Blockoo - Does It Really Work?
Intrigued by the recent Blockoo controversy here, here, and here, I decided to find out how Blockoo works.
In the website, Blockoo claims that “You can see who blocked or deleted you. […] you can know for sure using this service.”
What I found was expected: Blockoo CANNOT check who blocked you. At least not in the right-click-on-contact-and-click-block sense. It does check for people who deleted you, to a certain extent.
What it really does is to show you which people doesn’t have you on his/her contact list, whether by ignorance (forgot to add you back) or by choice (deleted you from his/her contact list). Not only this, the person has to be in your contact list in order for them to show up.
To investigate this, I signed up for a new MSN account just for testing (no, I’m not that gullible to give out my real username and password to a third-party). Let’s call this new account Gorilla. My main account is Yahoo.
.
Scenario 1: Gorilla is not blocked in Yahoo’s contact list
I added Gorilla in Yahoo’s contact list, and vice versa. Of course, they both show up as online in both contact lists.
Then I checked the Gorilla account at Blockoo. Not surprisingly, it says noone has blocked Gorilla.
.
Scenario 2: Gorilla is blocked in Yahoo’s contact list
Then I blocked Gorilla in my Yahoo contact list. As you can see, Yahoo looks offline in the Gorilla contact list (it shows as Mobile as I activated MSN Mobile for that account).
Upon checking the Gorilla account at Blockoo, surprise, surprise… it says noone has blocked me! Congratulations! Yeah right…
.
Scenario 3: Gorilla is not blocked, but deleted in Yahoo’s contact list
I continued by unblocking Gorilla, and then deleting Gorilla from my Yahoo contact list. Now Yahoo looks online in the Gorilla contact list. If I were Gorilla, I’d know for sure that Yahoo doesn’t block me.
Guess what Blockoo said? Yahoo has blocked or deleted the Gorilla account! This is the only occasion where the result is somewhat accurate (it does say blocked or deleted). Ignore the error message, some voodoo is going on at their server.
.
Scenario 4: Gorilla is deleted in Yahoo’s contact list, and vice versa
I then deleted Yahoo from the Gorilla contact list. So right now Gorilla doesn’t have Yahoo, and vice versa.
Blockoo decided that noone has blocked or deleted Gorilla again! Yay!
.
So as you see, Blockoo does not do exactly as what it claimed. It does check for people who have deleted you from their contact list, but that’s about it.
Moreover, Blockoo’s reputation is further tarnished due to the following points:
- Password is sent to a third-party site
- Password is not encrypted before sending (the new Blockoo site uses SSL, but to get there you need to click on the FAQ, and then click on a link which is not translated to English yet)
- Blockoo will spam the person’s contacts by default, where most people will be caught unaware
- It will sign in on your account automatically (however, this is necessary to check the contact list. More on this on the next post)
- Hidden adult-site ad that looks like a Windows Live Messenger alert (refer to the post on benetleong.com for a screenshot)
So do consider these things before you decide whether you want to use Blockoo.
As a side note, the whole controversy actually prompted me to find out more about the MSN protocol. By understanding the protocol, it’s easy to see how Blockoo actually works and where the pitfalls come in. I’ll write more on this in the next post.
June 22nd, 2007 at 3:00 am
I don’t know for other people, but my precious 7 year Hotmail account is too precious to lose, and not forgetting my lovely gibberish passwords. I would never risk the status of my account for the sake of curiosity.
June 22nd, 2007 at 7:50 am
Agree with you on this.
Person A must have Person B on the list. Person B must have deleted Person A.
Only in such a situation will Blockoo report a positive
June 23rd, 2007 at 1:19 am
voxy: Yes indeed, that’s a good practise to protect your security. I always stop short of giving up my password to other sites. Who knows what they could do to your password?
Mark: Yep. I’ll be doing a complete analysis on Blockoo in my next post, including how it might have worked. Stay tuned.
(Sometimes I do wish I could spend my time on something more useful than this, but heh, I could learn quite a lot on the MSN protocol from this project.)
June 26th, 2007 at 2:04 am
[…] couple of days ago, I wrote about Blockoo, discussing whether it actually […]
December 27th, 2007 at 7:12 pm
[…] service using my test MSN account two days ago. It’s the same account I used to test Blockoo a while ago. The test account has my main MSN account in the contact […]
January 11th, 2008 at 4:13 am
I’ve just read this… maybe I’m to late to comment hehe.
You are forgetting one big clue point.
The only way to see if a person is really blocking you, is by checking his online status. In other words, blockoo or any similar site will get your list, guess who deleted you (by using the standard MSN protocols), but then, it will check one by one the online status of every person who appears offline in your list.
Such applications can be found here: (status checkers)
http://www.blockstatus.com/msn/stchecker
http://www.msngeeks.com/index.php?page=blockchecker
So.. in essence, you could check who blocked you by hand.
Just grab your offline contacts, check their status, and if they appear as being online and you still see them as being offline, BINGO, then you’ve spotted someone who has blocked you.
Of course, this will only works if the contact your are checking doesn’t have his privacy options enabled… and I now can see why this test didnt worked for you… you probably had that privacy option checked.
(the one from this picture: http://farm2.static.flickr.com/1401/622951009_1e6e6f8686.jpg - only ppl in my list can view my online status).
That will also explain the reason why it works for some people and not for others.
Again, I do not know the actual system of this website but I’m making my own conclusions on how this work… since the voodoo stuff as you said is behind the scenes.
Bye,