Your Facebook Profile is Already Public

As Facebook’s privacy settings continue to evolve, many have discussed the increased openness as users gain more options to share content publicly.  All the while, though, ongoing problems with the Facebook Platform detract from the perceived level of control over privacy.

In essence, you should already think of your profile information as public.  First, any application you authorize has carte blanche access to your data.  You have no way to limit this access apart from avoiding authorization to start with.  Second, if a friend authorizes an application, that application likely has the same amount of access to your profile via your friends’ sessions.  You can limit the available data if you have not also authorized the application.

Finally, the current architecture of the Platform leaves users vulnerable to attacks that allow others to harvest profile information.  I have demonstrated such attacks before, and the more I investigate them, the more ridiculous the situation becomes.

This morning I found yet another XSS hole in a top 10 Facebook application (by monthly active users).  However, this was another FBML application, and as with several other cases, I could not immediately replicate my old XSS+CSRF attack for stealing profile data.  With a bit of experimenting, though, I realized another trick.  Rather than trying to insert script directly, I took a slightly different approach for executing this script.  This new technique ensured script execution, at the price of easy access to the session secret.  Using referrers, though, I gained access to the session secret as well.  This does require a user to have referrers enabled for JavaScript, but I’m fairly certain that’s the default on most browsers.

Not only did this new trick enable the attack on that particular application, it allowed me to launch the attack using another top 10 application that I already knew had an XSS hole.  Both of these applications also allow for clickjacking installs, meaning I could once again relaunch the full attack if I so desired.

Keep in mind that you need not visit an attack page for this to affect you.  If you’ve not limited unauthorized applications or the attack uses an application you’ve already installed, your data is vulnerable if a friend visits an attack page.

In short, an attacker could launch pages right now (this is zero-day stuff, people) that silently harvest profile information and photos from nearly any Facebook user.  Between these hacks and the threat of rogue applications, you should regard anything you post on Facebook as public information.

Facebook Instapaper Twitter Digg FriendFeed Delicious Google Bookmarks Yahoo Bookmarks Share/Bookmark

Facebook Taking Action on at Least One Issue

Late last night, Facebook issued a statement on their development blog with the cheery title, “Good Ads Make for a Good Ecosystem.”  I’ll begin by saying this post is very good news, and I applaud Facebook for addressing ad networks that violate application policies.

Finally.

My enthusiasm is a bit tempered by how long it’s taken for Facebook to respond on this issue, and I’m still mystified by some of the remarks in their post.  But first, let’s recap the good news.  By noon Pacific on August 3rd, Facebook will require all application advertising to meet a revised version of their own guidelines.  As part of this change, ad networks will no longer be able to use profile pictures or the names and birth dates of users without Facebook’s approval.  As Justin Smith notes, “To our knowledge, this is the first time Facebook has said all ads that display user data must be ’specifically approved’ by Facebook.”  Facebook also reminded developers that they can’t send user data to third-party advertising networks, and that ads are part of an application – meaning they fall under the same rules as the application itself.  I particularly appreciated this bit:

If you run code provided by an ad network in the operation of your application, be sure you understand what this code does.

Now for the less heartening aspects of this announcement.  Yesterday, July 28th, Facebook said:

Please remember that developers have never been allowed to send user data received from Facebook to ad networks…

Stop the tape.  On May 28th I posted the following tidbit about a Facebook Verified Application:

I was surprised to see right in the HTML for the application that when it called for an advertising banner, the iframe URL included my full name, sex, date of birth, age, relationship status, and college information (schools, years, degrees, and majors). I didn’t really think an application, particularly a verified one, should be passing such profile information to a third party.

On June 10th, I named names, noting that AdMazing was the ad network getting the data.  Fast forward over a month to July 25th, when I made this comment:

I did mention one example over a month ago on this very blog, yet the methods of that particular ad network have not changed at all in the mean time, nor has Facebook taken any action against them.

Now with that background, let’s finish the sentence from Facebook’s July 28th post:

…and we take firm action against this.

Right.

I might also note that on June 7th I filed a report about a different type of unsettling ads on Facebook which used user profile data, and on June 18th AllFacebook’s Nick O’Neill left this comment:

Just as a heads up I’ve been in discussions with Facebook for the past week about this exact issue and soon enough I should have a post up about the result. This is definitely a workaround that while they may be abiding by the terms, it results in shock to many of the users that see it.

