Everyone has probably already heard that Facebook rolled out new privacy settings today. If you haven’t seen them or gotten the following pop-up box on login…you will soon:
There are a great deal of articles already out about how this is such a great improvement and how these new settings give you more control over your privacy. However, I would argue that these settings may possibly open up more issues then they are trying to prevent. The best article on the new settings and the privacy implications is the one that the Electronic Frontier Foundation (EFF) released today titled: Facebook’s New Privacy Changes: The Good, The Bad, and The Ugly. I recommend everyone (no pun intended) read this article as it provides much more detail then I will provide in this post.
What I want to do is provide you with a summary of the good and the bad of the new privacy settings. I also want to give a security professional’s point of view on these settings. As a penetration tester I can tell you that my job just got way easier! You may have read my series on Enterprise Open Source Intelligence Gathering in which I tell you how you can find information on social networks about your company and employees. Well, searching for information on Facebook just got easier thanks to status updates being available using new technology like Google Real-time Search! Ok, on to the better and the worse!
- The new way privacy settings are “managed” is a good thing. It’s easier to find and navigate through the settings.
- I like that they ask you for your password to change privacy settings. It’s just another layer. Now, this doesn’t help much if you have a keylogger installed but it seems they put this in to prevent bots that may have taken over your account access to your settings. Again, not fool proof but another layer.
- The ability to fully customize privacy settings on all the content you post. So for example, you can specify if you want everyone on the Internet to view your status updates (more on that in a minute) or Friends, Friends of Friends and Custom.
- Users are now somewhat “forced” to check out their privacy settings. It’s more accessible that’s for sure.
- Your Name, Profile Picture, Gender, Current City, Networks, Friend List, and Pages are all available to be viewed by EVERYONE on Facebook! You cannot change these settings at all. Note, there is a way to remove your entire Friends List from your profile but it’s all or nothing! Here is a screen shot of this. You have to set it in your profile page using the “edit” button and check the box.These changes are quite disturbing considering that you used to be able to restrict this type of information. I really believe that Facebook has done this on purpose so *more* information is being shared about you while stating “enhanced” more granular privacy settings. If you have been to one of my talks in the past I always mention that social networks need to find ways to make money. The way they make money is off of the information you share! If you don’t get a choice about the basic information anymore…that’s more money in their pocket at the expense of your privacy.
- What about the security ramifications of this? It opens up a whole new world for cyberstalking, predators and other attackers. If you were someone that didn’t feel comfortable sharing this information in the first place, your choice is gone. Sure, you can lock down your profile so no one can search for you but if you do that…why are you on Facebook to begin with? You *have* to let your real friends search for you at some point!
- By default Facebook “suggests” that you set your status updates to “Everyone”. Here is the thing with status updates….Everyone means everyone on the Internet! This is where new technology like Google RTS comes into play. Imagine how easy it will be to find the latest information on “Tiger Woods” or now everything YOU are saying on Facebook, Twitter and other social networks. Enter in some social engineering and things just got easier for attackers looking to use you or your information (which is easy to figure out now that I can see your friends, and things that interest you via the pages your a fan of).
- Lastly, Facebook removed the ability to prevent Facebook applications your friends installed from pulling your “public” information. That option is now gone and applications that your friends install can now view your “public” info. Remember kids, “public” info is now: Your Name, Profile Picture, Gender, Current City, Networks, Friend List, and Pages.
One final note…be sure to double check all your privacy settings after you run the wizard. I found a few settings that reverted back to settings I never had. So what are your thoughts? Will this make you lock your profile down more? Do you care? Is privacy dead anyway? Will Zombies destroy us all?