GENEALOGY-DNA-L Archives

Archiver > GENEALOGY-DNA > 2007-01 > 1168383861


From: Asparagirl <>
Subject: [DNA] FTDNA - web security holes
Date: Tue, 9 Jan 2007 15:04:21 -0800


I hate to throw gasoline on the fire, but FTDNA has long had much
bigger security holes in its web applications than just accidentally
revealing project participants' last names (rather than their
most-distant ancestor).

Take, for example, certain "super-hidden" surname and/or geographic
projects, who do not share their data publically on their FTDNA
project websites. On many of them, non-participants browsing around
can't see their data datables, nor see their Google Maps, because the
little grey tabs for those items have been disabled by the project
administrator(s).

I won't go into details except with Bennett (if he wants them --
Bennett is copied on this e-mail), but suffice it to say that if you
have a decent knowledge of javascript, you can damn well figure out
the kit numbers of every person in those projects, and often their
most-distant ancestors, even if the information is supposedly hidden.
No "assistance" from Jason's code or any other outside program is
required.

Fun facts gleaned from this exercise: did you know that one of the
most prominent family names in Ashkenazic Judaism, and Levites to
boot, seem to be consistently R1b1? (Oops.) I'll leave out the name,
since it was found in one of the supposedly-hidden projects.


- Brooke Schreier Ganz
Los Angeles, California

This thread: