In reply to: "Open Source Client and money theft" in linden aswers

As said the client isnt considered as a "trusted element" of the SL architecture, the only person you will be able to rob is yourself, unless you manage to grab someone's login/password you won't have the required rights to manipulate any other user's balance.

of course if the user don't bother to protect himself with a strong password (alpha numeric + symbols non dictionary related passwords, 5 to 10 digits)
he just deserve to get his account hacked (kinda), don't complain about security if you do not follow the most basic security rules yourself.

Hijacking of account occur by getting the login/password of your account and if you have a proper password, the only way to get it is either by brute force (wich is i am sure detected automatically on LL's side). Or by the user sharing his PW, (which is a TOS breach leading to the account termination anyway).

Also if the user isn't completely stupid he won't use a non official client, unless the sourcecode is provided.

I would think that the biggest safe guard the LL has is that they will still be releasing the client. If you want to use an untrusted client built by someone you don't know, then that is a risk you will have to take. LL is still going to be releasing a official client for everyone to use.

Well I think someone might make their ill intended client download look "legit" as if it`s from LL.

Kind of like how people do to get a paypal/ebay password..

I think you should be pretty safe if you get your download from http://secondlife.com/community/downloads.php .

Someone could produce a malicious client -- and make it look "legit" -- even without access to the SL source code. There are a number professional reverse-engineering tools used by both the good guys and the bad guys to simplify exactly this type of work.

If anything, open-sourcing SL has raised the community's awareness of such a possibility. Had anyone released a malicious client a month ago, he/she would have had an easy time distributing it since no one would question it at all.

The same argument could be made against any kind of software, open-sourced or not. What's stopping anyone from distributing a trojan-horsed IE7 client? Or a Firefox2 one? A web browser which steals your passwords & credit card information as you type them in would be quite the lucrative exploit.

-peekay

How about http://secondlife.com/community/downloads.php?

Just a friendly reminder to examine your download urls very carefully.

Always take a peek at the status-bar.... and it will show. Never trust a link given by a "stranger".

Concerning all kind of trojans specially for Second Life spread through IE/Firefox/whatever. I don't see that happen. The target is too small. Mostly trojans and alike are used to turn desktops/networks into zombies (for spreading spam).

Phising is another matter, but most phising by mail is with a bit logic thinking to trace (a serious company will never ask for your password... never trusts links in e-mails... and so on and so on.... and for these things you don't have to be a computer expert... I ain't) and many phising-sites are recorded.

Maybe it is best to rely when possible on Second Life itself when it offers you a new version to download.

And yes, I listen and ask question when people talk about this subject. It is easy to learn these basics.
The person who maintains my two computers always explains what she does and even more important, why she does it. And she gives background information. This all in a way I can understand it. Guess I am lucky to have her for this job (and she is happy because I help her with her taxes )

Morwen.

An IE or Firefox trojan obviously wouldn't just affect SL. It could record any credit card information you send to, say, Amazon.com or BestBuy.com (in addition to secondlife.com), and send it to third-parties. Nothing "small" about such exploit.

Yet we haven't seen widespread fake-Firefox clients despite of its open-source nature.

-peekay

It will be just as possible for someone to write a malicious SL client as it is for someone to write a malicious contract. Once the client is written, the trick is to get somebody else to download it and run it; culturally, we're pretty good at not signing contracts without reading the fine print, and culturally we're adding a reluctance to open attachments, download software from questionable sites, etc.

IOW, I'm making an analogy between open-source clients and legal documents. Anybody can write one to do anything they want; but they can't as easily get what they want if we don't let ourselves be duped.