How to protect your private information from Facebook’s ‘creepy’ new open graph search

310670770_5f30fb24d0Are you sharing your telephone number on Facebook?

You might be and not even realize it.

A few months ago I signed up for Facebook’s Login Approvals, which required my mobile number. Instantly my number was added and set at my default setting.

If my general privacy setting were “Public”, my number could be one of the 2.5 million phone numbers that Brandon Copley recently harvested from Facebook using the site’s new Open Graph Search.

The app developer from Texas admits that users can use privacy settings to hide their number but still believes this is a violation of users’ trust.

“Facebook is denying its users the right to privacy by allowing our phone numbers to be publicly searchable as the default setting,” Copley told TechCrunch. “This means that anyone with my number knows my Facebook contact information.  I may have not told my future employer about my Facebook account, but if I called them on my cell phone they can now know how to find me on Facebook.”

To make sure your phone number isn’t public, go to your profile and click on “Update Info”. Click “Edit” next to your “Contact Information” then click on the audience icon and select the level of sharing you want. I chose “Only Me”.This isn’t the only privacy surprise you should expect as Facebook’s Open Graph Search begins rolling out to the site’s one billion users

The simplest way to make sure you’re only sharing what you want to share is to use our new Safe Profile Beta app, which scans your profile and lets you know how much you’re sharing and how to lock down your profile. But keep reading for more information about the search and how to prepare yourself.

Open Graph Search will definitely change the way people look at Facebook. You can sign up for the waiting list here: http://www.facebook.com/about/graphsearch

Your friends and their friends will be able to search your information in ways you may not expect. And this tool will likely become the “Google” of social—meaning people will go to it first to discover the people based on interests and location, which could get a bit “creepy.”

Some suggest this tool will make it easier for criminals to find information for phishing attacks or repressive governments to crack down on dissidents. You can see some examples of how married people who “like” prostitutes and government employees who “like” racism here: http://actualfacebookgraphsearches.tumblr.com/

However, the good news is that it’s restricted by your privacy settings most of your friends use Facebook pretty sanely, right?

“90% of users get the basics right and the other 10% are hopeless,” F-Secure Security Advisor Sean Sullivan told me. “When the 90% meets the 10%, de-friend the boneheads. Because soon they will reflect on you.”

Since you will not be able to opt out of Open Graph Search, you might want to take a few more steps to make sure you don’t end up on the bad end of a disturbing search made by a friend, family member or potential employer.

Here’s what to do now:

(If you’re one of the 90% of the Facebook users who gets how to use the site, you can skip to step three for tips that relate specifically to Graph Search.)

1. First of all, never post anything you wouldn’t want to end in your mom’s newsfeed.
This will save you from most embarrassment. This means, no pictures, videos or status updates you wouldn’t want to see on the cover of your hometown newspaper. If you do this, you’ll avoid most—but not all trouble that could result from being on Facebook or in its search.

2. Check your privacy settings and unfriend anyone who doesn’t seem to use the site responsibly
You can get fancy and restrict certain things to certain people, but Facebook’s basic privacy settings are “public” or “friends.” We recommend friends, unless you want to open your profile to end up in the search results of anyone in the world.

Find the lock near the upper right hand corner, click on it and select “See more settings” at the bottom of the menu that pops up.

Change every option for “Who can see my stuff?” and “Who can look me up?” pick “friends”.

3. Scrub you history
You can (and should) limit all of your old posts to just your friends. Once you do this, you cannot undo it. But you can go back and adjust each posts individually.

Click at the top right of any Facebook page and select Privacy Settings Find “Limit the audience for posts I’ve shared with friends of friends or Public?” and click Limit Past Posts. Click ”Limit Old Posts”.

4. Check your likes!
This is where Graph search gets “creepy.” Let’s say you liked a band three years ago or your competitor at work or a boy band as joke. Graph  Search doesn’t get the joke. What you’ve liked on Facebook is now much more important. And just as you unfriend anyone who worries, go through your likes and unlike any page you don’t want to be associated with. Unfortunately you need to do this page by page.

Go to your profile, click on “Likes.”

They’re organized chronically, so go back in time and unlike away.

5. Turn on “tag review” and take control of your wall.
The most annoying thing about Facebook is that people can tag you in photos you don’t want to be associated with. You can turn on “tag review” and prevent the photos from showing up to your friends but the tag will still be on the photo unless you “report/remove tag.”

Here’s how to turn on “tag review” so photos you don’t approve don’t show up on your profile.

Click on the wheel in the right-hand corner, click on your privacy settings and then click on Timeline and Tagging on the left menu.

Most people want to allow friends to post on your wall but if protecting your images is your priority, you may want to make it available only for you. Either way, it’s a good idea to select “friends” for “Who can see what others post on your timeline?” This will prevent strangers or even potential mates or employers happening to catch your page right as a friend posted some hilariously sick image on your timeline.

