Who Gets Your Personal Information on Facebook?

Are you one of the 350 million Facebook users? I’m a big fan of Facebook and like many I connect daily to see what my friends are doing and to share photos. As a security professional I am very careful about what I post and what information I allow to be shared. In that respect I’m unique. It surprises me how many of my friends will refuse to allow companies to share their information but eagerly give away their personal information to application developers on Facebook.

My friend Diana sent me some Christmas cheer. How could that be a bad thing right? Well, if I accept her cheer I’m sharing my personal information and all my friends with a company called Mob Science who has no physical address or privacy policy posted on their website.

Who are these application developers you’re giving your personal information too. One of the most popular developers is San Francisco based Zynga. They’re responsible for the games Farmville, YoVille, Mafia Wars, RollerCoaster Kingdom, Scrabble and dozens more. You’ll never be offered a chance to read Zynga’s privacy policy but the information is typical. They say only your name, address and gender are collected. As in most privacy policies they protect themselves with vague statements like “we don't generally collect any “Personally Identifying Information” about our users”.

I’m not saying the folks at Zynga are evil or have bad intent but I doubt most users realize they’re providing information to this or other little known companies. Most people mistakenly believe it’s just all part of the Facebook experience.

It’s not just the games. When you take a quiz, or even donate to “Causes” you’re providing access your personal information. When you create or join a “Cause” you’re registering your personal information with Berkeley based Philotic Inc, started by Sean Parker, one of the brilliant co-founders of Napster.

If you’re a fan of Farm Town, you’ve registered with Florida based SlashKey. Popular game provider MindJolt.com is another one that doesn’t include any physical address or privacy policy on their website. The number two Facebook developer Playfish acknowledges “We collect the following personal data from you … : your date of birth, gender and your contact details including the country where you live and any phone number(s) or email address(es) that you provide.” In addition, “We may use a third party to serve advertisements on our site. Cookies may be associated with these advertisements … We do not have access to or control of cookies placed by third parties.”

In the grand scheme of things the dangers from sharing your information with these companies may still be minor compared to other risks. I wanted to focus on 3rd party Facebook Applications because most people don’t understand why their Email Spam seems to know specific personal details.


Did you know when your friend allows an application, they give away all your information too?

When you sign up for Facebook all these boxes are checked as the default setting. That means if your friend allows an application, all the information you may have set to "Friends Only" is made available. Click Here to change your settings. (Update 12/9: Facebook has made some changes do don't be surprised if this page looks a little different)

Facebook has been slow to react to customer concerns but recently announced new privacy options. It’s still up to the individual user to check out their rights and options to protect themselves. If you’re a Facebook user please click here to read how you can update your privacy settings.

Updated 12/9
Facebook has updated their privacy options. Here's the replacement for the screen allowing you to restrict information shared by your friends.

Facebook Simplifies Sharing your Personal Info

Read More

Privacy Warning using Facebook on a Network.

First let me say, if anyone else wrote this I’d say they were crazy.

I had a big surprise this morning when I clicked on a Facebook link and saw I had new friends.   I was even more surprised when I noticed I wasn’t signed on as myself, but was signed on as Cindi my wife.

Using normal logic I would have thought my wife had used my computer. I knew that couldn’t be true because Cindi hates my computer.  My laptop is a ThinkPad x61 with a track-point and doesn’t even have a a mouse touchpad.  My laptop hadn’t left my side since last using Facebook and even if it had, she wouldn’t have been able to use it.

How could this happen?  All the common sense within me says that Facebook would use cookies on my machine as a way to remember me. What I experienced today implies some kind of IP address related connection. That would be stupid right?

We both use the same wireless network but still, that shouldn’t have anything to do with it.  This makes no sense to me, and some might think I’m crazy but I feel a need to share it. It really did  happen so it can only be a flaw in Facebook or some kind of weird network error.

Do you use Facebook at work on a network?  Do you say anything you wouldn’t want you co-workers to see?  Even in private messages? Well, Stop.  The only reason I started to use Facebook was to write about privacy but I never expected this.

If this has happen to you or if anyone has a better explanation… please comment.

Read More

Social Networks are a Ponzi Scheme of Friendship

Are you getting tired yet of the term Social Media or Web 2.0? Have your friends convinced you to join Facebook, LinkedIn, Twitter or some other social networking site? The truth of the matter is that Social Networking is a giant ponzi scheme.

When you first join a social network you start with only a few friends. It could only be your only friend is the one who convinced you to join.  The network typically has no real value until you add more friends and invite them to join.  Many networks will try to harvest your entire contact list in an effort to increase its membership.  So, you Email your friends and family and there’s a new layer of friends supporting the pyramid and the cycle begins again for them. Soon, you reap the benefits of “Friend of a Friend” and the network begins to have value.  As long as there are new users to join the network will be a success.

