Within two days, sites like LinkedIn and later Blizzard Entertainment and Yahoo had advised their users to change their passwords.

The latest company caught up in all this is the New York Times. A little more than an hour ago, the Times sent an email to customers (see below) whose email addresses appeared in a searchable database of compromised Gawker commenting accounts, warning them that if they used the same password on nytimes.com as they did on Gawker, it would be a good idea to change it. There is no evidence of any funny business on the Times’ Web site.

Incidentally, in case you missed it, Gawker’s technology head, Thomas Plunkett, circulated a memo detailing what happened at Gawker and what it plans to do in response to the incident. One thing it will do is offer disposable commenting accounts that users can ditch easily, and for which storing an email address won’t be required.

Here is the email from the Times:

NYTimes.com Wed, Dec 22, 2010 at 5:15 PM
Reply-To: nytdirect@nytimes.com

In case you missed our recent article “Gawker Sites Hacked and Passwords Compromised”
http://nyti.ms/hjNvlY we are writing to inform you that databases belonging to Gawker Media were compromised and hackers obtained more than one million user names, e-mail addresses and passwords.

While there is no evidence of suspicious activity on NYTimes.com we wanted you to know that
the e-mail address you registered with NYTimes.com matches an e-mail address that was on
the list of Gawker e-mail addresses and passwords that were published online.

If you use the same password for NYTimes.com as you did for Gawker, we strongly recommend you change your password. Changing your NYTimes.com password can be accomplished by visiting the Member Center page: http://www.nytimes.com/membercenter. After logging in to your account, click on the ‘change’ button associated with the password field which can be found under the Account Summary heading.

Here’s a Gadgetwise post with tips on developing a good password (in brief: do not make it a real word, keep it long and mix in an unusual combination of letters and numbers).
http://nyti.ms/gGR3kz

Please contact Customer Support at 1-800-698-4637 or e-mail customercare@nytimes.com with any questions.

Have a safe and happy holiday season.

The New York Times Company
620 Eighth Avenue
New York, NY 10018

As displayed by its policy of declining to give Google a way to extract user email addresses–which Google called it out on last week–Facebook is clearly worried about Google extending its excellent Gmail product with a rocket booster of emails imported from Facebook for a competing social tool. The timing of all this is coming to a head as the companies seek to release products before the end of the year.

So, is a social network that adds email better or worse than an email service that adds social?

Put another way, if you had to give up your Facebook or Gmail, which would go first?

An email service from Facebook would almost certainly have novel social features and the company’s trademark opt-out viral hooks. The Facebook emails will supposedly include @facebook.com addresses (and probably be the unique usernames that people have set up through Facebook’s vanity URL program). They would also be integrated into other Facebook products along with Office.

Meanwhile, a social product from Google, if done well, is one of the only things that could knock the young Facebook out of its dominance in the category. So many people today already depend on Google (you may have heard of its search product) and trust its brand.

Will Facebook email have Gmail’s hallmark feature, conversation threading? Will some young people who only use Facebook and texting for communication even notice a difference? Will Facebook finally release a better calendaring tool alongside email? We’ll let you know as soon as we find out.

By the way, this comment from Facebook platform tech lead Mike Vernal explaining why Facebook doesn’t want to export email addresses to Google (even though it already sends them to Yahoo and Microsoft) looks a bit different four days later:

Email is different from social networking because in an email application, each person maintains and owns their own address book, whereas in a social network your friends maintain their information and you just maintain a list of friends. Because of this, we think it makes sense for email applications to export email addresses and for social networks to export friend lists.

Please see the disclosure about Facebook in my ethics statement.

Google publicly shamed Facebook this week for not giving its users the option to export the email contacts of their Facebook friends and import them to Gmail. The rapid-fire kerfuffle between the two companies came after private talks about sharing such data had broken down, and is apparently working, with tech industry opinion seeming to side with Google, even though few if any users seem to actually care about the issue. Sooner or later, if users start demanding to own their email lists and complaining about Facebook being evil, it will happen.

But the actual battle isn’t about reciprocity. If it’s on purely moral grounds, everyone’s hypocritical here. Facebook has arrangements to share user email addresses with Microsoft and Yahoo, and Google has in the past impeded Orkut users from exporting emails to Facebook. The reason this is playing out this way is because of the contentious relationship between Facebook and Google, and Google’s planned competitor to Facebook, a.k.a. Google Me.

As a larger question, what captivates me is how much value people are putting on user email addresses. Are our email addresses really the best proxy for who we are?

