I get a lot of pleasure out of Facebook. While I’m happy to use it and even be advertised at, this free application needs to be watched. A lot of security and privacy folks have quit Facebook for their security and privacy lapses. The lapses will continue. As someone who will use Facebook anyway, I wanted to make it as secure and private as possible. So, for this blog post, I made note of the things I was surprised by. The things listed here are really only pointers or teasers for the Exhaustive Guide (updated September of 2011).
That guide goes deep and shows some new features, some of which allow for more privacy. For example,
- Make sublists of friends so you can control which groups of friends see which posts.
- Keep an eye on those Apps. With Application Access Logs, you can see a history of which Apps requested which personal information from you.
- Test your security settings by viewing your Facebook page as it would be seen by another user. To do this, go to privacy settings –> edit profile –> view as. Now type someone’s name in the box and you will see if that person sees only what you want them to see.
There was a good set of instructions going around more than a year ago. I followed those recommendations and like many people, I just assumed those would stick. Well, enough has changed in the account and privacy settings that that old “lockdown” is no longer complete. So, the first step to locking down Facebook is : Pay attention to changes. The graphic at the end of this article shows the changes over time to default Facebook privacy settings and they trend towards more exposure, not less. A good source of Facebook info is the ZDNet friending Facebook blog.
Here are notable facts from the article:
- Especially if you use Facebook with public wi-fi, you need to force HTTPS. It took a long time, much longer than it should have, but FB now allows you to use exclusively HTTPS. This means that your communication between your browser and Facebook will be scrambled so that nobody can read your traffic or hijack your session. HTTPS is not on by default, though. You have to turn it on. If you have any doubt about the need for this, watch this video.
- Customization for Apps has been upgraded. Facebook apps are things like Scrabble, Wordtwist, Mob wars, and whatever else you are adding into Facebook . These third-party applications are often poorly and insecurely written and can even be malicious. Note that the list of apps you see on your front page when you click “apps” is much shorter than the actual list of apps that are installed and silently monitoring your life. To view the full list go to Privacy Settings –> Apps –> Edit Settings. I was surprised to see several apps that I had forgotten about, silently working.
- I missed this in my first pass at checking account settings, but Facebook can also use your “Like” vote about a product or business as endorsement when they show an ad for that product to your friends. You can turn this off Account Settings –> Facebook Ads –> Edit Social Ads Settings.
Two things I would add to that guide:
- If you haven’t changed your password recently (or ever), do that now. Breaches in the past year make it somewhat likely that your password has leaked out somewhere.
- This might be more paranoid than you wanna be, but photographs uploaded to Facebook may leak personal information. This information may include the make and model of your camera, time of day and location. If you do not want this information known, consider scrubbing the photograph’s exif data before posting
This is from Facebook itself (link):
Applications your friends use can also access information from your profile
Not much has been written this, but your friends’ poor security choices could affect you. It happens when they post on your wall advertising a funny video that is really a virus.









