Security

Contributor: Fred Petrenko Fred Petrenko
Hello, everyone!

I would like to address the recent security incident, and also raise a few more general
questions with regards to community development and outreach.

First and foremost, I want to assure each and every one of you that ABSOLUTELY NO FINANCIAL INFORMATION HAS BEEN EXPOSED. We have been and continue to be 100% compliant with the most stringent PCI Data Security Standard regulations, and none of this information has ever been compromised. All of our EdenFantasys databases are scanned regularly by a third party company to ensure their security and are certified breach-proof.

The file in question

The Google spreadsheet contained the real names, physical addresses and emails of power bloggers who do off-site reviews. There was no affiliate or contributor's information in this file.

Those who haven't received emails from EdenFantasys regarding this matter were NOT listed on the spreadsheet.

We do not, nor have we ever, used a Google doc or a spreadsheet to store ANY information. The spreadsheet was created by an ex-employee, and is not how we normally conduct our business. Once we were alerted to the incident, the file was deleted. Furthermore, we are not storing any more information have in Google docs.

How it happened

One of the EdenFantasys staffers inadvertently changed the status of the document to public. This means that the password wasn't required to view it. Nevertheless, in order to see the contents of this file, the general public would have needed to know the web address of the document or be given a link to it. This wasn't possible because there were no published links anywhere.

The same day one of the bloggers from this file was scanning their site's logs and found the record of the EdenFantasys employee's visit from the open file. The blogger opened the link and was able to view the contents of the file. Instead of informing us, this blogger, aiming to protect herself and her fellow bloggers, started disseminating this address between friends. As soon as we found out what had happened, the file was taken down and deleted, so no one could access it.

Again, the document remained unseen by the general public as the link was never published. A handful of people who saw the contents of the document were bloggers from within their own circle.

What's going on now

There is no access to this document. It has been deleted from Google docs.

Another of the measures I am introducing is the mandatory signing of a confidentiality agreement for all employees of EdenFantasys involved in marketing or outreach positions.

I am also working with our developers to fully automate the power blogger/off-site review program. So all continuing work on off-site reviews will be stored in the secured EF Database behind firewalls.

I can tell you with absolute surety that we are taking all necessary measures to be much more careful with the sensitive data of our bloggers who do off-site reviews; however, with the nature of the internet being what it is, anyone who accessed the data could have saved it, and thus would still possess it. After that, it is up to the person what he/she decides to do with the data, regardless of whether they were listed in the document or not.

We have done our very best to be transparent about this matter. It is very difficult to personally answer every accusation or openly hostile forum post when we are working with all our resources to resolve the problems that caused it. I find it personally disappointing that some people, both in the forums and in the blogging community, seemed to take this situation as an opportunity to go into business for themselves, so to speak. If this situation hadn't been so exploited by certain people, we could have allocated more of our resources to resolving the matter in a timelier manner.

The sex blog community

As a business and as members of the greater community, we strive to be ethical and honest in all our dealings. However, this also makes us vulnerable at times. We care deeply about rights of everyone to express themselves.

My choice of working with community is not the matter of simple business. I can tell you that there are far more efficient ways to spend an advertising budget than via community support. You might be surprised by how insignificant the business generated by affiliate deals with sex blogs actually is. But that's exactly the point - it's not just about the business. Look at Adam & Eve, for instance - they don't have any presence in the sex blogs, yet they are far larger than some of the e-tailers heavily promoted in the blogosphere. However, I chose the community route because I genuinely believe that not everything is measured by dollar amounts.

I have recently read many angry, invective-filled posts on these very forums from people who despise EdenFantasys in general and me personally. And yet many of these people do not know me; all they know are things they have heard or read from other sources. Everyone is in constant communication with everyone else, yet the only communication with me I ever see consists of people demonizing me on the site of my own business. I do not see how this is community-building in action, unless the belief is that a community is only built by its own infighting and self-destruction.

