Facebook Comes A-Calling?

[Rob McCow]

From The Register -

Facebook has added APIs for developers to access the home address and mobile numbers of users, so FarmVille can see where, as well as who, you are.

Permission to access such data must be given through the usual notification system, but with the vast majority of users simply agreeing with everything they're asked, the new facility is attracting privacy concerns beyond those incurred by sharing one's details with the developers of Bejeweled Blitz or similar.

Users almost always click "Allow" when faced with such decisions, as demonstrated by Microsoft's Active X technology more than a decade ago and proven by the thriving malware ecosystem sustained by inattentive Facebook users today.

The alternative is pointed out by Sophos security, which suggests a more totalitarian approach: "Wouldn't it better if only app developers who had been approved by Facebook were allowed to gather this information?"

There are no Trojans on iOS or in the Mac App Store, so perhaps pre-approval is the way forward, restrictive as it is.

Sophos has said that the new APIs, applied on Friday, might be fodder for rogue application developers. Survey scams that form one of the mainstays of security threats on Facebook often attempt to hoodwink punters into supplying their mobile number and signing up to premium rate text messaging service of questionable utility.

The process of extracting mobile phone numbers of potential marks, which used to be a matter of social engineering trickery, might now be done much more easily. Users would still need to give permission for third-party Facebook applications to access this personal contact data but this has become a matter of fooling someone into clicking a dialogue box rather than the trickier process of hoodwinking them into typing in their mobile phone number.

Facebook recently beefed up its account recovery options to include messages sent to a designated mobile phone number as part of its account recovery procedure. This, and other factors, mean that the mobile phone number of many users will be held by the dominant social network.

Mobile phone numbers might even be held by the social network without users submitting them, in cases where their friends have recorded relevant phone numbers in their address book and make use of Facebook's iPhone application.

Sophos is urging users to remove their addresses and phone numbers from Facebook, as a precaution. A guide on reviewing Facebook privacy settings, developed by Sophos, can be found here.

The new APIs, launched at the weekend, also provide notification for developers if a user "unlikes" something: so next time you take a thumbs-up off a page, expect a phone call asking why, and perhaps a knock on the door from someone seeking a more detailed explanation.

So what do you think? Has anyone here actually told Facebook their address and mobile number? Will this affect you?

I don't think Facebook would allow this practice if it thought there was likely to be a lot of scams going on - at least, a lot of illegal or unpopular ones that might damage Facebook's reputation. So it'll probably be OK, but you never know!

[Si Hunt]

This doesn't bother me - stupid people were a few months ago setting their statuses to "OMG Facebook is showing your mobile numbers everyone!" - well duh, if you put it in in the first place then what do you expect? But I was more worried by the recent 'viral app' which I almost fell for. It promised to show your First Facebook Update Status, then gave the purpetrators permission to post using your account!

This is a bit worrying, and leads me to think I should not install ANY more Apps in future, if they are going to let this sort of thing happen.

Si.

[SiHart]

Well as Si says, this only affects you if you're silly enough to put those details online in the first place. There's no way that anyone on Facebook, or indeed Facebook themselves need to know where I live or have my phone number.

Si xx

[Lissa]

I saw an article once that made me see Facebook in a totally new way. It went something like this -

Facebook is worth $50 billion

It has 500 million users

But the site and the software that powers the site are basically worthless

Therefore the 500 million users (and their data) are what is worth $50 billion.

Facebook users are not the customers, they are the product.

Seeing it that way, developments like this don't surprise me in the slightest.

[Si Hunt]

My cousin is head of HR at a big global company, and before she hires anyone she routinely takes a quick look at their Facebook page. Probably not allowed, but then who's to stop her if she does it in her own time? She interviewed one person and then saw they were a Fan of The BMP on Facebook - and wondered if someone with that kind of tolerance was the sort of person she wanted at the company.

Equally, we were at work the other day and attention strayed to Facebook as a few of us are on it (note to self: do not post status updates during office hours). My boss started looking me up, and to my terror I realised she could see all my photos!
"Ooh, I can see the photos from Jim's Stag Do," she said accross the office. "And what you went to Kathy's fancy dress party as."

I almost had a hernia. I'd advise anyone to check who can see their photos and other info, as I had mine to "Friends of Friends", which of course means it only takes someone else in the office to add the boss and she can see everything. Which I don't neccessarily want, as one likes to be slightly guarded from ones employer!

Si.

[SiHart]

I've blocked all those. If you're not a friend of mine all you can see is the most basic profile that's on offer. I don't want anyone I don't know checking up on me!

Si xx

[WhiteCrowNZ]

Which I don't neccessarily want, as one likes to be slightly guarded from ones employer!

There's another M Talks in the Southern Hemisphere - and he's a heavy metal guitarist. As we're distant cousins, there's a vague resemblance. I'm just waiting for someone to check up on me and go "so how long have you worshipped Satan" ...

[Alex]

She interviewed one person and then saw they were a Fan of The BMP on Facebook - and wondered if someone with that kind of tolerance was the sort of person she wanted at the company.

But the British Medical Profession do a sterling job!

Ahem. I'll get my coat, etc.

As for this story, I removed my contact details ages ago, it amazes me that some people have their phone numbers and address for everyone to see, tis madness. And on the work front, I've set it so that only friends can see my profile, it just seemed to be the sensible thing to do...

[Darren]

This is why I never had and never will have any interest in Facebook.

[WhiteCrowNZ]

Maybe it's time to dislike "Che Guvara", "Overthrowing the state" and "Guido Fawkes got it right" then ...