Hit the Reset Button: A New Guide to Facebook Safety and Privacy

Facebook is now in the process of releasing dramatic updates to its ever-evolving privacy features. These updates contain some new tools to help secure your privacy and online identity. And if you haven’t reviewed your settings recently, now it the perfect time to do so.

How do  you know if the new features are available to you? Go to Account> Privacy Settings. If you see the settings above, you’re in.

F-Secure Labs Security Advisor Sean Sullivan walked me through the updates, identifying the most relevant changes for cautious users. Based on what we’ve found, here’s what you need to do now—if you haven’t already—to secure your Facebook account.

1. Secure your PC and password.
How to do it:
A. Update your system and security software. Our Health Check makes this easy.
B. Choose a password that can’t be guessed. Make it a password that you only use for this account and none of your “friends” will able to guess. Don’t choose a word in the dictionary or any word mentioned on your profile. Here’s system that our Labs recommend.

Updated Windows 7 or Mac OSX software along with updated security software will protect you from most threats in case you ever make a mistake online. I also recommend you back up your data in a remote location (off-site physical backup or online backup) for complete protection.

2. Go “Friends Only”.
How to do it:
A. Go to Account> Privacy Settings.
B. Under “Control Your Default Settings” click “Friends.”

Go with “Friends Only” because you can now choose how to share any post or picture with “Public”, the maximum audience, “Friends” or “Custom”. Custom includes options to select specific friends, “Friends of Friends” or “only me.” Or you can block specific people from each post. You can make this decision each time you post. So start it’s smart to start with the safest setting just in case you post something you shouldn’t have.

Also, you can now change the privacy setting of any old post or media you posted. This is a good new addition. However, certain things like your name, friends lists and the comments you make on Facebook pages will always be public.

You can decide how and who can find and contact you on Facebook in your Privacy settings by clicking “Edit Settings” for “How You Connect”.

3. Hit the “reset button” and turn all your past posts to “Friends Only”.
How to do it:
A. Go to Account> Privacy Settings>
B. Next to “Limit the Audience for Past Posts” click “Manage Past Post Visibility”.
C. In the pop-up, click “Limit Old Posts”.
D. In the next pop-up, click “Confirm”.

Why not? You can always change an old post to make it public again if necessary. Anything you share on Facebook can be reshared in some way by anyone who has access it. With this one step you’re saying I only want my friends who I trust to have access to everything I’ve done on Facebook. Facebook assumes you know your friends. That’s the official word in a recent official Guide to Facebook Security (PDF).

Of course, Facebook also profits from social games that flourish because people friend new people ravenously. So it’s a good idea to give your Friends List a quick scan and unfriend anyone you don’t know or trust—unless you’re a game player. Then you should know that Facebook appreciates your business but isn’t designed to protect your privacy

4. Turn on Profile Review to approve all posts and pictures tagged with your name before they’re posted on your wall.
How to do it:
A. Go to Account> Privacy Settings.
B. Next to “How Tags Work” click “Edit Settings”.
C. In the “How Tags Work” pop-up, click “Edit” next to “Profile Review”.
D. In the next pop-up, click “Turn on Profile Review”.

Anyone on Facebook can now tag you in a photo or a post. With Profile Review, you’ll be able to decide which photos and posts tagged with your name show up on your wall.

While you’re on the “How Tags Work” pop-up, you may also want to disable “Friends Can Check You Into Places”. This won’t stop someone from saying you’re at a bar on your lunch break, but it may prevent your friends from seeing such a fictional check in. If you don’t want Facebook to put you in its facial database to recognize you when you appear in your Friends pictures, click “Edit” next “Tag Suggestions” on the “How Tags Work” pop-up. Then select “Disable”.