Do some of you honestly believe that I am out to cause harm to you? Forget for a moment how absurd and paranoiac that sounds. Regardless of what some of you may think of me, I am a businessman. It is my policy not only as a businessman but as an ethical person to always try to do the right thing - not only for the sake of my business, but also for those associated with me both professionally and personally.

Furthermore, if I was as bad as some of you say, do you honestly think I'd let you debase me on my own site? I could easily delete any and all unfavorable posts, yet they all remain intact and fully public. So please, if it is a despot you are searching for, you will have to look elsewhere. He is not here.

EdenFantasys has seen turnover recently in some of its key positions. This has made for a somewhat tumultuous period of adjustment. However, I can tell you, I feel extremely confident that we now have a staff of creative, honest people who will do their very best to build upon the community goals of EdenFantasys.

We are all offering our cooperation and support to every facet of the sex community, from bloggers and affiliates, to writers and reviewers, to customers, to forum-posters and lurkers.

If you choose to work with us – if you choose to stay with us, then we would be honored to continue our relationship with you. If you choose otherwise, we will also respect that choice, even if we respectfully disagree with it.

Please understand this. EdenFantasys is not your enemy.
I am not your enemy.

My hand is extended in friendship and acceptance. Whether you choose to accept is up to you.

Sincerely yours,

Fred Petrenko
Owner and President, EdenFantasys

Afterword:

From this date forward, I will be making a weekly post to the forums, under the heading Letters from the Owner. I will use these posts to talk about issues within the community, as well as anything else that is on my mind. I am optimistic that these posts will give community members a better glimpse of who I am, what I represent, and what I hope to achieve – not as a businessman, but as a member of this community which I cherish a great deal.
11/24/2008
  • Save Extra 50% On Sexobot Attachment
  • Upgrade Your Hands-Free Play!
  • Complete strap-on set for extra 15% off
  • Save 50% On Shower Nozzle With Enema Set
  • Enjoy 50% Off Selected Items
  • 1
  • 2
  • 3
  • 4
  • 5
All promotions
Contributor: Champagne and Benzedrine (Roland Hulme) Champagne and Benzedrine (Roland Hulme)
Quote:
Originally posted by Fred Petrenko
Hello, everyone!

I would like to address the recent security incident, and also raise a few more general
questions with regards to community development and outreach.

First and foremost, I want to assure each and every one of you ... more
Thank you for this post, Fred! We look forward to hearing more from you on a weekly basis (and hopefully on more cheery topics.)

I'm sure I'm not alone in saying that the community you support through Eden Fantasys, while perhaps not a marketing coup in terms of dollar value for your business, has generated an awful lot of loyalty towards your company, events like this notwithstanding.

Even now, I, for one, wouldn't think of ordering sex toys from anywhere else - because I know this company, you guys have entrusted me with free products to review and therefore, I get a really good vibe that the 'trust' goes both ways.

Unlike other members of this forum, I've never considered anybody to have made light of the security breach (In the Pink and Drew have been troopers throughout) and I've seen other companies make similar or worse screw ups and brush them under the carpet instead of being upfront and honest about it like you guys have been (as far as we know.)

Remember, whenever you do anything online, you're passing your personal details, even your credit card numbers, to faceless strangers. My mother in law had her identity stolen by a bank clerk at her own branch, for God's sake. You can understand why she won't order anything online!

Trust is a two way street and I was disappointed to read this: "The blogger opened the link and was able to view the contents of the file. Instead of informing us, this blogger, aiming to protect herself and her fellow bloggers, started disseminating this address between friends."

From the comments section of a couple of bloggers, I'd gotten the vibe that this is what happened after the breach was discovered, but we had one blogger actually come onto the forum and tell us that she didn't do exactly that.

I can give her the benefit of the doubt or take what she wrote with a pinch of salt. Either way, I hope we can all take the opportunity to accept that a blogger passing around other people's personal information is JUST as bad IF NOT WORSE than a company accidently making personal information public. At least Eden Fantasies doesn't have a smug mask of wounded self-rightousness to hide behind.

