{"id":627,"date":"2008-08-13T16:00:58","date_gmt":"2008-08-13T16:00:58","guid":{"rendered":"http:\/\/neosmart.net\/blog\/2008\/disturbing-stats-about-facebook-users-amp-security\/"},"modified":"2013-08-26T18:18:24","modified_gmt":"2013-08-26T23:18:24","slug":"disturbing-stats-about-facebook-users-and-security","status":"publish","type":"post","link":"https:\/\/neosmart.net\/blog\/disturbing-stats-about-facebook-users-and-security\/","title":{"rendered":"Disturbing Stats About Facebook Users &amp; Security"},"content":{"rendered":"<p>There\u2019s a screenshot that\u2019s been sitting on my desktop for a rather long time now, and it\u2019s as scary as it is interesting.<\/p>\n<p>Facebook recently conducted a poll which showed up on the homepage newsfeed, and asked Facebook members just how exactly did they think Facebook\u2019s \u201cfriend finder\u201d worked when it prompted them for their email address &amp; password in order to get a list of contacts. The numbers pretty much speak for themselves, here\u2019s what they looked like near the end of the campaign:<\/p>\n<p><img class=\"colorbox-627\"  decoding=\"async\" title=\"Facebook Poll\" src=\"\/blog\/wp-content\/uploads\/facebookpoll.png\" border=\"0\" alt=\"Facebook Poll\" \/><\/p>\n<p>Now ignore the dark blue bar: it\u2019s a red herring and doesn\u2019t contain any interesting info. The real juicy bit is the \u201cYes\u201d option, and its 20% response.<\/p>\n<p><!--more--><\/p>\n<p><strong>20% of Facebook\u2019s 80 Million active users (give or take) believe that the passwords for their email addresses are being stored when they use the Friend Finder\u2026. and that doesn\u2019t bother them in the least.<\/strong> That\u2019s <em>sixteen million people<\/em> who don&#8217;t give a damn about their privacy, the contents of their email, or who has control of their entire online personas.<\/p>\n<p>This is a subject that&#8217;s been chewed <span style=\"text-decoration: line-through;\">half<\/span> to death already countless times by people far more in the know than myself; Jeff Atwood\u2019s <a href=\"http:\/\/www.codinghorror.com\/blog\/2008\/06\/please-give-us-your-email-password.html\" rel=\"follow\">excellent article on the topic<\/a> covers the dangers of sites asking for users\u2019 email addresses &amp; passwords, and \u2013 far more importantly \u2013 presents several more secure alternatives for web application developers looking to expand their social networks.<\/p>\n<p>To put things in perspective, take a look at this <a href=\"http:\/\/readwrite.com\/2008\/03\/08\/your_email_password_a_true_hor\" rel=\"follow\">downright horrifying tale<\/a> on ReadWriteWeb about software that prompted users for their email addresses &amp; passwords, then proceeded to save them for malicious use&#8230; then realize that 16 million Facebook users out there don\u2019t care if this happens to them. Think about all the private, sensitive, confidential information available on your email account and just how truly terrible it would be for that info to fall in the wrong hands.<\/p>\n<p>Of course all this begs the question: who\u2019s to blame for this bout of end-user stupidity (for lack of a more politically-correct term)? Is it na\u00efvet\u00e9\/trust in the goodwill of others that gets users to give out such sensitive data to people (Facebook has <em>500<\/em> employees!) they don\u2019t know from Adam? Or is it that they just don\u2019t get how dangerous it can be (see <a href=\"http:\/\/readwrite.com\/2008\/03\/08\/your_email_password_a_true_hor\" rel=\"follow\">the ReadWriteWeb article<\/a> for proof)? Or is it, maybe, that they\u2019ve simply gotten accustomed to being asked for their email address and corresponding password by \u201ctrusted\u201d sites they love to visit, too caught up in the \u201cgather as many friends as you can\u201d game to give a second thought to identity theft and fraud?<\/p>\n<p>Personally, I can recall a time when most \u201cnormal people\u201d I know would refuse flat-out to share such sensitive data with a site (phishing, tech support, etc. obviously excluded); but in the wake of \u201cWeb 2.0\u201d it\u2019s become so <em>normal<\/em> to ask for email addresses and passwords that no one ever gives it a second thought.<\/p>\n<p>And it\u2019s not just Facebook. To be totally frank, even <em>if<\/em> Facebook were to store end users\u2019 passwords in their database, the access to that info would probably be very highly guarded\u2026 but when every new social network on the block is suddenly doing the same thing \u2013 you can get a good picture of just how easy it would be to steal users\u2019 passwords.<\/p>\n<p><strong>MQ\u2019s 3 Steps for World Domination<\/strong><\/p>\n<ol>\n<li>Send out an email purporting to be from \u201cthe hottest new social network around\u201d informing the recipient that their \u201cfriends\u201d want them to join: \u201cClick here to show Peter you\u2019re a real friend!\u201d<\/li>\n<li>Get the user to register a new account \u2013 make the procedure as pain-free and simple as possible\u2026 and right then and there on the registration page ask for the user\u2019s email address <em>and password<\/em> so as to \u201cmake it easy to tell all your friends you care and get popular really fast&#8230;\u201d<\/li>\n<li>Profit.<\/li>\n<\/ol>\n<p>As soon as it&#8217;s OK for one person to do it, it&#8217;ll be OK for everyone to&#8230; and then we&#8217;ll be in too deep to do anything about it.<\/p>\n<p><strong>So why does Facebook &#8211; after polling their end users and seeing just how dire the situation is &#8211; continue to use the same flawed mechanism of harvesting email addresses&#8230; especially when better, safer alternatives exist?<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"<p>There\u2019s a screenshot that\u2019s been sitting on my desktop for a rather long time now, and it\u2019s as scary as it is interesting. Facebook recently conducted a poll which showed up on the homepage newsfeed, and asked Facebook members just &hellip; <a href=\"https:\/\/neosmart.net\/blog\/disturbing-stats-about-facebook-users-and-security\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":505,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[320,673,117,674,17,12],"class_list":["post-627","post","type-post","status-publish","format-standard","hentry","category-software","tag-facebook","tag-oauth","tag-passwords","tag-phishing","tag-privacy","tag-security"],"aioseo_notices":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/p4xDa-a7","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/neosmart.net\/blog\/wp-json\/wp\/v2\/posts\/627","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/neosmart.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/neosmart.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/neosmart.net\/blog\/wp-json\/wp\/v2\/users\/505"}],"replies":[{"embeddable":true,"href":"https:\/\/neosmart.net\/blog\/wp-json\/wp\/v2\/comments?post=627"}],"version-history":[{"count":3,"href":"https:\/\/neosmart.net\/blog\/wp-json\/wp\/v2\/posts\/627\/revisions"}],"predecessor-version":[{"id":2546,"href":"https:\/\/neosmart.net\/blog\/wp-json\/wp\/v2\/posts\/627\/revisions\/2546"}],"wp:attachment":[{"href":"https:\/\/neosmart.net\/blog\/wp-json\/wp\/v2\/media?parent=627"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/neosmart.net\/blog\/wp-json\/wp\/v2\/categories?post=627"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/neosmart.net\/blog\/wp-json\/wp\/v2\/tags?post=627"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}