MasterEvilAce's dashboard

I had a post all typed up, but wasn't logged in, and I lost it, so this one probably won't be as coherent. I don't know the exact implementation, but from a technical standpoint this is how it goes.

You listen to a track, Songbird contacts last.fm from your computer and gives necessary information such as Artist, Title, Album of the track you just heard. Because it makes this connection to last.fm, your public IP is easily seen by the last.fm servers. This can, and probably is logged (the connection has to be logged by some degree, at some point.)

If you are worried about them having your IP address, then it's already too late, because I'm sure it has been logged to your account when you first registered. Even if your IP has changed since then, they can still find out who you are from your ISP. Your ISP would probably log who used what IP address at any given point in time. From there they know everything about you. Of course they'd have to get a court order to go after your personal information from your ISP... Which is probably not going to happen unless they see some very suspicious activity (maybe you listened to every album a month before the retail copy hit the shelves?), and can actually use the information legally (more below).

At this point, I'm going to say Songbird probably doesn't do anything outside of that. It probably doesn't scan your library and report it to last.fm, or anything like that. Last.fm's software probably does that in order to keep its music database up to date (by knowing what artists made what albums with what tracks on it), and by knowing what you listen to, as well. It probably has no intention of doing anything 'malicious' with the data.

Having said that, I've read the article about last.fm's "data leak" or whatever you may want to call it... I don't believe anybody can really do anything with this information legally (let me know if I'm wrong). It was probably against the privacy policy of last.fm to give out information about your account like it did. If this is the case, then the 'evidence' is thrown out.

Secondly, the information is probably all from mp3's ID3 tags, which are easily modified. You can create a 3 minute mp3 that is completely silence, and tag it as Madonna - Hung Up. Does that mean the track is what it says it is? Certainly not. Because of this, there's no certainty of anything. On top of that, how does anybody know that you didn't rip the music from your own personal CD collection? They don't. They can't know where you got it.

I would say that users of last.fm have nothing to worry about, to be honest. If you are still afraid, your best bet is to stop using last.fm entirely. However, at this point since you have an account, they probably already know anything they need to know. I really wouldn't worry.

Hopefully some others have more insight into this.