Apparently Facebook was, in fact, working to address the issue and… oh wait a second.  That blog post was from June 7th of last year.  (By the way, Nick made good on his promise with a discussion of Social Banners and related issues.)

So why the sudden flurry of activity from Facebook regarding these application ads?  Perhaps the Financial Times can shed some light on the subject:

Facebook has found itself the victim of its own success. A user revolt is underway, as a huge number of users are updating their status to warn of a rumoured invasion of privacy by the site….

Also worth noting is how suddenly this message went viral. Ms Smith first reported her experience last Sunday, and the news was picked up, and dismissed by Mashable among others. But like a buried ember that sparks a raging brush fire, the meme caught a gust of wind, and by Friday was spreading across the social graph.

As I’ve pointed out before, Facebook has shown remarkable agility when their users raise an outcry en masse.  Say what you will about Facebook protecting their users, you can’t deny that Facebook works hard to defend its image.  After that viral wave of status updates, Facebook has moved swiftly to restore user confidence in the site’s advertising, whether from Facebook or on applications.

That’s why I’m not holding my breath for any action on the other privacy problems with the Facebook Platform I’ve noted, all of which remain and which, together, leave private information at risk.  Until users realize the current reality and make an issue out of it, Facebook apparently has little incentive to change the status quo.  I would love to believe that Facebook is more proactive and that I’m simply unaware of certain measures or underestimating the situation, but so far the company’s actions have inspired little confidence.

Facebook Instapaper Twitter Digg FriendFeed Delicious Google Bookmarks Yahoo Bookmarks Share/Bookmark

Privacy Policies on the Top 25 Facebook Applications

Today, I performed a little experiment.  I went through the current top 25 Facebook applications, based on monthly active users and excluding applications by Facebook, and checked to see if they linked to a privacy policy.  I noted not only whether a privacy policy existed, but where one could find it.

Each of the applications currently have at least 5.5 million monthly active users, and 12 of them are Facebook Verified Applications.  Keep in mind that every application is entrusted with the same access to user data on authorization, regardless of the application’s purpose.

With each application, I checked for any links on the Info page, then checked to see if any of these pages linked to a privacy policy.  I then looked for application terms of service on the installation page, and checked to see if the TOS linked to a privacy policy.  (Throughout this experiment, I made a distinction between “terms of service” and a specifically designated “privacy policy.”  I also considered plaintext URIs to be links, even if they were not hyperlinked.)  Finally, I looked for help or supports links within the application that then linked to a privacy policy.

Following this method, I was unable to find any link to a privacy policy in nearly a third of the applications.  Of these, one was a Facebook Verified Application (more on that in a bit).  Also, one application only posted to a user’s wall and never requested authorization to access user data.

Two applications linked to a privacy policy only after installation, one on the first page after installation, and one via a second linked support page.  Seven applications linked to pages on their Info page that then included links to a privacy policy.  In five of these cases, the page containing a privacy link was the About link, a rather subtle one that points to the developer’s web site, which at times applies to more than one application.  Three of the seven included links to application TOS on the install page which did not include privacy policies.

Eight applications not only had a privacy link via one of the Info page links (five being the About link), but included a link to a privacy policy in the application TOS from the install page.

Only one application linked to its privacy policy directly from the Info page of the application: CourseFeed.  Major props to its developers for making that decision.  A close second in terms of disclosure was Zoosk, whose privacy policy is included in the application terms of service, which are linked to from the installation page.  Also, Zoosk’s Info page links to a support page, which then links to a privacy policy.

All of these findings are summarized in the chart below.

Chart of findings on the top 25 Facebook application privacy policies.

Chart of findings on the top 25 Facebook application privacy policies.

A few other specific applications stood out in various ways.  While Birthday Cards linked to the RockYou homepage, which includes a privacy policy link, the homepage was taken over by an advertisement in Firefox, and I saw no way to close the ad and get back to the actual page.  Also, Slide’s FunSpace presented a rather strange dynamic.  The application seemed to behave as if it were a Facebook Connect page, only prompting for authorization in a pop-up dialog when I tried to create a post.  In fact, since I had used the application previously, it included such details as my name and friend list before I even authorized it.  I’m not sure exactly what was happening behind the scenes in that instance.

Finally, one application deserves mention for its rather pitiful performance: RockYou Live, formerly Super Wall.  This is a Facebook Verified Application, yet I could not find any link to a privacy policy within the application or via its links to other pages.  In fact, the About link on the Info page points to a section of the application, which requires user installation.  Finally, it provided no link to application terms of service on the install page.

