Privacy Watch: The Danger of Too Much File Sharing

If you trade rare jazz tracks on a free file-swapping service, you need to worry about more than just the wrath of the recording industry: You could inadvertently end up sharing sensitive information, like passwords or tax returns, with other users.

That's exactly what happened to "Bob" (not his real name), who wrote to privacywatch@pcworld.com to ask about an e-mail message he'd received. Bob uses the BearShare file-sharing tool regularly to trade music and other files online. The message he received told him that "a large number of what appear to be your personal Excel and Word documents are being made available for public consumption."

Bob was stunned by the message and asked me in his letter, "Is it really that easy for someone to access my machine and read all of my files?"

You bet it is, Bob. I contacted the cyber-Samaritan who wrote to Bob, Charles F. Sage, and he confirmed that he'd found a lot more than music when he turned off a BearShare feature that filters out files other than music tracks or video clips. Sage searched BearShare's network for files labeled 'passwords' and found ten spreadsheets full of them. And his search for files called 'tax' yielded six completed TurboTax files.

Here's how you can protect your private information if you use the BearShare, Kazaa, or Morpheus services.

BearShare: By default, the program shares all folders that contain image or music files (with the exception of the Program Files and Windows folders). Click Setup, Folders to bring up the shared folders list, which looks like a Windows Explorer panel. A red check mark in the box to the left of a folder means all of that folder's contents are shared; a box highlighted in a red border means that the folder is not shared in its entirety, but one or more subfolders is. Create a folder that will contain all your shared files, put your music or video there, and share only that folder. Never share your entire hard drive.

Kazaa: Anything you put in C:\Program Files\Kazaa\My Shared Folder is available for other users to download, by default. But you may be sharing other folders as well. To check what you've made accessible, click Tools, Find Media to Share to bring up the File Import tool. Click the Folder List tab to pull up a dialog box that looks almost exactly like BearShare's. Then uncheck the box next to any folder that contains files you want to keep to yourself.

Morpheus: Click the icon that looks like a wrench, directly below the traffic button. In the Properties window that appears, click Share in the left pane to bring up the list of shared directories. The default shared directory is C:\Program Files\StreamCast\Morpheus\My Shared Folder.

One last tip: Many of these types of programs continue running even if you close their main window. To completely disconnect from a file sharing service, make sure that you right-click the application's icon in the system tray and then select Exit.