Privacy and MSN Messenger

Privacy conscious Atomicans should be wary of using Microsoft’s MSN Messenger – Windows Messenger in XP – Instant Messaging client. According to this Bugtraq post, a 'feature'

Privacy conscious Atomicans should be wary of using Microsoft's MSN Messenger – Windows Messenger in XP – Instant Messaging client. According to this Bugtraq post, a 'feature' in MSN Messenger gives any website the capability of viewing your Messenger screen name, as well as the list of your MSN Messenger contacts. If you have yet to set a screen name, your email address is displayed in its place.

Microsoft sites such as Hotmail.com and Microsoft.com already have access to this information, as their domains are hard-coded into the Messenger client. Aside from providing added functionality to these websites, access to this information allows Microsoft to easily track its formerly anonymous visitors. More serious however, is the potential for any website to gain access to your MSN Messenger name, email address and contact list via registry manipulation.

Many popular Peer-to-Peer file sharing applications already come bundled with spyware or adware that tracks users online habits. It would be trivial for one of these spyware vendors (such as VX2) to update their programs in order to install the necessary registry keys for Messenger access.

By inserting new registry entries into the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft
\MessengerService\Policies\Suffixes", in the form of 'Suffix1 = "hackme.com”', new domains are given access to the information provided by this MSN Messenger 'feature'.

Currently, the only fix for this problem is to regularly check the above registry key for new entries, and to log out of Windows Messenger/MSN Messenger before visiting Microsoft owned websites.