Slashdot Mirror
Social Networking Site Safety Questioned
An anonymous reader writes to mention a TechNewsWorld article about social networking sites. Researchers are finding these places are goldmines for social engineering exercises. Between worm attacks and simple human observation, sites like MySpace are the perfect place to obtain saleable personal information. From the article: "The danger is real, according to a study conducted by CA and the National Cyber Security Alliance (NCSA). In October, the alliance issued its first social networking study examining the link between specific online behaviors and the potential for becoming a victim of cybercrime. Despite all the publicity about sexual predators on sites like MySpace and FaceBook, the alliance took a different approach by measuring the potential for threats such as fraud, identity theft, computer spyware and viruses. Although 57 percent of people who use social networking sites admit to worrying about becoming a victim of cybercrime, they are still divulging information that may put them at risk, as Boyd suggested. Social networkers are also downloading unknown files from other people's profiles, and responding to unsolicited instant messages that could contain worms, the NCSA reported."
Researchers are finding these places are goldmines for social engineering exercises.
Yeah, well you know what you have wherever there's a goldmine. Gold diggers.
The theory of relativity doesn't work right in Arkansas.
Should the other end be fixed? Why should it be possible to steal someone's identity with the simple personal details people make available online?
all the best,
drew
FreeMusicPush If you want to see more Free Music made, listen to Free
Just make your damn profile private! If you are naive enough to think that everyone in the world wants to read your profile, you are probably too naive to understand that everyone's intentions sometimes aren't friendly.
One of our HR people just to prove a point attempted to look at my profile, and then sent me a friend request which I denied for that reason. Making a definitive wall between work and whatever it is that I do at home is very important.
I was under the impression that this was a well known and obvious problem for a long time. Maybe I'm wrong it's new. Meh.
Never leave home and you'll never catch a cold or get run over by a car. Join the fight against leaving home now!
Its a meeting place for all the morons on the interweb (as called by a few of my friends)
Myspace, hi5, bebo, is just to name a few i see around here in job corps,
ever wonder why AOL Userers got the most phising emails, because most AOL users where morons
WulframII - Free Online Mutiplayer 3D Tank Shooting Game
Things I don't put on my accounts:
1. Real name. Anywhere.
2. Publicly displayed email address.
3. Any location info more specific than state.
Also, it helps to use different handles on different forums/blogs/"social networking" sites/etc.
In shocking news today, it was revealed that human stupidity is not relieved by the internet, but is actually exascerbated by it. News at 11:00!
"As God is my witness, I thought turkeys could fly." A. Carlson
People don't find these sites anymore. They go online specifically to accumulate profiles, with no knowledge of what they're doing. Of course it's going to go horribly wrong.
If my laptop's stolen (encrypted hard drive now), I have a backup. If my credit card's stolen I have another one in my safe. If identities get stolen that often, I wonder if people should have backup identities - so at least they can function while they're fighting with their financial institutions to unfreeze their main accounts and recover their losses.
Before saying it's nuts - consider that rich people have this in the form of numbered swiss bank accounts. Even in extreme cases where their entire accounts are frozen by governments, they have backup resources to sustain themselves for a while.
But for the less wealthy, perhaps it's best to do it the other way around - use an alternate identity while online like on myspace; and keep your real one as the hidden backup one.
Part of the problem is sites asking for identifying info when you sign up, including passwords, email addresses, real addresses sometimes, or postcodes/zipcodes, dates of birth etc? Why? None of this stuff has anything to do with what I post on Slashdot, my opinions on music, films, games. Having it stored on the site owners server does nothing to aid my attempts to get answers to technical problems on usenet or forums. And I'm not entirely sure it can be said to help reduce trolls and other problems that afflict public sites. If people didn't have to exchange all this info to register on sites etc, and it was only provided when absolutely necessary then maybe people will be more aware of exactly who's asking for it and how safely it'll be stored.
Another recent study said that walking down dark alleys while jiggling your car keys and waving a wad of cash around may increase the likelyhood of muggings.
Why is this such a big issue? Because we don't currently have a reliable way of verifying identity. Until that basic problem is fixed, there is no way to fix the identity theft issue.
Of course, the only really reliable way of proving identity is some kind of private key crypto backed up by high-end biometrics (eg, retinal scan, or dna), and the odds of something like that being implemented are hilariously low, for about a million reasons.
At the very least there needs to be some sort of private ID that is used to verify the "public" id that you pass along to the credit companies and whatnot.
ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
Best practices to protect personal data like IDs should be consistently supported in software if most people are to practice them.
I'm really annoyed every time I have to type my name/address/email into a Web form. How many times have I typed that info in the past 10 years of the Web? Why can't forms include either Javascript or even standardized APIs for requesting the same personal info? In increasing scopes with simple descriptive names. So I don't have to let my info sit cached at so many remote servers with which I do intermittent business, any one of which can leak my info at any time.
I want to see a Web GUI show submittable form sections tagged by their target org. I'd like to subscribe to a service that rates forms by their risk, demonstrated by proven vulnerabilities in distributed reporting databases (or whatever my selected advisor uses to decide its ratings). Many people would pay for such a service to advise how much info to disclose to a given recipient. And many organizations would pay to make using them free, like insurance and bank corps, not to mention governments with insight into the preventive value of informing consumers of disclosure risks, without slowing down acceptable transactions.
People can protect ourselves even more than with just tech fixes. We have the right to privacy in our "papers and effects": our personal data. We produce a government to protect that privacy. We should specify how they protect it, like requiring all disclosed personal data to be redistributed only within the context of the transaction into which it was delivered, unless explicitly agreed otherwise by the sender. Maybe even a Constitutional Amendment, to make more clear the privacy rights implicit in the Constitution, explicit in the 4th Amendment, but still not protected enough for adequate security in the modern age.