Once again, keep in mind that a user grants the same level of trust to each of these application on installation.  Yet 36% either have no published privacy policy or only offer links to a privacy policy after a user has authorized the application.  I’ve seen people get upset over the lack of a privacy policy on web sites that have access to far less personal information than a Facebook application.  If this sample of the most popular applications is any indication, however, people have another reason to be upset about the current state of privacy on the Facebook Platform.

Facebook Instapaper Twitter Digg FriendFeed Delicious Google Bookmarks Yahoo Bookmarks Share/Bookmark

Application Data Retention (Updated)

As many who follow news on privacy and technology know, Canada’s Privacy Commissioner Jennifer Stoddart recently issued a report criticizing Facebook for various problems with privacy on the site.  The report addressed several aspects of privacy on Facebook, including data access by third-party applications.

One item in the report, though, concerned data retention by Facebook.  As TechCrunch describes:

The organization and Commissioner’s main concern is that Facebook provides confusing or incomplete information about its privacy practices, like not giving users to opportunity to complete wipe out their accounts instead of merely deactivating them. Stoddart also criticizes Facebook’s policy of indefinitely keeping the personal information of people who have done just that.

Commissioner Stoddart is not the first to raise this issue, as it’s been a subject of debate for some time.  However, I have not heard many people discuss a related aspect: data retention by third-party applications.

Unfortunately, with the way the Facebook Platform is currently structured, applications receive no notification when a user removes an application’s access to their data or shuts down their Facebook account.  Consequently, an application developer has no way to determine when a user has “uninstalled” the application, and thus for most applications, data retention lasts forever.  You can see this in action by removing an application then later authorizing it again: all of your data generated within the application will likely remain.  For some applications, this data continues to be accessible to other users even if you’ve uninstalled the application.

And this is not simply a Facebook problem.  From what I understand so far, the same issue applies to OpenSocial platforms, such as MySpace.

Granted, there’s not simple solution to this problem, but as concerns grow over the amount of data shared on social networking sites, third-party data retention policies will have to enter the discussion at some point.  One can argue that each application developer is responsible for their own policies, but most applications probably have no policy, and lack of notification on uninstall makes any policy difficult to implement.

Update (8/26): Upon further research, I discovered that I was quite incorrect with this blog post; my apologies to Facebook for making an erroneous statement about the Facebook Platform.  Facebook does, in fact, allow developers to set a post-remove URL which is notified when a user removes an application.  Apparently my experience has mostly been with applications which do not take advantage of this feature, meaning the issue primarily lies with application developers, not Facebook.  I do wonder how many applications actually remove data upon uninstallation.

Facebook Instapaper Twitter Digg FriendFeed Delicious Google Bookmarks Yahoo Bookmarks Share/Bookmark

Matching User Expectations

About two months ago, I mentioned that one Facebook application had a hole which allowed me to view the photo albums of any Facebook user whose privacy settings allowed it.  I imagine that many users do not realize that access for “Everybody” is the default setting when creating a new album, so while the issue did not technically violate anyone’s privacy, it would probably come as a surprise to many people.

Turns out developers had already built applications whose sole purpose was accessing public photo albums.  Since these albums were set to public access, the applications simply made API calls consistent with the album’s privacy settings.  CNET News now reports that Facebook has taken action to prevent such access via the API.  Since the albums are still public, you could still access them if you had the direct URI, but the difficulty of finding the URI gives users the illusion of control without requiring them to understand the ramifications of the default setting.

The key to this whole story can be found in this statement from the CNET article:

A Facebook spokesperson said the company made the change so the technology more closely matched users’ privacy expectations.

Some people seem to think that Facebook should be more public and open – that users should get over any illusions of keeping information private on the Internet and embrace free exchange of ideas without annoying filters and controls.  People endorsing this perspective may wonder why I spend so much time talking about privacy on Facebook.  For instance, some may view highly targeted advertising as a benefit, since it can provide users with relevant ads that link them to services they would want.

I recall a blogger (I can’t remember where I read this; if anyone has a link, please let me know so I can give credit where it’s due) once remarking that if a site uses someone’s personal information in an unexpected way, that’s an invasion of privacy, but if something useful happens in an expected way, it’s a feature.  Privacy comes back to user expectations.

