Facebook application security

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

Pd - 01 May 2008 06:13 GMT

Although I have a Facebook account, there's very little personal
information on there, partly because I've always felt pretty uneasy
about Facebook applications, especially the first line that says "Allow
this application to access all of my personal details"?

I've wondered what Facebook does to make sure that the applications that
are available haven't been written to harvest information for identity
theft.

It turns out the answer is very little.

<http://news.bbc.co.uk/1/hi/programmes/click_online/7375772.stm>

Essentially the story is that the BBC created a Facebook application to
send personal details to an external email address. The application can
not only extract details of people who install the application, but also
the details of any friends of those people.

I'm a bit surprised there hasn't already been a big ID theft scam
discovered based on Facebook info skimming.

Facebook's response to the BBC Click article says basically that
naughtiness is not allowed, and any applications found being naughty are
either asked to comply, or removed. In other words, if an application is
found to be harvesting users' information they'll take action - closing
the barn door after the horse has bolted. If you find out you've had
your identity stolen using information from Facebook, you are encouraged
to tell Facebook:

"When a user adds an application, they agree to the Facebook platform
Application Terms of Use, which allows the developer to make requests
for access to the information in the user's profile, excluding contact
information.
Users are strongly encouraged to report any suspected misuse of
information to Facebook.

We have sophisticated technology and a dedicated team to address
inappropriate activity by applications. Access by applications to
Facebook user data is strictly regulated and if we find that an
application is in violation of our terms and policies, we take
appropriate action to bring it into compliance or remove it entirely.

Facebook is committed to user safety and security and, to that end, its
Terms of Service for developers explicitly state that applications may
not use adware, spyware, or other deceptive techniques.

It is not just the policies that dissuade misuse, it is the fact that
there is accountability for such misuse. Facebook has an entire
Investigations Team that watches the site and removes content and
third-party applications that violate Facebook's Terms of Use.

Facebook users also police the site and use the "report" button if they
come across violators of our Terms of Use."

I wonder if Facebook would comply with the UK Data Protection
regulations?

Signature

Reply to this Message

Peter Ceresole - 01 May 2008 11:24 GMT

> Although I have a Facebook account, there's very little personal
> information on there, partly because I've always felt pretty uneasy
> about Facebook applications, especially the first line that says "Allow
> this application to access all of my personal details"?

Well quite apart from that [1], when I applied for an account I was so
disgusted by the sheer dusty crumminess of what was on there that I
cancelled my account within an hour.

I realise that Facebook might be very useful for some people and
purposes, but not for me. I suppose it's a limitation in *me*. Every
year I become more like my dad (one of the aspects of ageing that
doesn't worry me as he was a good chap). So maybe I lack the requisite
*youth*. But to me it had all the fascination of spending a day in the
booking hall of Gloucester Road underground station.

Mornington Crescent...

[1] It seems absolutely clear to me that social networking sites must be
the Hampstead Heaths of the Net. So long as people are aware that they
are in danger of losing their pants when they go there, it's okay. In
fact that may well be the hwole idea. The danger is when they feel safe.

Signature

Peter

Reply to this Message

eddedmondson@hotmail.com - 01 May 2008 12:09 GMT

What personal details are these? I mean, my name's up there, my
workplace, and my address. But these are all to some extent or another
bits of public information anyway. My bank details aren't
there... What are people putting up there that allows identity theft,
and why are some services or whatever using what could be public
information as some kind of authentication?

All strikes me as a big fuss over nothing.*

Signature

Edd
*OK, there's issues of embarrassing data leaking out that I might have
up there - silly photos I'd let my friends see or something. But
that's not the issue they're going on about

Reply to this Message

Pd - 01 May 2008 13:22 GMT

> > Although I have a Facebook account, there's very little personal
> > information on there, partly because I've always felt pretty uneasy
[quoted text clipped - 4 lines]
> workplace, and my address. But these are all to some extent or another
> bits of public information anyway.

People are putting up all kinds of personal information. Pet's names,
schools, favourite artists etc. All classic noob sources of passwords.
Knowing a whole bunch of background information about someone makes it
much easier to get further information. According to a report in the
Guardian two years ago, about 100,000 people in Britain are victims of
identity theft every year, whether it be as simple as fraudulent use of
credit card details, through loans being taken out in their name, to
fake passports.

I've had problems getting a mortgage in the past because some bloke with
my name declared himself bankrupt, and I had to get notarised proof that
he wasn't me. It seems like a big fuss about nothing until it affects
you personally.

Signature

Reply to this Message

Mac Forum / Country Specific / UK Mac Group / May 2008

Facebook application security