions on behalf of this other account. When attempting to load another page during these few minutes, another cached page was served in most cases."
Some users beg to differ, and report in comments to the
lj_maintenance post and to the latest
news post that they are still having this issue 72 hours later - still being able to see entries they have no business seeing; still being redirected to editing other users' profiles, comments, entries, settings.
The truth is probably somewhere in between, but it seems that for some people who'd still been hanging on, how this issue has been handled (piled upon how various past issues have been handled) is what completely broke their trust in LJ management. Given that LJ refers to this security issue as a "service issue" in the News post, and says that "it had no effect on security" in the lj_maintenance post when
clearly, it did - I would not call being able to see data I have no business seeing "no effect on security," and on any other website, I would've expected a site-wide email explanation and apology to go out within hours, not days - I'm concerned enough that I'm thinking about no longer crossposting my entries from Dreamwidth to LJ.
So you're probably thinking,
\what can I do to protect myself? Given that this is a caching problem, the most effective answer seems to be:
1. Go
manually expire all of your LiveJournal login sessions. On that page, click on the X button next to each login session listed under "Currently Logged In Sessions." This will log you out from all login occurrences except the one you're using to do the expirations, and apparently will get the pages you've looked at during those login sessions out of the cache? (Which is the private data being exposed. Any friend-locked entry you've looked at while this has been going on is, by my understanding, at risk, which is why as soon as I'm done typing this entry, I'm going to go expire my sessions myself.)
2. Log out of LJ, and
stay logged out until this issue is completely resolved. I'm not sure how to verify when this is the case if you don't trust what LJ's been saying in official communities, though. I guess ask other trusted security-minded and privacy-minded friends who still use LJ, through non-LJ channels?
*
Given that this is sending people who hadn't already fled LJ fleeing for the hills:
Here's where I am on a semi-regular basis:
-
Dreamwidth for, these days, primarily travelogue and the occasional non-public entry.
-
Flickr for photos
-
Twitter for marginalia
-
Pinboard for social bookmarking (after AVOS destroyed Delicious, they've been the best option: most functional, least interested in censoring your bookmarks (ohai DIIGO), most interested in listening to their users and potential users and balancing everyone's needs.
-
Pinterest for the pretty (I know, it's confusing to have both Pinboard and Pinterest, but I've been finding it really useful for "bookmarking" more visual things that I want to see in a sort of collage form. I've primarily been using it to try to figure out what the heck my "style" is, but it's making me think about how I currently keep track of recipes I'd like to try, especially recipes that come with food-pornesque-pictures ...)
- My Flickr (and soon my Pinboard) crosspost to my
Tumblr, but I haven't been particularly good about paying attention over there lately; it's just so chaotic to me.
I also do the Facebook and G+ things, though on a somewhat superficial and fragmented level. Given both Google and Facebook's
own issues, privacy-related and otherwise, my presence there is on the infrequent and vaguely performative side. If you're interested in friending me there, let me know.