Third parties are actively seeking out end-user information using Facebook
Download as PPTX, PDF0 likes389 views
Facebook poses serious privacy risks to users according to the document. It identifies three main factors that undermine user privacy: users disclose too much personal information, Facebook does not adequately protect user data, and third parties actively seek user information via Facebook. Specifically, the document finds flaws in Facebook's terms of service, security vulnerabilities that could lead to data breaches, lack of user control over their personal information, and disclosure of user data to advertisers without clear user consent. In conclusion, the document asserts that using social media inherently exposes users' privacy due to platforms' inability to fully protect data and lack of transparency around how personal information is used.
Third parties are actively seeking out end-user information using Facebook
- 2. Overview End-users share a wide variety of information on Facebook, but a discussion of the privacy implications of doing so has yet to emerge. We examined how Facebook affects privacy, and found serious flaws in the system. Privacy on Facebook is undermined by three principal factors: users disclose too much, Facebook does not take adequate steps to protect user privacy, and third parties are actively seeking out end-user information using Facebook. Specifically, university administrators are using Facebook for disciplinary purposes, firms are using it for marketing purposes, and intruders are exploiting security holes. For each threat, we analyze the efficacy of the current protection, and where solutions are inadequate, we make recommendations on how to address the issue.
- 3. Introduction Facebook is one of the foremost social networking websites, with over 8 million users. With this much detailed information arranged uniformly and aggregated into one place, there are bound to be risks to privacy. University administrators or police officers may search the site for evidence of students breaking their school’s regulations. Users may submit their data without being aware that it may be shared with advertisers. Third parties may build a database of Facebook data to sell. Intruders may steal passwords, or entire databases, from Facebook
- 4. I. User privacy Terms and conditions Information that Facebook stores, Third party information, Direct data collection, Privacy, The most active users disclose the most Users are not guarded about who sees their information Users Are Not Fully Informed About Privacy As Facebook Expands, More Risks Are Presented
- 5. Facebook Terms and Conditions So, like every other one of the world's 1.28 billion monthly active Facebook users, you blindly agreed to Facebook's Terms and Conditions without reading the fine print. You entrusted your photo albums, private messages and relationships to a website without reading its policies. And you do the same with every other site ... sound about right? In your defence, Carnegie Mellon researchers determined that it would take the average American 76 work days to read all the privacy policies they agreed to each year. So you're not avoiding the reading out of laziness; it's literally an act of job preservation. So here are the Cliffs Notes of what you agreed to when you and Facebook entered into this contract. Which, by the way, began as soon as you signed up: 5
- 6. Facebook Terms and Conditions(Cont..) Nothing you do on Facebook is private. Repeat: Nothing you do on Facebook is private. That includes some things you haven't even done yet. Even if you leave the network, not all your information does. Your information lets Facebook sell the power of your profile to brands and companies. You're also giving Facebook the ability to track your web surfing anytime you're logged into the site. Facebook also uses strategic partnerships to track your purchases in real life. 6
- 7. Facebook Terms and Conditions(Cont..) Facebook uses all this outside information to target ads to you. Facebook has been rolling out location services that effectively turn mobile phones into location tracking devices. And it plans to use this location data to sell you things. And, yes, Facebook can use you and your data for research. 7
- 8. Facebook Terms and Conditions(Cont..) Facebook data is potentially available to government agencies. And if you actually think you know what you've agreed to, remember that Facebook maintains the right to change its mind about user conditions at any time. https://www.facebook.com/legal/terms 8
- 9. Information that Facebook stores All data fields on Facebook may be left blank, aside from name, e-mail address, and user status (one of: Alumni, Faculty, Grad Student, Staff, Student, and Summer Student). A minimal Facebook profile will only tell a user’s name, date of joining, school, status, and e-mail address. Any information posted beyond these basic fields is posted by the will of the end user. Although the required amount of information for a Facebook account is minimal, the total amount of information a user can post is quite large.
- 10. Third party information Third-party information Two current features of Facebook have to do with third parties associating information with a user’s profile. The “Wall” allows other users a bulletin board of sorts on a user’s profile page. Other users can leave notes, birthday wishes, and personal messages. The “My Photos” service allows users to upload, store and view photos. Users can append metadata to the photographs that allows other users to see who is in the photographs, and where in the photograph they are located. These tags can be cross-linked to user profiles, and searched from a search dialog.
- 11. Direct Data collection The collection of data directly from Facebook serves two principles. It served as a proof of concept, to demonstrate that it is possible for an individual to automatically gather large amounts of data from Facebook. Also, the collection of data from Facebook will provide us with a large, nearly exhaustive and statistically significant data set, from which we can draw valuable conclusions on usage trends.
- 12. Privacy “My Privacy” Facebook’s privacy features give users a good deal of flexibility in who is allowed to see their information. By default, all other users at a user’s school are allowed to see any information a user posts to the service. The privacy settings page allows a user to specify who can see them in searches, who can see their profile, who can see their contact info, and which fields other users can see. In addition, the privacy settings page allows users to block specific people from seeing their profile. As per the usage agreement, a user can request Facebook to not share information with third parties, though the method of specifying this is not located on the privacy settings page.
