There’s this huge security flaw in myspace that lets you read comments on private profiles, and I’ve pretty much read all the crap that Lindsay Lohan, Paris Hilton, Hillary Duff, and Nicole Richie are saying to each other. Paris got told by her PR guy Elliott to cut it out and she was supposedly grounded from using the computer, but of course she didn’t comply and continued commenting.

This was up on Oh No They Didn’t and got a brief mention in The NY Daily News, but the ONTD post is private now and I learned about it through a friend’s e-mail.

The thing is, there’s a formula to it and it really doesn’t matter if someone changes their profile name or password. Once you know their numeric user ID it’s incredibly simple to do, and as long as they keep commenting it’s easy to find out their numeric user ID.

They seem to realize that people are reading their comments and are talking about all the new people asking to be added as friends, but they don’t really get the fact that changing their passwords and screen names doesn’t fix the problem.

I was really reluctant to report on this at first as 1) there’s way too much information to sift through and report 2) it feels wrong and 3) I don’t want to get sued. Plus I got sucked into the voyeuristic aspect of it and I wanted to be able to keep spying.

Best Week Ever has the links, though. I know this is Monday’s news but somehow it fell under my radar.

The juiciest news: Lindsay, Hilary, and Paris talk about doing banana and strawberry “Nesquick” and returning “needles” to each other. They could just be joking around. They’re also all friends with Jesse McCartney, and he could be screwing Lindsay, because he says:

But it’s just as likely that they’re joking around, and of course there’s no way to verify that it’s really Lindsay, Paris et. al, but I believe.

Paris also tells Lindsay:

And it looks like Paris is BFF with Lindsay again because she’s using an icon of the two of them together.

Here’s my favorite comment, from Haylie Duff to Jesse McCartney:

If you have any kind of logic skills you’ll quickly be able to figure out how to view anyone’s private comments using the links from the Best Week Ever post above.

Myspace will undoubtedly fix this soon, and it’s a huge security flaw. According to myspace’s user agreement everything on the site legally belongs to them, so I don’t know if any celebrity lawyers can sue for reposting information found on myspace, but if it gets widely distributed like Paris’ hacked Blackberry they’re sure to try.