Shoutbox

Microsoft censoring MSN Messenger conversations

quote:

---

According to communications director of MSN Sweden, Jessica Börjel, this is being done to protect users against exploits and worms spreading through the MSN Messenger service.

Among the things Microsoft appears to want to block are URLs and file name references. And this is where the trouble starts:

    * You cannot use the string download.php anywhere in a message, not even when it’s not part of a URL.
    * The link filter does not take canonical URLs into account: http://evil.example.com/download.php and http://evil.example.com/down%6Coad.php is the same URL, expressed in two different ways. The first one is blocked, while the second one is not.
    * Even if Microsoft fixed the canonization issue, and were able to block both, there are a loads and loads of redirector services, like as TinyURL that can be used to mask known bad URLs

And, for the truly paranoid: Since Microsoft are automatically monitoring your conversations, and block certain messages — what prevents them from eavesdropping on your messages, and sending any “suspicious” content off to third parties, such as governments and their agencies?

( Thanks to Jakob for the tip )

Update: After this story got dugg, one question that has been cropping up, both on digg and in other forums is this: Is this filtering of messages taking place in the client or on the server? It is taking place on the server. This means that all clients, such as GAIM, Adium, Trillian and others are affected.

BTW, Diggers, I’ve written something about the Digg effect if you want numbers.

---

Try it, it actually works lol. Done tested it.

old. it also blocks gallery.php, .exe, .script, etc.

It blocks the URL of Pim's Messenger Plus! personality picture page, among other things.

Solution:  http://www.secway.fr/us/products/

quote:

---

Originally posted by dreaded
Since Microsoft are automatically monitoring your conversations, and block certain messages — what prevents them from eavesdropping on your messages, and sending any “suspicious” content off to third parties, such as governments and their agencies?

---

I don't see the link between blocking those URLs and sending info to governments. Even if they wouldn't block any URLs or messages, what stops them from doing it anyway. When they are required by law to send governments logfiles Microsoft will comply. The problem won't be Microsoft, it will be your government.

Wouldn't that be simply a violation of privacy? And they say...'We respect your privacy'

well the European Government wants to make it legal... and they probably will... so I think about encoding all my messages...

This "censoring" is done clientside, right? Microsoft's servers don't actually check the message, I would think.

So apparently it's server side. Still though, it's ridiculous to compare this kind of user protection to logging messages and sending them to governments. It kinda reminds me of people getting all upset over content-based gmail ads.

quote:

---

Originally posted by Rodney
This "censoring" is done clientside, right? Microsoft's servers don't actually check the message, I would think.

---

I believe it is done server side. If you send the "illegal" text the server closes your connection the the switch board.  I believe this started with MSNP13.