Facebook Security Awareness (White Paper)

FACEBOOK
Facebook is a social networking service launched in February 2004, owned and operated by Facebook,
Inc. As of September 2012, Facebook has over one billion active users, more than half of whom use
Facebook on a mobile device. Users must register before using the site, after which they may create
a personal profile, add other users as friends, and exchange messages, including automatic notifications
when they update their profile. While Facebook is a useful tool it is also has security risks the two biggest
are showing to much information to others and letting others see what you are doing on other sites.
Account Creation



On the sign up page Facebook will ask for your name first and last, your email, password, your
birthday, and your gender. (Fig.1)
This is a concern because all this information with the exception of the password will be in your
profile available to anyone who has access to your Facebook page.
o This means a person can retrieve the information from Facebook and start the process of
identity theft.
o However a user can set the birthday as not viewable to anyone in the security settings
more on this latter.
The other problem is that it is all too easy for someone to put false information in and appear to
be somebody else. For instance a 35 year old man pretending to be a 16 year old girl can we say
pedophile?
Figure 1 Facebook signup page


The next page that comes up is the security page were you have to enter the letters numbers in the
box as they are displayed above. (Fig.2)
This is called captcha the letters and numbers cannot be read by a computer only by humans.
Enter the letters and numbers and click sign up.
Figure 2 Captcha security page




The next screen to come up will be the email friend’s screen. (Fig. 3)
This screen asks you to put in your email address from which Facebook will pull all your contacts
out and send them an invite.
o This is not a good idea if you have a mixed contacts list one that has both professional
and personal contacts.
o It is also not a good idea as it may make a bad impression on people.
You have the option of skipping this if you wish.
After this the process of setting up the creating the account will be done.
Figure 3 E-Mail Friend's Screen
What others can see about me and what I can do about it.




Once the account has been created there are some settings that can be used to keep personal
information out of the wrong hands and restrict who can and cannot see your Facebook page.
The first place to go is the edit profile page.
o To get there click the home tab at the upper right of the page and then click edit profile
under your name on the left side of the screen.
The screen that comes up is the edit profile screen. (Fig. 4)
On this screen you can put in general information like the city you live in and the school you go
to.
o It is best to be as general about this information as possible makes more difficult for some
to steal your identity or find you in the real world.
o The other thing you can do on this page is set your birthday’s privacy level.
Figure 4 Edit Profile Screen

In the basic info box click edit and a pop window will appear. (Fig. 5)
Figure 5 Birthday Privacy level




Half way down the window will be a section titled birthday in that section is a drop menu with
choices for how much of the birthday will be shown
o everything
o just month and day
o nothing.
o The best setting is nothing because birthdays are a key component of identity theft.
The next screen to go to is the privacy settings and tools screen. (Fig. 6)
o To get there click the cog symbol in upper right hand part of the screen and choose
privacy settings.
This screen allows the user to set who cannot see the users stuff.
o Friends
o public
o custom
o Best policy is just friends.
The second thing that can be done is setting who can look you up the settings are the same as
above.
o Again friends is the best setting.
Figure 6 Privacy settings and tools screen

The next screen to go to is the security screen to go their click on security in the menu on the left
hand side of the screen. (Fig. 7)
o This screen allows the user to set things like
o secure browsing within Facebook
o turn on login notifications so you know when your account is logged into,
o login approvals which use a code on login to verify the person logging in owns the
account
o create passwords for apps.
o see the location were the account is currently logged in from
o any devices recognized by Facebook.
Figure 7 Security screen


The last screen that the user should go to is the blocking screen. (Fig. 8)
o As before go to the menu on the left hand side of the screen and click blocking
This screen allows users
o to block other users from being their friend,
o block app invites from a user
o block event invites from a user
o block apps from gathering information about you.
o These are to be set according to the user’s need.
Figure 8 Blocking screen
Logging Into Other Sites with Facebook
One of the features of Facebook is the ability to log into other sites with a user’s Facebook credentials this
is called logging on with Facebook.


What happens is when a user logs on with Facebook everything the user does on that site is
shared on their Facebook page.
Hulu will be used as an example.
o On the log in page the user is given a choice.
o Log in with a Hulu Account or log in with Facebook. (Fig. 9)
Figure 9 Login page


Logging in with Facebook is not a good idea it allows others to know what you are doing on a
secondary website.
o If you wish to log in with Facebook then log in and go into the account settings.
o Within the account settings or privacy settings there will be a screen that will allow you
to turn off sharing or customize it. (Fig. 10)
o The best recommendation is to turn of sharing that way the user may do what they want
without observers.
Just like the personal information covered in the last section this information can be used to win a
user’s trust and lure them in.
Figure 10 Settings Page
The best recommendation is to turn of sharing that way the user may do what they want without
observers. Just like the personal information covered in the last section this information can be used win a
user’s trust and lure them in.