And that’s one of the major problems I see with privacy on Facebook right now.  I don’t consider myself a “privacy fundamentalist.”  I simply believe users should have control over their information and be aware of how it’s used.  If Facebook users want public profiles or highly targeted advertising, so be it.  But make sure those users are aware of what’s going on – sell them on the benefits while being realistic about the risks.

If social networking sites want to strike a good balance on privacy, they need to match user expectations.  Adding new features may require changing those expectations (the News Feed comes to mind), and that can happen through education, other helpful features, and time.  But iwhen the state of privacy on a site races ahead of what users expect to happen, that’s a problem waiting to happen.

And that’s the way I see Facebook right now.  Vulnerabilities in applications leave personal information at risk.  Application advertising networks process vast quantities of personal information to target ads (yes, Facebook does too, but their relationship to the user is quite different).  Rogue applications can steal personal information.  All the while, Facebook trumpets their extensive privacy controls, and I continue to get shocked reactions when I explain or demonstrate to people what’s actually happening with their personal information.

And that’s why I keep talking about privacy in social networking applications.

Facebook Instapaper Twitter Digg FriendFeed Delicious Google Bookmarks Yahoo Bookmarks Share/Bookmark

The Limits of Application Privacy Limits

One issue I have not discussed much previously is how much of your data an application can access via a friend’s session.  I and others have had to sort through some confusion on this topic, and I appreciate recent work by Ian Glazer to clear things up.  As you can see from my comments on Glazer’s second post about his Privacy Mirror, I did not fully understand how things worked until Glazer posted his more detailed explanation of his findings:

It shouldn’t take a few hundred lines of PHP, three debuggers, and an engineering degree to figure out how privacy controls work. This lack of clarity robs Facebook users of the opportunity to make meaningful and informed choices about their privacy.

What Glazer found is that when a user restricts how much profile data is available to applications through friend’s sessions, those restrictions only apply if the user does not also authorize the application.  Once you install an application, all of your data is available in any friend’s session (subject to profile restrictions).

In Facebook’s defense, they do technically say this on the application privacy settings page, though I think it could be made more clear.  I certainly didn’t comprehend all the ramifications at first:

When a friend of yours allows an application to access their information, that application may also access any information about you that your friend can already see….

You can use the controls on this page to limit what types of information your friends can see about you through applications. Please note that this is only for applications you do not use yourself…

One could easily argue that this is a case of incompetence on my part for not making sense of what Facebook said, but I know that other security researchers have also missed some of these caveats or didn’t put them all together.

As Glazer points out, Facebook provides an easy way to tell how much information a friend can access via your profile, but provides no simple way for letting you know how much data applications can access.  Apparently, though, the answer is rather simple, since besides a few special cases, an application still basically has full access.

Facebook Instapaper Twitter Digg FriendFeed Delicious Google Bookmarks Yahoo Bookmarks Share/Bookmark

Debunking Facebook’s Statements on Ads

I never want to come across to harshly when talking about Facebook; I honestly believe they want to protect user privacy and security.  But while Facebook continues to hone and publicize the privacy controls in their own features, they seem to ignore major issues with Facebook applications.  Some might argue that applications are not under Facebook’s control, but this ignores changes Facebook could make which would help protect users.  I can only think that Facebook does not want to risk alienating developers any further.

In turn, many developers seem to shift responsibility to end users.  Recently I read back over coverage from ReadWriteWeb and the BBC on rogue Facebook applications, along with a discussion on Facebook’s developer forum.  While the reports admittedly included sensationalist elements, I was surprised to see commenters taking the position that rogue applications weren’t a problem, since users authorize applications to access their profile data.  In essence, if an application steals data, it’s the user’s fault for letting it.

This perspective fails to take into account the average user’s understanding of how applications access and share data, not to mention how little control a user has over applications.  And most users would probably be shocked by how even mainstream applications make use of profile information to target advertisements.  Many of these applications and advertising networks again take a hands-off approach, noting that a user could opt out of such programs.  But what are the chances of a user even realizing this, much less taking the time to figure out how?

Advertising in applications made a few headlines this weekend, after a message on user privacy made the rounds on Facebook.  The message did not actually address application ads, but in a statement on the message, Facebook deflected attention from their own ads to talk about application ads, and painted a rather rosy picture of user privacy on the Platform.  I respectfully disagree with their assessment.

First, let’s clarify: the original viral message on profile pictures in ads pointed to an actual privacy setting which controls whether your profile picture appears in Facebook Ads.  This was never about the application ad networks Facebook brought up in their statement.

