Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

8/19/2011
02:41 PM
Connect Directly
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Facebook Offers Security Guide

Faceboook tries to explain the many security issues that have arisen for users of social networking and give tips for keeping accounts secure.

Top 15 Facebook Apps For Business
(click image for larger view)
Slideshow: Top 15 Facebook Apps For Business
Facebook on Thursday began promoting a guide designed to help users participate in its social network with less risk, a need that has grown as the service has.

Co-authored by Linda McCarthy, former senior director of Internet safety at Symantec, Keith Watson, a security research engineer at Purdue University, and Denise Weldon-Siviy, a teacher and editor, the Guide to Facebook Security offers both well-worn security advice and surprising recommendations.

Though some Facebook users question the wisdom of presenting the guide as a downloadable PDF--a common vector for malware--those averse to PDFs are probably sufficiently sensitized to Internet security issues that they wouldn't benefit from the advice. Those unaware of the potential pitfalls of file downloads, however, will almost certainly find something of value in the 14-page document.

The guide opens with the most common online security recommendation in recent years: choose a good password, one that's at least eight characters long, contains one or more numbers, and at least one special character. It goes on to reiterate other conventional wisdom, like not reusing your Facebook password on other sites, not sharing it with friends, and changing it regularly.

You've probably heard this before. But many Facebook users probably haven't or have ignored this advice previously, which is why it bears repeating.

What might not be expected is advice like making sure you log out of Facebook. "Logging out of Facebook when you're not using it is a simple and effective way to protect your account," the guide states. "Many people think that if they close the webpage or exit the browser that also logs them out of Facebook. It doesn't. The next person who goes to Facebook.com on that computer will find themselves [sic] already logged in--to your account."

Facebook has a vested interest in keeping users logged in: It could log users out after a period of inactivity, the way online banking sites do. But the company wants users to remain logged in when they visit other websites, particularly sites that have integrated Facebook APIs, like Social Plugins. That's because social features provided by Facebook won't load on third-party sites when a Facebook user visits but isn't logged in to Facebook.

The authors of the guide appear to be aware of this tension, because they qualify their advice. The guide specifies that you should log out of Facebook when using the service away from home. Even so, the guide also advises logging out of Facebook when a home computer is shared. Those serious about security might consider logging out at the conclusion of a Facebook session, even if that de-socializes third-party websites.

The guide also advises Facebook users to only friend people they know. Anyone with more than several hundred Facebook "friends" has probably violated this suggestion many times over.

This is particularly important because Facebook operates under the assumption that you know your friends. When attempting to access Facebook from abroad, Facebook will attempt to verify your identity by asking you to identify your friends in tagged pictures.

The security guide also provides valuable recommendations about things like how to obtain a one-time password--text "otp" to 32665 (FBOOK) from a phone that you've registered with Facebook--and how "Like" buttons can be trapped for clickjacking attacks.

If you're the least bit unsure about how to navigate the world of social networking securely, take a look at the Guide to Facebook Security.

Attend Enterprise 2.0 Santa Clara, Nov. 14-17, 2011, and learn how to drive business value with collaboration, with an emphasis on how real customers are using social software to enable more productive workforces and to be more responsive and engaged with customers and business partners. Register today and save 30% off conference passes, or get a free expo pass with priority code CPHCES02. Find out more and register.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Google's new See No Evil policy......
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31664
PUBLISHED: 2021-06-18
RIOT-OS 2021.01 before commit 44741ff99f7a71df45420635b238b9c22093647a contains a buffer overflow which could allow attackers to obtain sensitive information.
CVE-2021-33185
PUBLISHED: 2021-06-18
SerenityOS contains a buffer overflow in the set_range test in TestBitmap which could allow attackers to obtain sensitive information.
CVE-2021-33186
PUBLISHED: 2021-06-18
SerenityOS in test-crypto.cpp contains a stack buffer overflow which could allow attackers to obtain sensitive information.
CVE-2021-31272
PUBLISHED: 2021-06-18
SerenityOS before commit 3844e8569689dd476064a0759d704bc64fb3ca2c contains a directory traversal vulnerability in tar/unzip that may lead to command execution or privilege escalation.
CVE-2021-31660
PUBLISHED: 2021-06-18
RIOT-OS 2021.01 before commit 85da504d2dc30188b89f44c3276fc5a25b31251f contains a buffer overflow which could allow attackers to obtain sensitive information.