Disturbing Stats About Facebook Users & Security

 

There's a screenshot that's been sitting on my desktop for a rather long time now, and it's as scary as it is interesting. Facebook recently conducted a poll which showed up on the homepage newsfeed, and asked Facebook members just how exactly did they think Facebook's "friend finder" worked when it prompted them for their email address & password in order to get a list of contacts. The numbers pretty much speak for themselves, here's what they looked like near the end of the campaign: Now ignore the dark blue bar: it's a red herring and doesn't contain any interesting info. The real juicy bit is the "Yes" option, and its 20% response. 20% of Facebook's 80 Million active users (give or take) believe that the passwords for their email addresses are being stored when they use the Friend Finder…. and that doesn't bother them in the least. That's sixteen million people who don't give a damn about their privacy, the contents of their email, or who has control of their entire online personas. This is a subject that's been chewed half to death already countless times by people far more in the know than myself; Jeff Atwood's excellent article on the topic covers the dangers of sites asking for users' email addresses & passwords, and – far more importantly – presents several more secure alternatives for web application developers looking to expand their social networks. To put things in perspective, take a look at this downright horrifying tale on ReadWriteWeb about software that prompted users for their email addresses & passwords, then proceeded to save them for malicious use… then realize that 16 million Facebook users out there don't care if this happens to them. Think about all the private, sensitive, confidential information available on your email account and just how truly terrible it would be for that info to fall in the wrong hands. Of course all this begs the question: who's to blame for this bout of end-user stupidity (for lack of a more politically-correct term)? Is it naïveté/trust in the goodwill of others that gets users to give out such sensitive data to people (Facebook has 500 employees!) they don't know from Adam? Or is it that they just don't get how dangerous it can be (see the ReadWriteWeb article for proof)? Or is it, maybe, that they've simply gotten accustomed to being asked for their email address and corresponding password by "trusted" sites they love to visit, too caught up in the "gather as many friends as you can" game to give a second thought to identity theft and fraud? Personally, I can recall a time when most "normal people" I know would refuse flat-out to share such sensitive data with a site (phishing, tech support, etc. obviously excluded); but in the wake of "Web 2.0" it's become so normal to ask for email addresses and passwords that no one ever gives it a second thought. And it's not just Facebook. To be totally frank, even if Facebook were to store end users' passwords in their database, the access to that info would probably be very highly guarded… but when every new social network on the block is suddenly doing the same thing – you can get a good picture of just how easy it would be to steal users' passwords. MQ's 3 Steps for World Domination Send out an email purporting to be from "the hottest new social network around" informing the recipient that their "friends" want them to join: "Click here to show Peter you're a real friend!" Get the user to register a new account – make the procedure as pain-free and simple as possible… and right then and there on the registration page ask for the user's email address and password so as to "make it easy to tell all your friends you care and get popular really fast…" Profit. As soon as it's OK for one person to do it, it'll be OK for everyone to… and then we'll be in too deep to do anything about it. So why does Facebook - after polling their end users and seeing just how dire the situation is - continue to use the same flawed mechanism of harvesting email addresses… especially when better, safer alternatives exist?

View article...