I don’t know if this is the year we’ll peak with social networks but they’re certainly hot.  According to Pew Internet & American Life Project, 11% of online American adults are now using Twitter. I’m not sure what defines an “online American” but I know I’m one of them.

I mentioned before that I am “Twitterpated” and you can follow me at http://twitter.com/BillP. I also have a WinPatrol information feed at http://twitter.com/WinPatrol that currently has 75 followers. You’ll me on LinkedIn,  Facebook  and you can read why people love WinPatrol on my Fans of WinPatrol page.  It’s only been active a couple weeks and we already have 143 members.  Click below to join. 

WinPatrol on Facebook

Now This is Important
You don’t have to be a member or participate on Twitter to benefit from its huge network of Tweeters.  Search.twitter.com  has become the Google of real-time and current information. Most news organizations are using Twitter to research stories.  When US Airways flight 1549 splashed down in the Hudson I heard it first on Twitter. While on board a ferry racing to the scene, @jkrunms shared a photo taken by his phone via Twitter. Before ABC announced this years line up for Dancing with the Stars, I already had the list from folks on Twitter. It takes Google some time to index the world wide web so if you need immediate info I recommend adding Search.twitter.com   to your favorite places.

Follow @BillP on Twitter!

As Phil Collins sang,  You follow me, and I’ll follow you or was it the other way around? 

 

Read More

Photo From Your IPAddress Has Been Uploaded

It starts with an innocent message that you think comes from one of your Facebook friends. Below is a classic example of social engineering designed to steal your password.  It didn’t take a brilliant hacker to come up with this scam. It just took someone with evil thoughts and no life.

I noticed this message on a friends Facebook page this morning and my experience told me right away that something smelled funny. When I cautiously went to the web page listed via my test machine it all become clear.

First, they try and scare you.

 

It might seems safe because they only want your Email right?

If you entered your password, it’s time to go to Facebook
and other sites listed before and change it now.

Next Step

Now, they want to know where to use your name and password.

And finally, you get the final let down.

If you fell for this, you’re not alone.  Like most social engineering scams they use fear to throw you off.

 

 

 

Read More

Passwords Up for Grabs on Social Networks

I’m not a big fan of new Web 2.0 Social networks but I have participated in some new ventures. You won’t find me on MySpace, BeBo or other silly services. I am active on LinkedIn which is geared towards professionals and yes, I’m addicted to Twitter. I did join Facebook to write about their Beacon privacy problems and still participate now and then to see what my friends are doing.  I don’t participate in any of the Facebook applications because like many services they always try to trick me into sending invites to my friends.

The services I really hate are the ones who try to get you to hand over your address book so they can spam your contacts with invites to join. In many cases, they just want you to give them access to your Email accounts so they can suck out your contacts and automatically populate your new friends list.  While this might be convenient it can be very dangerous. 

The most annoying is a service called Tagged.

It Gets Worse

Many sites will transmit your name and passwords as unsecured data. This makes your name and password visible to anyone along the Internet path.

When you’re entering or giving someone else access to your name and password you should first look to see if you’re on a page that is https:// or shows the locked symbol indicating a secure transmission of data.  There’s also a method which can be used encrypt data called OAuth but it’s impossible to know which sites actually support this. 

Recently, I joined BrightKite which allows me to integrate messages to Twitter. They tell me Twitter doesn’t support “OAuth” which means I sent my Twitter login information across the net unsecured. This is scary because there are a wide variety of tools which integrate with Twitter. None of them will encrypt your name/password when logging on to Twitter. So if you see me say something really stupid on Twitter, it might not be me. 

I’m sure you don’t use the same password for different online sites ( cough cough) but in the case of social networks, it’s very important you create different passwords. Just like I periodically remind readers to review their backup procedures, and today is a good day to look at your current password scheme.

 

 

 

 

Read More

Facebook Recommends IE7

I may have mentioned once or twice that I’m not always the first to upgrade to new versions. When something works for me I’m happy and will continue using it until I have a good reason to upgrade. I still haven’t upgraded to Internet Explorer 7 and haven’t had a good reason to switch. Most of the time I use Firefox but I do occasionally use IE especially on my tablet PC which has some problems with Firefox.

I was surprised when I went to Facebook today and saw that they were encouraging me to upgrade to IE7.

Of course, they’re not just promoting Microsoft's Internet Explorer. They also provided links to Firefox and Opera.

According to my Blog reader stats 46% of my readers are using IE7. Only 16% are still on IE6. I guess it might be time to upgrade. I haven’t heard any horror stories from IE7 users lately. What do you think? Click on “Comments” below and let me know.

Read More