Everyone has probably already heard that Facebook rolled out new privacy settings today. If you haven’t seen them or gotten the following pop-up box on login…you will soon:
There are a great deal of articles already out about how this is such a great improvement and how these new settings give you more control over your privacy. However, I would argue that these settings may possibly open up more issues then they are trying to prevent. The best article on the new settings and the privacy implications is the one that the Electronic Frontier Foundation (EFF) released today titled: Facebook’s New Privacy Changes: The Good, The Bad, and The Ugly. I recommend everyone (no pun intended) read this article as it provides much more detail then I will provide in this post.
What I want to do is provide you with a summary of the good and the bad of the new privacy settings. I also want to give a security professional’s point of view on these settings. As a penetration tester I can tell you that my job just got way easier! You may have read my series on Enterprise Open Source Intelligence Gathering in which I tell you how you can find information on social networks about your company and employees. Well, searching for information on Facebook just got easier thanks to status updates being available using new technology like Google Real-time Search! Ok, on to the better and the worse!
The Better?
- The new way privacy settings are “managed” is a good thing. It’s easier to find and navigate through the settings.
- I like that they ask you for your password to change privacy settings. It’s just another layer. Now, this doesn’t help much if you have a keylogger installed but it seems they put this in to prevent bots that may have taken over your account access to your settings. Again, not fool proof but another layer.
- The ability to fully customize privacy settings on all the content you post. So for example, you can specify if you want everyone on the Internet to view your status updates (more on that in a minute) or Friends, Friends of Friends and Custom.
- Users are now somewhat “forced” to check out their privacy settings. It’s more accessible that’s for sure.
The Worse?
- Your Name, Profile Picture, Gender, Current City, Networks, Friend List, and Pages are all available to be viewed by EVERYONE on Facebook! You cannot change these settings at all. Note, there is a way to remove your entire Friends List from your profile but it’s all or nothing! Here is a screen shot of this. You have to set it in your profile page using the “edit” button and check the box.These changes are quite disturbing considering that you used to be able to restrict this type of information. I really believe that Facebook has done this on purpose so *more* information is being shared about you while stating “enhanced” more granular privacy settings. If you have been to one of my talks in the past I always mention that social networks need to find ways to make money. The way they make money is off of the information you share! If you don’t get a choice about the basic information anymore…that’s more money in their pocket at the expense of your privacy.
- What about the security ramifications of this? It opens up a whole new world for cyberstalking, predators and other attackers. If you were someone that didn’t feel comfortable sharing this information in the first place, your choice is gone. Sure, you can lock down your profile so no one can search for you but if you do that…why are you on Facebook to begin with? You *have* to let your real friends search for you at some point!
- By default Facebook “suggests” that you set your status updates to “Everyone”. Here is the thing with status updates….Everyone means everyone on the Internet! This is where new technology like Google RTS comes into play. Imagine how easy it will be to find the latest information on “Tiger Woods” or now everything YOU are saying on Facebook, Twitter and other social networks. Enter in some social engineering and things just got easier for attackers looking to use you or your information (which is easy to figure out now that I can see your friends, and things that interest you via the pages your a fan of).
- Lastly, Facebook removed the ability to prevent Facebook applications your friends installed from pulling your “public” information. That option is now gone and applications that your friends install can now view your “public” info. Remember kids, “public” info is now: Your Name, Profile Picture, Gender, Current City, Networks, Friend List, and Pages.
One final note…be sure to double check all your privacy settings after you run the wizard. I found a few settings that reverted back to settings I never had. So what are your thoughts? Will this make you lock your profile down more? Do you care? Is privacy dead anyway? Will Zombies destroy us all? 🙂
I am going with security and privacy are dead. This feels like one step forward and two steps backwards. Getting control of some information while losing it on others is a pretty hollow victory…
I HATE FACEBOOKKKKK PRIVACY SETTINGS!!!!!!!
Privacy is becoming deader, yes I believe there is in fact less control over privacy with the new settings, or at least that is how it appears to me at the moment. Time will tell.
What KaizerA said.
I don’t want those stupid applications bothering me especially those malicious ones. I also don’t want people to be able to search for me on Google which pisses me off. Now it’s going on “lock down” if I can even down that.
i really really hate new privacy sttings…cant ya chng it agen plzzzzzzzzzzzzzzzzzzzzzzzzzzzzz.its sucks….nd its a shit idea to add new settings…every 1 hate it…
You can block you friends list from everyone except your friends by clicking the pencil next to it on your profile page. Then uncheck the box.
Pingback: Arron M Finnon - Finux Blog
Friends lists are STILL not hidden from strangers when u click this tab… When people have at least 1 mutual friend with you and they right click “See All” on the mutual friends box and either choose “Open link in new window” or Open link in new tab” strangers can see all your friends even if you chose to hide it on your profile… And with Internet Explorer just clicking “See All” shows the entire friends list.. face book have lied and many people think their “UPDATE ON DEC 10th fixed friends listsprivacy.
please everyone write to facebook to complain…they have tricked people into thinking they have given privacy back on friends lists
Pingback: Social Media Security » Social Media Security Podcast 7 – New Facebook Privacy Settings, Twitter Lists, FTC and Bloggers