| The following notes were taken from: |
Table of Contents |
Meeting Purpose
- The Trust and Safety User Group is to provide a forum to discuss topics relating to safety and security in Second Life. However, please note that for matters of privacy and personal safety, the following will not be openly discussed by members of the team:
- Reports of abuse, together with the outcome of investigations or actions taken in response; specific account information (including terminations, suspensions, warnings, etc.); DCMA or copyright issues; internal processes; ToS interpretations.
- The meetings:
- Are held on the 3rd Tuesday of the month, at 11:00 SLT.
- Take place at the Linden Estate Services meeting place.
- Are a mix of Voice and text chat.
- Dates and times of meetings are recorded in the SL Public Calendar.
- For descriptions on all SL user groups and their purpose please refer to SL Official User Groups.
Phishing Links
-
Second Life dialogue boxes have sometimes been used to trick users into entering their passwords – if you see something like this – always click Ignore, never enter information personal information. Phishing issues have become an increasing problem over the last several years, with people placing URL links into group and IM messages which are inherently untrustworthy (e.g. fake SL Marketplace URLs leading to sites designed trick users into users into revealing personal information, such as passwords, etc.).
- These links have been made harder to identify as they can be easily disguised as innocuous text links which can be easily clicked (tip: hover the mouse over the text link to show the actual URL in tooltip format before clicking).
- A good point of reference for avoiding phishing attempts and what to do if caught by one has been written by Pantera Pólnocy on the Firestorm wiki.
- Steps have been taken at various times to try to reduce the risk of such exposure via routine warnings issued by LL, through the implementation of the SL eye-in-hand logo appearing next to official URL links (those to https://xxxx.secondlife.com, where xxxx might be something like marketplace), which has also bee adopted by Firestorm, although this particular approach is not foolproof.
- Firestorm 7.2.4 has also introduced a “URL unmasking” option for added safety.
- LL are aware of the concerns and are looking to implement further protections of their own against such attacks.
- However, there is a duty of care among users to exercise common sense as well. For example, where the URL is fully exposed, checks that it is valid. for example:
- Official login pages should be in the format “https://accounts.secondlife.com” or “https://id.secondlife.com”.
- Marketplace links always have the format “https://marketplace.secondlife.com” (no misspellings of “marketplace”, etc.) with item links following-on from this in the format: “/p/item-name-with-hyphens/item listing ID number (e.g. 11223344556)”.
- If the URL is embedded in text, hover the mouse over the text link to show the actual URL in tooltip format, per the comment above.
- Capabilities such as providing Group owners / moderators to whitelist “allowed” links, etc., have been requested and are being considered.
Multi-Factor Authentication
- Multi-Factor Authentication (MFA) remains the preferred way to protect a Second Life account.
- It can be enabled via your Second Life account dashboard.
- Additional instructions can be found here, if required.
- There have been multiple requests for LL to improve MFA, including a means to use it via er-mail, plus ability to recover without requiring a support ticket to be filed.
- Additional options for MFA are being discussed by Trust and Safety (including automated recovery), but no specific updates or new capabilities had reached a point where they are ready for discussion with users.
General Discussion
- General harassment / abuse using alt accounts:
- Questions were asked in both general terms and with specifics on the use of multiple accounts to harass / abuse others.
- As per the guidelines for the meeting, specific cases were not open to discussion.
- However, Alabaster Linden (Trust and Safety team supervisor) did confirm there are specific bad actors who routinely appear within Abuse Reports, and there are discussions going on internally within the team as to how:
- A more proactive approach can be taken with regards to instances of harassment at places like welcome hubs to prevent general harassment.
- A more rapid response can be given to cases of repeat harassment.
- With regards to the latter, Alabaster Linden also indicated that there is work going on in the background that will hopefully make it easier to manage / reduce the impact of repeat harassment via identified individuals.
- It was also reiterated that all issues of harassment / abuse should be filed with LL as Abuse Reports (see my Abuse Reports tutorial, if required).
- Abuse Reports:
- Trust and Safety receive around 50o abuse reports a day (approx. 2500-3,000 per working week).
- All reports:
- Do get reviewed, but obviously, and wherever possible, high-priority items (e.g. immediate cases of harassment or griefing) tend to get the most immediate treatment.
- Are investigated and are not handed off for automated processing via AI tools or similar.
- Unfortunately, sometimes it can take time for some issues to be addressed (e.g. land encroachment on Mainland).
- Abuse Reports can be submitted from any viewer, use of the official viewer is not required.
- Abuse reports do not have to be filled out in full, but should contain as much pertinent information as possible.
- Again, please refer to my Abuse Reports tutorial (written in consultation with the Governance Team – as it used to be called).
- Data gathering:
- There have been recent concerns about the use of bots for data-gathering in Second Life, particularly since the BonnieBots were completely banned.
- These concerns related to legitimate use of such bots for gathering non-intrusive information (e.g. such as with Grid Survey, or gathering region data which can be used in the production of heightmap / 3D renderings of regions, etc), and have been passed from user group to user group.
- As such, guidelines are being sought as to what is / is not regarded as a legitimate use of bots for data gathering and (on a more technical level) whether some data on regions can be made available less intrusively than via the use of bots.
- The second part of this question is something that requires more internal discussion at LL.
- The first part of the question is difficult to answer, as some are more tolerant of bot use than others.
- It was suggested that the issue is more comprehensively written-up in a support ticket (or similar), outlining things like data usage, concerns, what is being sought, etc., so there can be a more direct conversation on the matter, rather than it being passed from user group to user group.
- Alabaster Linden also offered to go through the various policies provided by the Lab on the use of bots, etc., and see if there is something specific that can be published by way of a blog post as a part of the promised outreach by the Trust and Safety team to help clarify matters.
- A question was asked on what is allowed within region maturity ratings – the clearest answer is via the Maturity Ratings guide. There is also the Adult Content FAQ.
- The last 15-20 minutes of the meeting are general conversation.
Next Meeting
- 13:00 SLT, Friday, July 21, 2026, at the Linden Estate Services.
Inara Pey: Living in a Modemworld 