We recommend you turn on “Review posts friends tag you in before they appear on your timeline?” This won’t stop your friends from tagging you in something embarrassing but it will stop it from showing up on your wall if they do.

We definitely recommend you enable “Review tags people add to your own posts before the tags appear on Facebook?” This so called tag review will keep you from being in ridiculous tagged pictures or posts that show up in search results. Instead of just popping up on your wall the posts will show up in your activity log where you can approve a tag or asked for it to be removed. To get to your “Activity Log” to approve your tags, go to your profile by clicking on your name on the top navigation. Then click on “Activity Log”

Here’s a Facebook video on how to “report/remove” photos or videos you don’t want to be tagged in.

6. If you want to prevent your friends and family from being associated from you, hide them.
On your profile/timeline page, click “Friends”. In the new screen you’ll see an edit button.

Select “Only Me”.

To hide your family, click “About” below your name, work, school and hometown on your timeline. Under “Relationships and Family” select “Edit” and select “Only Me.”

7.       If this is too much work, consider moving somewhere you’ll have lots of privacy—Google+.

[Photo by Milica Sekulic]

More posts from this topic

dead end

Should We Stop Thinking of Email As Private?

When he was still working in cyber security for the Finnish government, Erka Koivunen met a NATO diplomat that there was "nothing new" about the era we now live in. Foreign envoys have always lived with the constant awareness that their private communications could be "leaked" for their enemies to exploit. "Anything that was written down could eventually be discovered," Erka, who is now an F-Secure Cyber Security Advisor, told me. "So the most sensitive conversations never took place in writing." Given the massive email leaks that have now hit the worlds of business, with the Sony hacks, and politics, with the leaks of U.S. political figures, is this how we should all start thinking? Does everyone alive in the twenty-first century have to operate like a NATO diplomat? Or a C-level executive who knows any word she types could be subpoenaed? Or the campaign chair of a presidential campaign? The answer, unfortunately, seems to be increasingly clear. "Whatever you write, you may need to defend your position in public," Erka said. Relying on an insecure medium The problems with email begin with the general insecurity of it as a means of communication. It's more like sending a postcard than sending a sealed letter, Erka explains. "As soon as the message goes out of your or your company’s systems, you lose control of it," Erka explained. "This is by far the biggest problem of the good-ole-email. Messages can be eavesdropped, altered, delayed, replayed or dropped altogether without you ever knowing." To actually spy on email as it's being transmitted generally requires legal access to telecommunications infrastructure or extraordinary technical knowhow and resources. Think law enforcement or intelligence agencies. Since these groups have a vested interest in cloaking their activities, they had little incentive to engage in the massive sort of leaking of gigabytes of private data we've seen from Wikileaks. However, we appear to be at the end of the era of "the gentleman's agreement" between countries, as cyber policy expert Mara Tam explained on a recent episode of the Risky.Biz podcast. This agreement went something like: "Gentlemen read each other's email, but they don't leak it to the public." The leaks from former CIA contractor Edward Snowden helped make the public aware of how much information the government potentially could access. But the exposure of a private individual's digital communication to the world presents a stark new reality for anyone who conducts business online. "Personal mailboxes store gigabytes’ worth of conversation history that will be a treasure trove for attackers for multiple reasons," Erka said. "There are sensitive discussions about business strategy, customers, competitors, products. There is also internal gossip, badmouthing and other damaging stuff." Activist Naomi Klein told The Intercept that "this sort of indiscriminate dump is precisely what Snowden was trying to protect us from." And we don't yet have a full sense of the potential ways this mass of data can be used against us. A competitor could use private information to tarnish someone’s reputation and hackers can mine the data to prepare for future cyber intrusions or to gain access to your other accounts through password resets. Letting the public decide what's private Leaks have already cost some executives their jobs and could swing the U.S. presidential election. But in a sense, we're all victims of this new risk to all of our privacy. "Whatever you write in an email you have to consider, are you ready for your boss, your spouse, your business partners to read it?" Erka asked. This new reality leads inevitably to the tragedy of self-censorship. Zeynep Tufekci -- a "techno-sociologist" -- ‏has been doing a running commentary on the Wikileaks revelations and is very disturbed by what she's seeing. "People gossiping in internal conversation is not a scandal—but destroying public/private boundaries will paralyze dissent, not the powerful," she tweeted. Wikileaks is releasing more documents than it could ever sift through in the hopes that the newsworthy information will be discerned by interested researchers around the world. But along with potentially relevant items, intensely private information has been revealed. "For example, a suicide attempt was publicized through Podesta indiscriminate dump (Wikileaks tweeted it out)," she noted. "Who will want to be political?" This makes the loss of email seem dire, but perhaps it speaks to a not just a flaw in the medium's security but the medium itself. "The deeper problem with email is that it has never quite settled on a social mode," The New York Times Farhad Manjoo wrote. "An email can be as formal as a legal letter or as tossed off as drive-by insult. This invites confusion." What can you do? So, should you be like that NATO diplomat content to keep all of your deepest secrets out of writing? Can you expect yourself to remove all snark and potentially offensive thoughts from your emails? Should you assume that your email box is like a box of letters in your attic, vulnerable to anyone who can get access to it? These answers are ultimately up to you and how you use -- or don't use -- email. F-Secure security advisor Sean Sullivan has found that young people he's interviewed are increasingly abandoning email as communication tool. "They only have an account -- typically Gmail -- in order to sign up for stuff," he said. If this continues, email is on its way out, whether it's private or not. For now, lawyers, doctors and other professionals with explicit legal responsibilities, email has a much more defined role that cannot be easily abandoned or circumvented. As far as your work email goes, consult your IT staff for guidance as you may be under legal obligation to preserve your data. But for your personal email, Erka suggests you have to at least be aware of how likely you are to be a target and what you can do to contain any potential damage -- besides using a strong unique password for every email account you have and only entering your account information on the secure webpage of your email provider. If you are involved in international politics, for instance, there's no question. You are a target. Hackers are either after your emails or are trying to get access to powerful people in your contacts. If you're someone with no power, no tumultuous relationships and no interest in politics, you're likely not to be on anyone's radar... yet. The problem is no one knows where you'll be in a few years and our inboxes are big enough to last a lifetime. "When everyone is using cloud-based emails like Gmail, there's no need to save space," Erka said. "That's the whole selling point of those services: Never delete anything." If you see the potential for enough damage, you many want these recent leaks as an inspiration to launch a serious spring cleaning of your personal online inboxes, including email and social media. "You may want to delete the messages you don't need and sort the stuff you do want into folders that you take off the web and can store on a secure backup," Erka suggested. Yes, you will lose the convenience of being able to search your Gmail box through a simple interface, but so will potential hackers. He also recommends sharing documents through sharing platforms and cloud services such as Sharepoint, Salesforce or Dropbox. "These links can require separate authentication upon opening and the sender can control how long it will be valid," Erka said. "If the email gets stolen and leaked years later the chances are the link will be invalid by that time." For quick conversations, Sean suggests Wickr, which offers self-destructing messages through a mobile app or a desktop client with easy encryption, something that just doesn't exist for most email. "For professionals, Wickr has a paid service which will retain messages for a legal requirement, and will then securely delete them post-requirement," he said. Regardless of policy, employers have a vested interest in moving their staff away from an over-reliance on email for more than privacy reasons. "Actual phone calls and face-to-face discussions that get out of your chair are probably more useful than email or chat threats," Sean said. "So rather than swap from one to the other – just learn to better utilize what you work with best." These leaks offer a sobering reminder that email is not secure. But, perhaps, the more important message is that it as a means of communication, it was never very smart. [Image by Alan Levine |Flickr]