5. Set your Account Security.
How to do it:
A. Go to Account> Account Settings>
B. On the left-hand column, click “Security”.
C. Click “Edit” next to the “Security Question”. Pick a question only you will be able to answer.
D. Click “Edit” next to “Secure Browsing”. Click the box next to “Browse Facebook on a secure connection (https) when possible” and then click Save Changes. You’re browsing will now be secured when it can be.
(Many apps and games are not yet updated for secure browsing. Using these may boot you out of Secure Browsing. But Facebook seems to put you back into secure browsing as soon as it can.)
E. For extra protection, click “Edit” next to Login Approvals. Then click the box next to “Require me to enter a security code each time an unrecognized computer or device tries to access my account” and click Save Changes. This will create a little hassle but could also prevent your account from being hacked.

These tools are the extra protection you need to greatly reduce the chances of your account being hacked. And if you do get hacked, an active secondary email account and a good security question will help you get it back.

6. Turn off Public Search
How to do it:
A. Go to Account> Privacy Settings>
B. Next to “Apps and Websites” click “Edit Settings”.
C. Next to “Public search”, click “Edit Settings”.
D. Make sure the box next to “Enable public search” is NOT checked.

Do you want your Facebook page to be the first thing to come up if an employer, an ex or your mom does a Google search of you? If your answer is yes, click that box. If not, limit the ability to find you within Facebook and Facebook apps.

7. Click with caution.
How to do it:
A. Think twice before you ever click the “Post” button.
B. Think thrice before you click on the links posted by friends.

Clicking on a bad link could expose you to malware or scams. This is when you need your updated software to protect you most. For extra protection, use our free ShareSafe App to share links with your Facebook friends. You’ll even earn points that can be used to win rewards.

8. Limit the information shared with Apps.
How to do it:
A. Go to Account> Privacy Settings>
B. Next to “Apps and Websites” click “Edit Settings”.
C. Next to “Apps you use”, click “Edit Settings”.
D. Click the “X” box to delete any app you aren’t using.
F. Go back to App settings, and click “Edit Settings” next to “How people bring your info to apps they use”. Uncheck every box and click Save Change.
E. For extra protection, turn off all applications until you need them. Do this by clicking “Turn off all platform apps” in the Apps, Games and Websites settings.
F. For even more protection, turn off “Instant Personalization” which automatically shares your public information with Facebook’s partner sites. Do this clicking Edit Settings next to “Instant personalization”. UNCHECK the box next to “Enable instant personalization on partner websites.”

When you’re dealing with apps, you’re dealing with third-party developers who you may not know or trust. The actual language Facebook uses to clarify how and when your information may be shared through apps and friends is difficult to decipher.

The more you limit the data you’re sharing, the more control over your identity you have. We say eliminate the unknowns; opt out of sharing until you have a reason to opt in. You should also know if you use an app, there’s a chance your friends could find see that. So keep that in mind every time you try out a new app.

BONUS TIP: Tell Facebook not to use your  image or name in ads.
How to do it:
A. Go to Account> Account Settings>
B. On the left-hand column, click “Facebook Ads”.
C. Click “Edit third party ad settings”.
D. Next to “If we allow this in the future, show my information to” select “No one.”
E. Click Save Changes.
F. Click “Facebook Ads” again and click on “Edit social ads setting”.
G. Next to “Pair my social actions with ads for” select “No one.”

Now check your work. See how other people see your profile.
How to do this:
A. Go to Profile.
B. In the upper right corner, click on View As…
C. View how specific friends or the “public” sees you.

A sign posted on a wall in Facebook headquarters says: “Move fast and break stuff.”

Facebook’s transition into secure/https browsing, is a good example of how Facebook improves privacy and security in a steady, if occasionally buggy, way.  As you explore these new features, you may notice, for instance, that Facebook still may use the word “Everyone” in one or two places, though they announced that they’re transitioning to the word “Public.” But the changes here are for the better.

These updates are, of course, not enough for some critics. As usual, you should expect some unforeseen consequences, as there nearly always are when 750 million active users have to reexamine how they use the largest social network ever created.

Your security depends on you and your friends knowing how Facebook works. Now that you know how to protect yourself, I hope you share this information with someone you care about.

Follow F-Secure on Facebook for more security and privacy tips.