--
make install -not war
Quo usque tandem abutere, Nimbus, patientia nostra?
Socializing at a bar puts you at greater risk of physical harm. Socializing at a church puts you at greater risk of personal judgment. Socializing at a coffee shop puts you at greater risk of cardiac arrhythmia. Socializing at a restaurant puts you at greater risk of clogged arteries. Not socializing puts you at greater risk of dying alone.
Step into a huge movement. Don't Tread In Me.
So spammers and marketers and others are data mining social networking sites. Great, I think it is the duty of each of us to go create a fake site with a fake name and link to a few other people. Heck we can even get creative and talk about "favorite" products. Maybe I'll accidentally post the number of a local law firm claiming it is my home number :)
The phone book has my full name, address, and phone number. The kind of information MySpace asks for can be obtained by meeting me briefly in person and acting friendly. Is putting this information online really qualitatively different from the regular act of walking around and meeting people?
Step into a huge movement. Don't Tread In Me.
I think a great way to combat issues like this is to start teaching safe browsing in school. We are already teaching them how to use the computer and how to find information over the internet, but are they teaching them how to use the technology responsibly. When I learned how to use a computer in school, we learned what bugs and viruses were, but they weren't as widespread then, so there was no lesson on how you might get a virus, how to prevent getting that virus, and if you do get a virus, how do you repair your machine. This was also before spyware was understood as well as phishing and identity theft. We all saw the movie "The Net", but no one really thought that could happen to them, and could only be pulled off by some elite hacker out to get you, and only you.
We need to teach the kids that not everyone on the internet is your friend. Not everyone on the internet is who they say they are. You can protect yourself from malware by using safe browsing behavior (don't click OK at every message that pops up, smiley face add-ons are not so smiley). Never give out personal information on the internet unless you are absolutely positive that the person you are giving it to is in fact who they say they are, and there is a legitimate reason for it. This means no SSN, phone number, credit card/bank numbers, address, etc.
Like I said earlier, when I was in school, all of this was not really a concern, so I'm not sure if schools are actually teaching this kind of stuff.
"It's not whether you win or lose, it's how drunk you get." -- H. J. Simpson
Personally , I wouldn't mind that much , people think that is all a game , a virtual thing , an unreal world or the "Internet" that Tv News highlight that much with very ignorance , the same ignorance shared by people who do use computers for massive porn , chat for sex , for example , staying in community like paltalk , msn , absorbing those dirty ads , popups , gettin worms... gettin various damage on their "expensive pc monster bought at the mall" , signed by Dell or HP , and so on . Opposite , who knows that bit much is safe anyway and I can tell you that these last kind of people understood from a longtime that I'm trying to tell you now : It's no possible to protect people from their same ignorance , Who want discover things explore , study , ask for things , To know Is Power . So , let take noobs what they deserve , there's nothing to make in order to stop this .
How many social researchers salivate when they hear "Hi, I'm Chris Hanson with Dateline NBC".
The industry alone should be salivating, for all the pedo-rific jaw dropping action that goes on in a pedo bust.
Without myspace or any of these, what kind of pedos would we watch get busted on Friday night.
There's only so much Michael Jackson to go around.
If you'll excuse me, I just met a 19 (12) year old kid and am going to drive 300 miles away to meet them. (And yes, I always have protection, erotica, booze, and her favorite perfume with me, you know, just in case...)
.
[disclaimer: this is a joke, no cop calling please.]
Free childcare classifieds: www.carebrite.com
So...places where lots of social networking occurs are good places for social engineering?!
Next you'll be telling me that places with lots of water, fish food, and fish habitat are good places to go fishing!
Who is commissioning these studies? And why? Rick Remero?
The people who are really afraid of these sites are LARGE RECORD COOPERATIONS (the same folks who brought you the DCMA and DRM). These sites freak them out and they will use these stupid studies to spread FUD.
Get over it. Nothing to see here.
Comment removed based on user account deletion
Here is the scenerio I would like to see:
17 year old guy that looks 20-22, makes a profile that shows him as 22. You know, birthdates, posts about his hangout being a bar, comments about his job. That sort of thing. Figure out Datelines MO, and start picking up on their fake minor. Then when the plans are made to meet for sex, slip in something along the lines of "Yo, it's illegal for 22yo to sleep with minors, so I am 17, OK? We don't want anyone getting arrested now, right?". Then when he shows up, and it turns out to be Dateline, he has the entire Dateline crew arrested, as they solicited a known minor for sex. There would even be the logs to prove it.
Tell me that you wouldn't have a media circus with a headline like "Dateline crew arrested in underage sex scandle!"
I take a lot of pictures. A lot of pictures. As in, I've taken 12 gigabytes of photographs since March 2006. And every time I'm at a party or barbeque or Frosh Week or some audition, taking pictures as I'm wont to do, people always say the same thing. "You're going to put these pictures on Facebook, right?"
I don't know if its our age or our culture, but all the friends my age (admittedly, also university students) love posting and seeing photos of the latest goings-on. But that's just it. They're called social networking sites for a reason. It's not a news site like Slashdot, nor should it be implemented as one.
Please don't berate the photo-sharing features of Facebook. The UI is well designed, the implementation is good, and the feature is quite useful.
"Live as if you'll die tomorrow." Ridiculous. You could die later today.
Recently saw the show where Oprah hires a hacker to find the personal details of a userid at myspace and he did it in like 5 mins !
Chris ,
Php Programmers.