Slashdot Mirror
Sophos Slams Facebook Security In Open Letter
An anonymous reader writes "Security experts are calling on Facebook to implement a three-point plan to improve safety online. Sophos says it receives reports every day of crime and fraud on Facebook, and that victims are desperate for advice on how to clean up their profiles and undo the consequences. In an open letter to Facebook, the firm calls upon the social networking giant to adopt three principles: privacy by default (opt-in sharing), vetted app developers, and use of https whenever possible. 'Our question to Facebook is this — why wait until regulators force your hand on privacy? Act now for the greater good of all.'"
adopt three principles: privacy by default (opt-in sharing), vetted app developers, and use of https whenever possible
Their answer is very predictable: No, no and no.
If information does "leak" out of Facebook their precious company won't be worth the billions and billions they seem to think it is.
Answer: because that would interfere with our business model.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
Instead of telling another business what to do, and jumping on the ever popular Facebook bashing bandwagon, how about you fix your anti-virus software so it doesn't freeze, crash, block access to portable drives silently while it scans them, and leak memory like a sieve. While your at it no anti-virus is perfect so clean up your heuristics. This is nothing more than a shoddy publicity stunt.
I agree with 2 out of 3 of the points though. I think they could make a dog's breakfast out of forcing HTTPS use and block out too many users. Of course if they did it right with a clearly visible link to the HTTPS address it would work (though take a huge toll on their servers). But the other 2 Facebook likely won't do because it would cost them money and increase their responsibility - probably not the best of reasons to ignore security. Vetting app developers costs money and if something gets through probably increases their legal exposure. Making everything private by default decreases Facebook's value which is all about what information is shared. If you don't want something on Facebook, forget privacy options, just don't put it there in the first place. They'd sell your grandmother if they had the right motiviation.
These posts express my own personal views, not those of my employer
As a frequent user of Facebook, I find the numbers of rogue and bogus applications to be the most annoying aspect of the site. They need to start seriously vetting the developers and apps NOW. No more allowing apps to just be posted and start spreading SPAM from user-to-user.
I use Firefox, with the "NoScript" and "AdBlock" plugins, so 3'rd party sites have no access to ANY scripting functions. This allows me to visit these rogue app's sites and REPORT them, which I do frequently. I also warn my friends who fall victim to them, NOT to click the links posted on their pages. Many of them have thanked me for doing this. I have seen Facebook remove virus apps and links within minutes of my reporting them, which is "good", but not good enough!
It's high time that the people at Facebook took this much more seriously, and use PREVENTION rather than CURE after-the-fact.
Willie...
Most important. Ever since I signed up back in the day when university email address was necessary, Facebook has been steadily changing privacy guidelines and resetting sharing settings to be open. I end up having less and less stuff on my profile.
Easy answer: doing those things will hurt Facebook's bottom line. So, they won't until forced.
Clamping down on third party apps alone would make facebook more secure. Require https for apps, and ban predatory apps. There is an app that creates a status message that looks like a standard "hey look at this" link in your feed. When a friend clicks it, it not only brings them to the target link, it automatically publishes that same status on their wall without them having even installed the app. I wonder what else apps can do without explicit user permission? Really, given the increasing frequency of facebook status updates being admitted in court and used by potential employers - that could be quite enough to get you in a heap of trouble. So I say - keep up the pressure. Either Facebook will get the right idea, or perhaps an ethical congress person (heh, I know) will propose regulation, or perhaps a white hat hacker will expose just how nasty this kind of security hole can be - and the resulting nasty PR will force Facebook's hand. (Accidentally posted this when I wasn't logged in).
If I can have my World of Warcraft account secured with a two factor authentication, I should be able to do this for Facebook. Seriously.
The price is always right if someone else is paying.
. 'Our question to Facebook is this — why wait until regulators force your hand on privacy? Act now for the greater good of all.'"
Why lose all that oodles of money that they could make by selling access to the users' personal data to dataminer? Facebook is not a charity. It is there to make money. It has to make money at some blistering pace, even if it is sustainable for just a short duration. Long enough for the founders and sugar daddy venture capitalists to dump stock and realize the gains. Then... well, who cares what happens then.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Doesn't give a shit!
I still do not understand why people haven't figured this out yet.
"Security experts are calling on... ". Zap
Expert Experts are encouraging Security Experts to change their language from "calling on" to "asking". The Expert Experts believe that "calling on" is one way street and "asking" would open a "dialogue". This "dialogue" can help with "discussion" of a "three point plan", allowing possible evolution of the solution to a "two point plan", a "one point plan" or an "item of consideration".
