"This card is viewed by other accounts" - an update on the Library Elf and your privacy

Pop Goes the Library's Liz Burns did a useful experiment with Library Elf - it came out as a plus for the Elf in my book.

Liz entered her mother's library card twice - once in her own Elf account (with Mom's permission), and a second time in a new account for her mother.  She saw no warning messages that the library card was being viewed by two accounts when she set it up. 

About a week later she delved back into her mother's account settings. Aha - inside Mom's account settings was an asterisk with a message: "This card is viewed by other accounts."  Further clicking revealed Liz's own email address (Liz was the "other account" viewing Mom's record).

Even if a snoop uses a hotmail address, Mom gets more notification (not a lot, but at least some) than if the snoop looks up Mom's records at the library site directly.

On the other hand, I'm still concerned about the ease with which the Elf lets us look at other folks' library records. Yes, the underlying problem is each library's own weak security (some don't even have PINS).  But as I see it, the Elf shines a floodlight on this weakness, then gathers the records and delivers them to your doorstep.

Ever heard of "practical obscurity"?  That's the old-fashioned privacy we used to enjoy, relying on difficult access to our records. Even our public records like property records, court records were reasonably private, since a snoop would need a lot of motivation and time to gather them by foot from dusty shelves in county offices. Today, of course, snoops get these records with a couple of mouse-clicks (and more with some $).

The Elf blasts through the "practical obscurity" of archaic library web interfaces which bury our records at least somewhat.  The Elf busily gathers our records from hither and yon, aggregates them, and delivers them to anyone who asks. 

All the snoop has to do is set up an initial account (five minutes - fast, easy, free) and enter a skeleton key (see below).  Library borrowing records are then delivered to their laptop or cell phone regularly, presumably til the end of time.  An Elf infomercial could truly say, "set it and forget it."

By "skeleton key", I refer to each library's security system.  The Elf helpfully supplies an easy-to-read chart listing each library, and whether it requires just a card number, or whether a PIN is needed.  If a PIN is used, it tells us if it's the last four digits of someone's phone number, or whether it is user-specified.

The "set it and forget it" is what makes the Elf a cool service -- and I'm still using it.  I don't think it would make a difference to my privacy if I didn't use it. Please correct me if I'm wrong, tech folks - does RSS delivery open more security holes? I don't use the text message option. Anything else to consider?

In fact, now that I've read Liz's report, I think it's in my best privacy interest to use the service. That way I can at least look over my shoulder at my settings occasionally and see if my "card is viewed by another account" ...  something that could happen without my awareness if I didn't have my own account.

I changed my library card's PIN recently, and plan to do so at irregular intervals.  I'm lucky my library lets me do this.

This is a wake-up call for libraries to upgrade the passwording and security of patron databases. Using skeleton keys (library card numbers, weak PINs) is no longer enough, if it ever was. If that's done, then the Elf could be just joy without horror.