- 13. The most active users disclose the most Users who frequently update their profiles tend to be even more open. We found that, although the general trends of relative disclosure did not change, the relative willingness to disclose all information increased. Using another heuristic for determining active users, users with lots of friends tend to be much more forthcoming with their personal information, particularly that which might be valuable to advertisers. Facebook has grown extremely rapidly, establishing a user base of 8,000,000 users, and close to 100% penetration at certain schools. If Facebook continues to grow in popularity, the average user will likely become more and more like the “well-connected” user. If this trend continues, the level of information disclosure will keep increasing correspondingly. 13
- 14. II. Facebook Threats Security Breach Commercial Data mining Password Interception Incomplete Access Controls Disclosure to Advertisers Lack of User Control of Information Third party Advertising
- 15. Security breach A security breach at Facebook, either from an outsider locating vulnerability or from a disgruntled insider, would potentially put all 8,000,000 Facebook records at risk. This is not a risk that can be eliminated; no site is perfectly secure. The fear of a security breach is certainly a reasonable one, as large data warehouses are often targets of intruders. For example, ChoicePoint’s databases were breached and 145,000 records were compromised. While a Facebook breach would not be sufficient to start performing identity theft, a trove of so much personal information would contain much information that people would not want to make public. 15
- 16. Commercial data mining Companies such as ChoicePoint, Inc. have built billion-dollar business on selling databases of personal information. Facebook has a database on 8 million college students that is far more accurate than the usual commercial data, as users have an incentive to make information accurate. Profiles used for social networking are likely to be 100% accurate, as they are maintained by their subjects. This is in marked contrast to the accuracy of databases such as those maintained by ChoicePoint and Acxiom, which have records of dubious accuracy 16
- 17. Password interception The fact that the username and password were sent in cleartext is a security vulnerability. An adversary could read Facebook user names and passwords off of the Ethernet or unencrypted wireless traffic, obtaining access to users’ Facebook passwords, as well as any additional accounts they use those passwords for. Because of the ethical and legal implications of doing so, we did not attempt to steal passwords. It should be noted, however, that MIT cited password theft as a real problem when they maintained telnet servers that had login data sent as cleartext. The University of New Mexico cited this as the main reason they chose to disable Facebook access from their network. Because many many users use their university email passwords as their Facebook passwords, UNM views Facebook as a security liability for their network. Current Facebook Precaution: Facebook currently takes no steps to protect user passwords in transit. 17
- 18. Incomplete Access Controls There is nothing inherently wrong with allowing users to search for photos, but there are no restrictions akin to “My Privacy” for photographs. In addition, the usual access controls do not apply to “My Photos,” anyone from any university can search for and see any other photograph by editing the query URL. The ability of users to upload and tag photographs easily, and the difficulty for a user to de-tag large numbers of photographs, makes it easy for others to find photographs with few restrictions. Current Facebook Precaution: Facebook limits photograph searches by profile in the same way they limit regular searches; the problem lies in the additional unrestricted method of searching all photos by name. 18
- 19. Disclosure to Advertisers Facebook has a relationship with several companies currently. Apple and JetBlue, among others, have their own “groups” that interested users can join, to show their brand loyalty, or for a chance at giveaways. Facebook’s privacy policy explicitly says that they may disclose profile information to third parties, so the prospect of them doing so is clearly realistic. Current Facebook Precautions: Facebook offers an “opt out” link on their Privacy Policy page, which, if clicked, means that one can “submit a request” to Facebook to not share information with third parties. They say that they “will make every effort to implement any choice you make as soon as possible.” Offering the user choice in this matter is clearly to the user’s benefit. However, the feature has no followup or feedback, and is couched in language that does not actually imply any sort of binding agreement. 19
- 20. Lack of User Control of Information Other users can upload and associate information to one’s Facebook account. The most prominent feature of this type is the “My Photos” feature, which allows users to upload photos and tag them with the names of the people in the pictures. This functionality has already resulted in trouble for an underage student at University of Missouri-Columbia when college administrators found a picture of her duct-taped to a chair while another student poured beer in her mouth. This was a matter of considerable embarrassment as she had just been elected student body vice president. The university is currently considering removing her from that role. Current Facebook Precaution: Facebook allows users to de-associate themselves from unwanted data, but in the case of photographs, the data remains on the server. This is also an “opt-in” function that requires constant monitoring of the system. 20
- 21. Third party Advertising Advertisements that appear on the Web Site are delivered to users by our advertising partners. Our advertising partners may download cookies to your computer. Doing this allows the advertising network to recognise your computer each time they send you an advertisement. In this way, they may compile information about where you, or others who are using your computer, saw their advertisements and determine which advertisements are clicked. This information allows an advertising network to deliver targeted advertisements that they believe will be of most interest to you. Facebook does not have access to or control of the cookies that may be placed by the third party advertisers. This privacy statement covers the use of cookies by Facebook and does not cover the use of cookies by any of its advertisers. 21
- 22. Conclusion We conclude that using social media sites exposes us more to loose our privacy. None of the social media sites can say their users are fully protected from any unwanted usage of their data or from any other intrusion. And even the users are not aware of how their personal information can be used or make other people rich. So if you wish to protect yourself better not to use any one of it. 22
- 23. Thank you! By: - Daniel Ilunga