More posts from this topic


A temporary profile picture but permanent app permissions

We are all sad about what’s happened in Paris last Friday. It’s said that the terrorist attacks have changed the world. That is no doubt true, and one aspect of that is how social media becomes more important in situations like this. Facebook has deployed two functions that help people deal with this kind of crisis. The Safety Check feature collects info about people in the area of a disaster, and if they are safe or not. This feature was initially created for natural disasters. Facebook received criticism for using it in Paris but not for the Beirut bombings a day earlier. It turned out that their explanation is quite good. Beirut made them think if the feature should be used for terror attacks as well, and they were ready to change the policy when Paris happened. The other feature lets you use a temporary profile picture with some appropriate overlay, the tricolor in this case. This is a nice and easy way to show sympathy. And it became popular very quickly, at least among my friends. The downside is however that it seemed so popular that those without a tricolor were sticking out. Some people started asking them why they aren’t supporting the victims in Paris? The whole thing has lost part of its meaning when it goes that far. We can’t know anymore who genuinely supports France and who changed the picture because of the social pressure. I changed my picture too. And it was interesting to see how the feature was implemented. The Facebook app for iOS 9 launched a wizard that let me make a picture with the tricolor overlay. Either by snapping a new selfie or using one of my previous profile pictures. I guess the latter is what most people want to do. But Facebook’s wizard requires permissions to use the camera and refuses to start until the user has given that permission. Even if you just want to modify an existing picture. Even more spooky. The wizard also asked for permission to use the microphone when I first run it. That is, needless to say, totally unnecessary when creating a profile picture. And Facebook has been accused of misusing audio data. It’s doubtful if they really do, but the only sure thing is that they don’t if you deny Facebook microphone access. But that was probably a temporary glitch, I was not able to reproduce the mic request when resetting everything and running the wizard again. Your new profile picture may be temporary, but any rights you grant the Facebook app are permanent. I’m not saying that this is a sinister plot to get more data about you, it may be just sloppy programming. But it is anyway an excellent reminder about how important the app permissions are. We should learn to become more critical when granting, or denying, rights like this. This is the case for any app, but especially Facebook as its whole business model is based on scooping up data about us users. Time for an app permission check. On your iOS device, go to Settings and Privacy. Here you can see the categories of info that an app can request. Go through them and think critically about if a certain app really needs its permissions to provide value to you. Check Facebook's camera and microphone permissions if you have used the temporary profile picture feature. And one last thing. Make it a habit to check the privacy settings now and then.   [caption id="attachment_8637" align="aligncenter" width="169"] This is how far you get unless you agree to grant Facebook camera access.[/caption]   [caption id="attachment_8638" align="aligncenter" width="169"] The Settings, Privacy page. Under each category you find the apps that have requested access, and can select if the request is granted or denied.[/caption]     Safe surfing, Micke   PS. The temporary profile picture function is BTW simpler in Facebook's web interface. You just see your current profile picture with the overlay. You can pan and zoom before saving. I like that approach much more.   Photo by Markus Nikander and iPhone screen captures    

November 16, 2015
facebook login

Using Facebook to log in – safe or not?