October 20, 2016

An Open Letter to Businesses that Block VPNs on their Free Wi-Fi

Occasionally we get a question on our privacy community about a Wi-Fi hotspot blocking VPNs. Thankfully this doesn't happen very often, but we decided to write this letter to let companies that do this know why they shouldn't. Dear business providing free Wi-Fi but blocking VPN, First of all, we don’t want to seem ungrateful. Thank you for giving us free internet on your premises. We all appreciate a reliable hotspot to occupy our time while we fight boredom in a hotel room, rest up before evening bingo on a cruise ship, or sip on a Mocacchino at a downtown café before picking up the kids. Data caps on our mobile plans are getting less and less in the way of us enjoying our time online when away from home, and we thank you for helping us avoid this problem. But what you may not realize is that every public Wi-Fi hotspot is also a golden opportunity for cyber criminals. It’s not your fault, this is just a fact of life we're trying to live with. Most traffic sent over Wi-Fi is basically out there for the taking, and anyone with a laptop and readily available programs can easily intercept all unencrypted data sent over your hotspot. There are a few tricks for users to make sure all their traffic stays encrypted and private, but using a VPN is arguably the easiest way. And yes, it is harder for you to monitor or control what VPN users do on your hotspot. But is having that control so important that you’re willing to trade your customers’ security for it? By blocking VPN on your Wi-Fi, you are actively telling your customers to put their private data at risk while surfing, or to not surf at all.  It’s the equivalent of giving people access to a beautiful sandy beach, but telling them they can only use it if they don’t wear sunblock. Ultimately, it’s your hotspot and your call. But if you care about your customers, don't be in the minority of businesses that forces them to give up their online security and privacy. Best wishes, the FreedomeVPN team.   https://www.youtube.com/watch?v=BnTFGiV27Zw

October 7, 2016