But as far as I'm concerned, the matter's closed. Given the amount of flak we've all given you recently, I feel confident we're not going to run into a situation like this again any time soon (so please don't prove me wrong.)

So here's to seeing the Eden Fantasies community grow, flourish and blossom for a long time to come. There are always bumps in the road, but this is still the Sex-Store I trust.
11/24/2008
Contributor: Victoria Victoria
Quote:
Originally posted by Champagne and Benzedrine (Roland Hulme)
Thank you for this post, Fred! We look forward to hearing more from you on a weekly basis (and hopefully on more cheery topics.)

I'm sure I'm not alone in saying that the community you support through Eden Fantasys, while perhaps not a ... more
What a wonderful and encouraging response! So well-put and rational. I really needed that. RR, you have been a continual voice of reason on the forums and I appreciate it SO much. Thank you!!!
11/24/2008
Contributor: Fun Lover Fun Lover
Thank You Fred for your post I feel it was important to hear your side of the story so we can sort out what went on. It shows me that you have an interest in your company and your customers. It is easy to jump on the band wagon but now that we have both sides of the story we can make an informed decision moving forward on where we want to be with EF. As you have said some may choose to leave some may choose to stay. You weekly posts are a great idea so that your customers can get to know you and your business better and make informed decisions about where they choose to do their business. Thank You for the honesty and concern as we are all worried about our credit information and our personal information being exposed. Hopefully we can put this behind us now and move forward.
11/25/2008
Contributor: Airlia Airlia
Finally. Fred thank you for posting, I still obviously am smarting from the whole incident especially since my information was on the spreadsheet and I was only informed on the 21st at 2202. You're all human, I still maintain that you have one of the easiest best sites to navigate and have enjoyed the interaction here. I am not paranoid that EF or the employees are out to get me, but like other bloggers am worried at what the general public can and will do in panic -as was clearly evident in this case.

I look forward to the weekly postings and the answers to all my questions.
11/25/2008
Contributor: Snappy Snappy
I'd like to point out that I was locked out of my Eden Fantasys account with no prior explanation. I sent an email to Eden Fantasys but received no reply. The three remaining reviews were slightly reworded and presented as the reviews of "Veronica". Now I find that I can access my account but all of my reviews are currently posted. Once again I am asking Eden Fantasys to take down the reviews of products that I paid for and generously posted. Thank you.
11/25/2008
Contributor: Neuron Geek Neuron Geek
Quote:
Originally posted by Snappy
I'd like to point out that I was locked out of my Eden Fantasys account with no prior explanation. I sent an email to Eden Fantasys but received no reply. The three remaining reviews were slightly reworded and presented as the reviews of ... more
Your account was blocked because of the vandalism. The review system doesn't have functionality for taking down already published reviews. You however found the shortcut and substituted the original content with some meaningless text. Your actions caused significant problem in other parts of the site as it is complex and heavily interlinked system.

Soon after your actions, our technical department was alerted with spike of error messages from all over the website. When programmers realized what caused this flood of errors your account was blocked immediately.

Significant labor went into retrieving the original content from the database and installing in this account. Because the retrieval operation was performed unplanned and the re- installment of the reviews could've caused significant damage to the whole system, the account was reinstalled for the testing purposes under the fake name Veronica.

After successful tests at about 11.00 am Tuesday morning the account was turned over to you under your regular name Snappy.

At this moment the review system doesn't have proper functionality of removing already published reviews. We will consider implementing this feature. However no guarantees can be made at this moment that this is altogether possible task. Any actions similar to what you did will be considered the act of vandalism and the account of the reviewer will be blocked.
11/25/2008
Contributor: Adriana Ravenlust Adriana Ravenlust
Thank you Fred for responding. I am especially happy to read this:
I am also working with our developers to fully automate the power blogger/off-site review program. So all continuing work on off-site reviews will be stored in the secured EF Database behind firewalls.

