I can confirm unequivocally, in my tests, that turning off the setting mentioned by bloodhawk (i.e., sliding the Show Friends slider all the way to the left) does NOT block the behavior.

I can't find any way - in Messenger, Hotmail, or on live.com - to block the way that the Hotmail What's New page scrapes up "friends of friends."

Microsoft screwed up this one big-time.

As bloodhawk notes above, you can change the privacy setting for Friends List (if you can find it), but in all the experiments I've done so far, that hasn't changed the Hotmail logon screen behavior.

I'm going to try again with brand new id's and see if I can get the setting to work, but even if it does, anybody who IMd someone long ago will still be vulnerable. As best I can tell.

If your experience varies, please let me know!

I see the setting, but as best I can tell it doesn't have the effect that you describe. I change the setting for user "X" to Just Me. I then log on to Hotmail with a different account. The "X and Y are now friends" display is still there.

Try it and see for yourself.

As for trolling... So, if this works, you're saying it's obvious that if you want to prevent one of your IM buddies from seeing all of your IM buddies' names when they log on to Hotmail, you should know that you have to (1) go to www.live.com, (2) log on with your IM id and password, (3) navigate to the Privacy page, (4) click through the Advanced tab, (5) click on a line that says Basic Information, and (6) adjust the slider that says Friends List to Just Me.

You're also saying that clicking on the Private setting shouldn't necessarily make your IM buddies list private.

Forgive me, but who's trolling whom?

Yes, that's correct: I mean that clicking Private - the third of the three privacy options - does NOT block disclosure of your IM buddies.

I've been looking all over for a setting such as the one you describe, and I don't see it.

In my Live profile, I click Privacy Settings, Advanced. At the top of the page I see the three options - Public, Limited, Private. As you say, none of those block disclosure of IM buddies.

I go farther down the page and I don't see a Basic Information block. I see "Profile and Search" and "Activities" ... all the way down to "Manage connections with other services".

There's no Basic Information block, and no slider to set who can see my Friends List. None.

Under "Profile and Friends" there's a slider marked "Basic Information" which can be set to "Just Me". Is that what you're talking about?

But you see, that's the problem. I set up ALL of the accounts as "Private" and that didn't keep Hotmail from showing my erstwhile "friend". When I click Advanced, I don't see a setting that says "don't blab about the people I've IMd" - don't see anything similar. What did you change to tell the Hotmail logon screen that it shouldn't scrape my IM buddies' names?

@bloodhawk - Sorry, but this isn't MS bashing. I've been writing books about Windows and Office since Windows 3.1, and I've been accused of being both an MS toady and a basher - sometimes both at the same time. Ain't true. I call 'em as I see's 'em. I've been looking for a way to disable the chain-of-references. Please tell me where to turn it off. Changing the overall setting to "Private" in Wave 4 doesn't do it for me.

@izo - If you have a chance to read the InfoWorld article, you'll see that my original example involved a guy and his boss, and a potential new employer. That's close to the scenario that originally brought this problem to my attention. Back in April, I wrote about - and warned Microsoft about - this precise problem. (See my Windows Secrets Newsletter article.) Somebody there just isn't listening. Privacy problems are real and enduring. Examples are fleeting - mutatis mutandis. No offense intended.