Second, consider why Facebook banned SocialHour and SocialReach.  From what I understood at the time, Facebook had a problem with the ads falsely implying that friends had taken certain actions (e.g. taking a quiz).  Facebook did not seem to address the issue of profile pictures being used in the advertisements, and the practice has continued on many advertising networks to this day.

I was honestly rather surprised by Facebook’s statement, since it seemed to imply that all was well with application advertising.  I then became shocked when I read the update Nick O’Neill posted after digging for more information:

I’ve spoken to Facebook and they’ve made some relatively strong statements, the most important of which was that ad networks “need permission from the owner of whatever photo they use.” That means unless an ad network asked for permission to use your image, they can’t use it. Additionally, here are the policies that are applicable according to Facebook:

  • The data section of the platform guidelines indicates that just because a developer gets access to user data doesn’t mean that they can use it
  • Developers are not allowed to pass user data they get from FB to ad networks.
  • Apps cannot break the law, and there are rights of publicity issues that come into play here. Facebook is granted permission in the terms to use a user’s photo in an ad but this permission does not extend to developers or ad networks.
  • Not doing anything misleading (indicating a user has taken a quiz when they haven’t is misleading)

Seriously?  Seriously? It doesn’t take long to realize how flagrantly these guidelines are being ignored:

  1. Many application ad networks use the profile pictures of users and their friends.
  2. Application ad networks routinely access loads of profile data from users and their friends.  This information is often processed client-side and not sent back to the ad network servers, but you’d probably be stunned at just how much data is sifted through.
  3. User data is routinely sent back to application ad networks.  I can cite several examples of this, but I hadn’t brought them up sooner as I’ve been working on sorting through them and gathering records of what happens.  I did mention one example over a month ago on this very blog, yet the methods of that particular ad network have not changed at all in the mean time, nor has Facebook taken any action against them.
  4. The session secret of an application is routinely passed on to application ad networks.  This enables the ad network server to make requests to Facebook via the API and access user data.  Regardless of whether such action happens (and it does, by the way), an application should never share its session secret with outside web sites.  In several cases, the session secret is inadverently recorded by Google Analytics – and that includes ad network Analytics accounts.

As an example of ad networks accessing user data, remember SocialReach?  This very moment, one application with over 10 million monthly active users is serving SocialReach ads scripts which make Facebook API requests from the SocialReach web site.  These are the same FQL queries SocialReach made prior to Facebook banning it a while back. Update: On further investigation, it appears the SocialReach code operates client-side, though the session secret is still passed on to SocialReach and the code does make API requests.

As I said, I’ve been planning to talk more about this, but was still working on putting everything together and making further investigations.  With the sudden press about application advertising, I figured I should go ahead and at least note how badly reality differs from what Facebook seems to be trying to portray.  If news sites want proof or more specifics on the problems I’ve described, feel free to get in touch.

Part of what leaves me bewildered is that if I can uncover so many problems in my research, how does Facebook not notice them?  Some of these issues are even occurring in Facebook Verified Applications.  I simply don’t understand how Facebook can make the kinds of statements AllFacebook published in light of all the obvious issues still present.

Instapaper Facebook Digg Twitter FriendFeed Delicious Yahoo Bookmarks Google Bookmarks

Facebook Polling Users About Privacy

I just completed an interesting two-question survey via an official link on Facebook.  The poll first asked to what extent, on a five-point scale from “completely disagree” to “completely agree,” I agreed with this statement: “Facebook cares about its users’ privacy and security.”  Next, Facebook asked if I would describe myself as:

  • Very open – I wouldn’t mind if everyone could see all of the information I share on Facebook
  • In between – I don’t mind if everyone can see some of my information, but certain information I only want to share with my close friends or family
  • Private – I only share things with people I know

The survey came from the Facebook Research Team.  I’m guessing the first question is not only to gauge people’s image of Facebook but a statistic to trumpet if most users answer positively.  (In light of Facebook’s naivete towards Platform privacy and security, I did not.)  The second question is interesting in light of Facebook’s shifts from more controlled/private to more open/public.  And as Bruce Schneier recently discussed in an essay on privacy salience, Facebook probably hopes most users fall into the “very open” category.

I certainly look forward to seeing the results of this survey if they’re released.

Instapaper Facebook Digg Twitter FriendFeed Delicious Yahoo Bookmarks Google Bookmarks

1 11 12 13 14 15