However, I would like to point out that financial data is not the only data about which people were worried. Real names can do just as much damage, especially with such a sensitive topic. I would still like EF to recognize that.
11/26/2008
Contributor: Dame Demi Dame Demi
Thank you for your post, and it's wonderful to hear from you 'in person.' What happened was terrible, no question. But your company has always been exceptionally good to me
11/26/2008
Contributor: Liz2 Liz2
Thanks Fred for the clarification, it now makes sense to me. My identity has been compromised in the past, by a major university yet, so understandably I get anxious.
Anyway communication is key......avoids an incident from spinning out of control.
Appears that a solid team is in place so let's move on!!
11/26/2008
Contributor: Champagne and Benzedrine (Roland Hulme) Champagne and Benzedrine (Roland Hulme)
Quote:
Originally posted by Snappy
I'd like to point out that I was locked out of my Eden Fantasys account with no prior explanation. I sent an email to Eden Fantasys but received no reply. The three remaining reviews were slightly reworded and presented as the reviews of ... more
Hi Snappy,

As a freelance writer, published both on the web and in print, I am sympathetic to you wanting to have your reviews taken down from Eden Fantasies. Just some thoughts on the legal aspects, though. I'm not a lawyer, but I've written a lot, so I think I've got a good grasp of things:

Legally, if somebody wrote reviews in exchange for free products, the copy they have written is property of Eden Fantasies - at least that's legally implied, if not explicitly stated in a contract.

As for reviews of products they've bought themselves - if they've 'bought them out' at a discount, there's similar 'consideration' (an exchange) which implies that the reviews are the property of Eden Fantasies, if there's not explicit reference to that legally somewhere.

If there's no consideration - as in no discounts, goods, services or money has changed hands - the copy of the review might be considered property of the reviewer. However, I've written enough freebies to know that appearing on a website or in print is often considered consideration in and of itself, so most articles I've written no longer belong to me, but at least I get to see them in print with my name attached. I've surrendered copyright to them.

Bloggers and Eden Fantasies haven't really played hard with the rules here - I've seen many bloggers print their same reviews on their blogs as well as Eden Fantasies. That's probably of benefit to EF (generating traffic) but from a legal point of view, if that had been an article you'd written for a magazine or newspaper, you'd be 'stealing' their property by printing an article you'd written yourself elsewhere - even on your own blog.

The article has an intrinsic value by making people have to go to that website/buy that magazine to read it. If they can read the same content for free online elsewhere, why would they invest time or money to see it at the (paying) site?




It's easy for bloggers and reviewers to think "I wrote it, it's mine" but actually the issue is a LOT more complex than that - hence why the TV and movie writers went on strike earlier this year, for example.
11/26/2008
Contributor: Snappy Snappy
I noticed that Eden Fantasys demonstrated that they have the ability to take down published reviews. They were taken down shortly after I posted my request. Why can't they be taken down now? I suspect that you're being less than honest with us about that.
11/26/2008
Contributor: ~Storm ~Storm
Quote:
Originally posted by Champagne and Benzedrine (Roland Hulme)
Hi Snappy,

As a freelance writer, published both on the web and in print, I am sympathetic to you wanting to have your reviews taken down from Eden Fantasies. Just some thoughts on the legal aspects, though. I'm not a lawyer, but I've ... more
Yup, I agree with Red Roulette (and I am a writer by trade also). If you got toys or goods of any kind in consideration for your review, you were paid, and it's really not right to ask Eden to take them down. I mean, are you going to give them compensation for the merchandise?

As for the review belonging to EF or the author, it's really both. Ownership always belongs to the author, but that doesn't mean the author can rescind it. It was written in good faith and that agreement was met.

