If you’ve tried to add new contacts on Facebook, Flickr or LinkedIn, you’ve likely been prompted to provide your Gmail/Hotmail/AOL email credentials. Using these credentials, these sites will cross-check your contact lists with known users on their site, in an attempt to hook you up with people you already know.

While the notion of sharing your authentication credentials with a third-party sort of blows my mind (too many years as an Admin, I suppose), as 80% of us use the same password across all sites (I just made up the 80%), it probably wouldn’t be too hard for Mr. Twitter to guess your Hotmail password if he really wanted to.

No, actually what interests me is how one could use this information leak to out fakesters. The approach is pretty simple – add a couple hundred email addresses to your contact networks in Gmail/Ymail/Hmail etc, upload to a site, and see just who pretends to be who.

This raises a question: Just when did it become fair play to share my email address? When I created a Twitter account, I provided my email for verification – but I didn’t assume that a third-party would be able to correlate my email to my Twitter identity simply by uploading an address book. What’s the big deal, you say? Let’s take the case of Fake Steve Jobs. What if Fake Steve were to create a Twitter or Facebook profile and use his “real” email address for account verification – his gig would have been up a long time ago.
Why does this matter? If you’re going to be a fakester, use Mailinator, right? Valid point, there will always been advanced technical countermeasures. What troubles me is how we trade the functionality of this handy “feature” for a reduction in privacy – and I’ve yet to see anyone really question it. If I provide a service with my email address, it has generally been my right to control who sees or does not see that email address. With these new “contact” functions, I lose control. My identity information is in the public, ready for anyone with an address book to discover.
So what if you are a fakester on Twitter or any of the other sites that employ these address book searches? Unless you’ve bulletproofed your identity by using a completely throw-away email address that you’ve never used anywhere else, it’s likely your identity could be compromised.
As Web 2 is ego-centric, anonymity/pseudonymity in consistently painted in a negative light. By embracing – and not questioning – these information leakages, we’re reinforcing this mode while perpetuating the fallacy that “there’s nothng to hide if we’re not doing anything wrong.” This is an erosion a privacy, and a new form of surveillance.