The Expert Experts think that by "calling on" the Security Experts may be ignored. If any Expert is ignored it is often implied they are not Experts which is not a desirable outcome.
1. "User settings"
2. "Delete Account"
3. "Yes"
Science is all about firing a drunk pig out of a cannon just to see what happens.
It's one feature I wouldn't mind being opted-in to without my permission.
Unfortunately, since the time that I signed up back when you still had to select your university from a pull-down menu of just a few schools, they instead decided to opt me in for a few other "features":
1) Sharing my information via Beacon with trusted partners like Blockbuster, CBS, Verizon, Sony, and the New York Times (all of whom are known for the care they take in handling their customers and the privacy of their customers/sarcasm), despite the fact that I had previously opted-out of sharing my information with third parties.
2) Listing me on a page for every single item I had listed as a "favorite" or "interest", effectively making them publicly accessible information that could be crawled or seen by anyone, despite the fact that I had opted-out of sharing that information previously.
3) Allowing anyone to view a complete list of my friends, even if I don't know them or anyone else who knows them, despite the fact that I had opted to make my profile, which was previously the only method of accessing that information, accessible to "Friends Only".
4) And in what I sincerely hope is a bug but suspect is not, letting anyone at all see all of my pictures, despite the fact that I had my settings explicitly set to "Friends Only" for all of my picture settings.
On that last one, I was seriously peeved too, since one of my housemates (who I hadn't friended yet) was able to see all of my pics without a problem. I'm not sure if it was a bug or what, since it was completely contrary to my settings, but I didn't stick around to find out since it was well past strike three for Facebook at that point. Instead, I closed my account within the hour and haven't looked back.
It's one thing that they don't do enough to protect their users, but what really bugs me is that they trick their users about what security means in an attempt to get more info out of their users.
In recent months I've been getting messages from FB warning me that my account is not secure. When I look at the steps they want me to take they have nothing to do with making my account more secure and everything to do with extracting more personal info from me. I think that using people's concerns about security to trick them into giving more personal info is quite slimy.
First and foremost - if you don't like Facebook then don't use it. Nobody's twisting your arm to make you use it.
Secondly I don't think regulation would ever help. Companies like Facebook will always find a way to weasel out of it: "oh, it's too expensive" or "oh, we'll move to another state." The only way to force the required privacy changes through is to make the directors of these companies accessories to the crimes. If the directors are personally held accountable and required to pay fines, do jail time, etc., for the crimes committed through their portals using identity theft, stalking and so on then we'll start to see sweeping changes to how these businesses operate online.
This will obviously not happen (sharing off by default!? haha, good one!), and even Sophos probably knows that.
They're just coming forward because they want to get free advertising as a security company that cares for user privacy. That is all. Empty story here.
Beware: In C++, your friends can see your privates!
Funny how vetting devs is considered a good thing in this article, but when Apple does it with the App store, it's called "lock in".
Just the other day I got a "so and so has made you an administrator of x page" from FB (actual facebook message, not some fake thing).
I go to try and report it, and lo and behold there is no way to report it except by going to the page and clicking "report."
The FUCKING PROBLEM is that the page has HOSTILE JAVASCRIPT as part of the worm and simply navigating to it makes it impossible to back out unless you force-close (kill -9) the browser entirely.
Yes, Facebook has security problems, and they've insulated themselves pretty well from reporting them too.
Jerks.
--
BMO
Face to Face? Dead as a doornail. "The world has moved on..."
I think therefore I can't be ~TTNH
...90% of Sophos "news" feed from the last months consists in highlights of Facebook scams, warnings about "specially engineered" posts, and the likes. Maybe they are just trying to con FB into hiring them as their "Security Provider"?
Mostly harmless.
When you go to these links, they ask you for authorization to post to your stream. It does not happen automatically after clicking the link. These types of apps are also already banned, of course, but Facebook is a quite slow at moderation. They do need to do a bit of work on that.
We need a new metaphor for "criticize" than violence. "Rachel Maddow eviscerated Ron Paul!" "Ron Paul put Rachel Maddow in a head lock, then decaptitated her with a spork!"
Utilizing the synergization of benchmark e-solutions to pre-workaround action items!
Actually it's because most third party apps are served in iframes and forcing HTTPS causes mixed content warnings