If you peel back the back-and-forth, the substance of Facebook’s argument is that Facebook users are on the service because it’s a social network, not an email application. When you use Facebook, your friends are identified by their (usually real) names, and you hardly ever see their email addresses. From Facebook platform tech lead Mike Vernal’s comment on TechCrunch:

Email is different from social networking because in an email application, each person maintains and owns their own address book, whereas in a social network your friends maintain their information and you just maintain a list of friends. Because of this, we think it makes sense for email applications to export email addresses and for social networks to export friend lists.

But to Google’s point, if people want to deactivate their Facebook accounts and/or try another service, they shouldn’t lose what they’ve created. When you join a new service, the best way it becomes useful and interesting is to quickly find and invite your existing friends (see: network effects)–and the best way to do that is to import a list of your email contacts.

The problem is you don’t own your friends’ email addresses; they do. Email is the only successful example of a decentralized social network.

Facebook has a privacy setting that lets you decide who specifically can view your email address. But that’s just within the centralized system of Facebook; you don’t (yet) get to choose where your email address can be shared. Plus, as we all know, Facebook’s privacy settings can get rather complicated, and both we users and the company change them over time.

Say I have a business contact I don’t want to share my personal email with, and she goes and exports her Facebook email contacts so she can fill out her Yahoo Mail contact list. Those settings need to carry over. And even if they do, spam and invasions of privacy are pretty much inevitable.

But am I my email address? As someone who’s very recently changed jobs, I know firsthand that link can be broken. I registered for so many of the sites I use with my old work email, and my whole address book was locked up there too. Now I have to reconstruct those relationships with a new identity. But I can do it. I’m still myself, after all.

Probably all of you reading this have more than one email address, and often multiple people use the same email address or the same computer. There’s not a one-to-one link between self and email, and the overlaps are often confusing and annoying.

Besides email, other options for an identity token might be your phone number, your social security number, your Facebook user name or your fingerprint.

But email seems to be the agreed-upon best proxy for Web services. Companies like RapLeaf run their businesses on connecting and aggregating information about people based on identifying their valid email addresses (and incur concerns about the implications of getting all that data in one place and selling it).

The stakes in this battle are increasingly high. Both Facebook and Google want to be our identity on the Web. I stay logged in to Gmail and Facebook all day from my laptop, and reap the benefits of those services being integrated with other ones, whether it’s a related service like Google Calendar or a new doodad that I can use Facebook Connect to register for.

Both Facebook and Google are striving to do two things:

• Represent us best by collecting our connections and experiences
• Be our token to bring that identity the rest of the Web

So think about where this is going. Facebook last week introduced a single-sign-on feature for phones (first on select Android apps and soon iOS). The way this will work is when you open a participating app, you have the option to connect to Facebook and bring your identity and friends with you. So the first time you use the app, it knows you and your context. You can imagine if this were to extend to Facebook’s Instant Personalization product, and you were to get a phone that out-of-the-box got your Facebook account and then automatically set up your contacts, preferences, apps and anything else you want or need. It’s powerful stuff.

Please see the disclosure about Facebook in my ethics statement.

Background: Last week, Google stopped allowing Facebook to help its users find their friends by importing their Gmail contacts list. Google said the move was about data portability and liberation, calling Facebook a “data dead end” because it wasn’t giving its users’ email addresses to Google.

Facebook yesterday found a workaround to re-enable Google contacts importing, and Facebook engineering lead Mike Vernal commented on TechCrunch at length under his own name, charging Google with hypocrisy for disallowing contact importing for Orkut last year and “limiting user choice.”

What’s funny, though, as sources have pointed out to us, is that Facebook actually does allow email importing, specifically to Yahoo Mail and Microsoft’s Hotmail (we checked AOL mail too, but couldn’t find it there).

This is no secret; Yahoo launched its Facebook email contact importer in March of this year. In a blog post at the time, senior product manager Rick Pal said,

Importing from Facebook is super simple…After you click login, we will authorize your account and begin importing, which may take a minute or two depending on your Internet speed and how many Facebook friends you have.

Update: Microsoft confirmed through a spokesperson that its Windows Live users can import both Facebook and Gmail contacts, and said some nice stuff about its commitment to customer choice.

Access to user emails isn’t something Facebook gives just anyone. In fact, only a few partners can hook into them while the rest have to rely on users’ Facebook-formatted information available through Facebook Connect. That includes Google. The difference, according to a source, is that Yahoo and Microsoft asked nicely.

Please see my disclosure related to Facebook here.

But it’s easy to delete or lose emails. Contacts in a digital address book are more permanent, and they synchronize with smartphones.