I am one of the 60, and I just can't freak out about this. Yes, I wish it hadn't happened and it makes me wonder about other security issues, and I will think about whether I want to continue with them, but I will not ask them to take down my reviews. Nor will I make any rash decisions.
11/26/2008
Contributor: Adriana Ravenlust Adriana Ravenlust
Quote:
Originally posted by Champagne and Benzedrine (Roland Hulme)
Hi Snappy,

As a freelance writer, published both on the web and in print, I am sympathetic to you wanting to have your reviews taken down from Eden Fantasies. Just some thoughts on the legal aspects, though. I'm not a lawyer, but I've ... more
I'd like to mention that it is against EF's terms of service to post a review elsewhere. I remember looking specifically for that information when I signed up.
11/28/2008
Contributor: Beautiful Dreamer Beautiful Dreamer
Quote:
Originally posted by Adriana Ravenlust
I'd like to mention that it is against EF's terms of service to post a review elsewhere. I remember looking specifically for that information when I signed up.
I remember reading that as well. I thought it said you could put a very tiny amount up linking it to Edens, but the complete review could not be posted.
11/28/2008
Contributor: Airlia Airlia
Oh interesting... totally forgot about that.
11/28/2008
Contributor: Nashville Nashville
Quote:
Originally posted by Beautiful Dreamer
I remember reading that as well. I thought it said you could put a very tiny amount up linking it to Edens, but the complete review could not be posted.
Essin Em mentioned once it's like plagiarism against yourself posting something in 2 different spots.
11/28/2008
Contributor: Dragon Dragon
Here are the Terms and Conditions that are currently posted. When I looked back at them recently I found one thing that was very interesting. If you want Eden to link back to any personal sites, you must have a link to Eden that is not labeled "Eden Fantasys" or derivation of the company name. (Not "Eden Fantasys" not "Eden")

I'm not completely sure why they want to hide, but I'm betting that most people either didn't know or forgot that aspect.
11/28/2008
Contributor: Airen Wolf Airen Wolf
Wow as a new wide eyed wanderer in this world of Eden Fantasys I am encouraged that when there is a major problem the owner of the business cares enough about the community to take the time to state his case. It saddens me to see such a simple mistake compounded by fear and hasty action when a simple "Hey this shouldn't be available to the public" with the understanding that any further breach of privacy would result in letting people know their identities weren't safe. It's what I would have done but then I've never had my identity stolen and used against me.

This is the first community where I have felt safe and accepted both for my alternative lifestyle and for the fact that while I am very interested in toys I don't know much about their safe and proper use. I have learned SO much that I would be very sad to see the community eat itself alive with a "flaming witch war" like so many others. We are all striving to create a sex positive community and maybe even dream of creating a sex positive world where we don't have to hide our identities. Though I understand that this is a long term goal and that there will always be sick people in this world who will see a happily sexual person as a target I hope this can be a safe learning lesson and not cause real world complications either for the company or for the people mentioned on the list.

Though I am very new to this community and probably have no right to comment, I would like to say that should I feel the need to leave the community I feel I could adequately leave my reviews intact as they are for the products not for the clearing house I bought them from. I understand the desire to not have EF profit from my works if I am angry at them but still for someone like me who might drop in with NO knowledge of safe toy use I would want a responsible review available for them. I have always held that firmly in mind when writing my reviews and I can see from the other reviews that others have as well.

All in all I am still happy to be here and hope that in the future EF and it's wonderful team will entrust me with some products to review for them but if not then for all the wonderful patience and support they gave me when my order was hopelessly muddled I will continue to review all the products I buy as best I can, for EF as well as for the newbie.

~AirenWolf
11/28/2008
Contributor: Dragon Dragon
Quote:
Originally posted by Airen Wolf
Wow as a new wide eyed wanderer in this world of Eden Fantasys I am encouraged that when there is a major problem the owner of the business cares enough about the community to take the time to state his case. It saddens me to see such a simple ... more
I think that you are always welcome to communicate and speak your thoughts! I personally haven't seen your name before, and this is a great introduction. I too agree that there should not be a "flaming witch" hunt- only open communication and knowledge.
11/28/2008
Contributor: Sassy Sassy
I didn't receive free merchandise or any other compensation for the reviews that I am asking Eden Fantasys to take down.
11/28/2008
Contributor: Snappy Snappy
That's my post above with the username "Sassy". I accidentally created two accounts when I started contributing here. So, to reiterate,
I didn't receive free merchandise or any other compensation for the reviews that I am asking
11/28/2008
Contributor: Snappy Snappy
One more try:
I didn't receive free merchandise or any other compensation for the reviews that I am asking
Eden Fantasys to remove from this site.
11/28/2008
Contributor: Spiking Glue Spiking Glue
Quote:
Originally posted by Snappy
One more try:
I didn't receive free merchandise or any other compensation for the reviews that I am asking
Eden Fantasys to remove from this site.
link Current Terms of Service regarding reviews.