Open up your favorite web site and you can see what this is about right away. There are in many cases two options, an ordinary log-in and “Log in with Facebook”. Have you been using the Facebook option? It is quite convenient, isn’t it? I was talking to a journalist about privacy a while ago. One of the hints that ended up in the final story was that it isn’t necessary a good idea to link your other accounts to Facebook. And that raised questions. Some people have wondered why it is so, and pointed out that we at F-Secure also provide that option in our portal for F-Secure SAFE, MY SAFE. So let’s take a closer look. Is it good, bad or ugly? Here’s the important points: Facebook acts like an authentication service in this scenario. One single password opens the door to many services. This is indeed convenient and reduces the need to remember a lot of different passwords. But you should use different passwords on every service to reduce the damage if a password is leaked. That could happen for example in a phishing scam. Using Facebook’s log-in everywhere is putting all your eggs in the same basket. The worst thing you can do is to use the same user ID and password on all your sites, but *not* the Facebook function. A leak in any of them could give the attackers access to all your systems. Using the Facebook login instead is in this case a way to *improve* security. Facebook's servers are well secured, a leak from them is highly unlikely. It may reveal private info from Facebook to the other service unnecessarily. Most of us just click OK when Facebook asks for permission to give data to the other service, without thinking about what we really approve. Facebook will get yet another sensor to profile you. They will know that you use a certain service, when and how often you use it, and on what kind of device and where in the world you are when using it. Most people are on Facebook under their real name, but you may want to use other services more anonymously. If you don’t want it to be publicly known that you use a particular service, then you shouldn’t use your real-name Facebook account to log in. Remember that privacy on-line is not just about how much private data you reveal. It’s also very much about whom you reveal it to and how fragmented your digital footprint is. Preventing different services from consolidating your data improves your privacy. So should I use this feature at all? Maybe, it depends. There are some downsides, but it's a convenient way to log in, that can’t be denied. But first, the security-savvy approach is to instead use separate strong passwords on every site and a password manager. It’s a little bit of work when you set it up, but it is really the most secure approach. Don't use Facebook log-in for critical services. Those are sites containing sensitive information or where you make payments. They always deserve a strong unique password. But there's also a large number of sites that aren't that critical. Your on-line newspaper for example. If crooks get your Facebook password then your compromised newspaper account will be the smallest of your problems. Go ahead and use Facebook log-in for those if you find it convenient, but keep in mind the privacy concerns listed above. It's all about how picky you are about privacy. And don’t forget to review the permissions you have givens to apps and sites in Facebook. Go to Settings / Apps and you see the list of approved apps. Remove anything that sounds fishy, that you can’t remember approving or that you aren’t using frequently. Don’t be afraid to remove too much. The worst thing that can happen is that an app or site stops working and asks you to give it Facebook permissions again. Open all remaining apps and review what permissions they have. Think about what they do for you and if they really need all their permissions. Fix the permissions if needed. To wrap up. The Facebook log-in feature is not a security problem. Facebook's security system is solid and your security is not in jeopardy if you use it. But I still recommend separate passwords for the critical sites. The question marks are on the privacy front instead. Linking sites together contributes to forming a more comprehensive digital footprint. It's up to you to decide how worried you are about it. With this info you should be able to make an educated decision about where Facebook log-in can and can't be used.   [caption id="attachment_8629" align="aligncenter" width="266"] Jamendo's permissions in Facebook. This is the basic permissions most well-behaving apps/sites ask for. If the site asks for more, consider carefully if it really is needed.[/caption]   Safe surfing, Micke     Images by C_osett and Facebook screen capture

November 12, 2015

Are you using Facebook at work? (Poll)

I’m sure you have run into it if you work at a company with an organized IT function. They provide you with a computer, but they control it and set restrictions on what you can do with it. This is justified. Keeping the systems patched and updated is necessary to maintain security. Not to talk about maintenance of the anti-malware. But security is not the only driver for controlling the computers. Productivity is another. The web is usually wide open and employees can surf wherever they like. Entertainment, social media, news, hobbies, work-related issues, they are all there in the same web. Trying to limit web access to just work-related content is a really hard task. Practically impossible in most cases. And on top of that, you can always pull out your smartphone, if the mean IT-folks have created nasty restrictions on the employer-owned device. Employers’ worries about security and productivity are demonstrated in a Bloomberg article. It’s a bit dated already, but probably still quite accurate. The list of banned apps can be divided in three groups. Cloud services makes it easy to share company secrets. Entertainment is time-consuming and addictive. And finally Facebook representing social media. Banning Facebook is interesting. Social media has quickly grown to be one of our most commonly used communication platforms. Is it really fair to shut this off for the whole workday? But Facebook can on the other hand be very addictive. I’m sure there are employees who spend far too much time there. But the question is if an effective ban of Facebook really would improve productivity? No-one can work 8h flat out without any breaks. Personally I feel that micro-breaks, like checking Facebook, helps me stay focused and get the work done. So let’s see what you think. What’s your relation to Facebook at work time?   [polldaddy poll=9172266]   Safe surfing, Micke   Photo by momo  

November 10, 2015