I hate to say it, Snappy, but when you agreed to the TOS, you gave them your reviews. However, it is not beyond asking them to act in good faith. Just be aware that they aren't legally obligated to.
11/28/2008
Contributor: Dragon Dragon
Quote:
Originally posted by Spiking Glue
link Current Terms of Service regarding reviews.

I hate to say it, Snappy, but when you agreed to the TOS, you gave them your reviews. However, it is not beyond asking them to act in good faith. Just be aware that they aren't legally ... more
Hey cool! Thanks Spiking Glue. I did not see that link at all when I went looking for TOS. It's buried too far down on the main page. I found the this one which can then be followed to here.

Both are generic and don't cover everything that needs to be mentioned.

There is a compromise solution that I've seen. Eden benefits from the reviews being on the company site, and therefore considers it a business asset. Certain reviewers no longer wish to be associated with Eden for many reasons. The option is to have your entire review profile changed so it's not personally identifiable- leaving the reviews up.
11/29/2008
Contributor: Spiking Glue Spiking Glue
Quote:
Originally posted by Dragon
Hey cool! Thanks Spiking Glue. I did not see that link at all when I went looking for TOS. It's buried too far down on the main page. I found the this one which can then be followed to here.Both are generic and don't cover everything that ... more
Yeah, I know what you mean. It's one of those 'hiding in plain sight' moments. *laugh* There's a link at the bottom of every page on Eden, as a part of their templating system, and from there I simply clicked on the link labeled 'reviews ...', although I did click 'copyright' first. I figured it out right away, because I'd seen it and read it before. Eden's policy on reviews is not significantly different from any other store who accepts reviews and anecdotes.

I think maybe Snappy kind of already did that? She seems to have rewrote her profile since I saw it last, it seems more impersonal than I remember it being.
11/29/2008
Contributor: Snappy Snappy
I haven't rewritten my profile. I didn't agree to give Eden Fantasys those reviews. I would appreciate it if they would honor my request to take them down. Once again, I did not receive any consideration in exchange for those reviews.
11/29/2008
Contributor: Champagne and Benzedrine (Roland Hulme) Champagne and Benzedrine (Roland Hulme)
Quote:
Originally posted by Snappy
I haven't rewritten my profile. I didn't agree to give Eden Fantasys those reviews. I would appreciate it if they would honor my request to take them down. Once again, I did not receive any consideration in exchange for those reviews.
I think what other reviewers have been trying to point out is that by agreeing to the TOS, you DID agree to give Eden Fantasys the reviews. Hence asking you to agree to a TOS in the first place. Small print and all that - and pretty standard with all online places you can leave reviews (try Amazon, for example.)

I don't know. As I said, I'm not a lawyer.
11/29/2008
Contributor: Grizli Grizli
Quote:
Originally posted by Snappy
I haven't rewritten my profile. I didn't agree to give Eden Fantasys those reviews. I would appreciate it if they would honor my request to take them down. Once again, I did not receive any consideration in exchange for those reviews.
Snappy. I am a developer at Eden. Legal issues aside, we cannot take the reviews down. Please, calm down. Contact us if you want: 1. Disguise your profile; 2. Disable the service altogether; 3. Sign off from any emails. These we can and will do.
11/29/2008
Contributor: Snappy Snappy
@Grizli Why could they take some reviews down and leave others up a few days ago, but not today?
11/29/2008