Facebook - Not So Private!

By Daniel Emery Technology reporter, BBC News

(CANADA) The man who harvested and published the personal details of 100m Facebook users has spoken out about his motives.

Ron Bowes, a Canadian security consultant, used a piece of code to scan Facebook profiles, collecting data not hidden by users' privacy settings.

The list, which contains the URL of every searchable Facebook user's profile, name and unique ID, has been shared as a downloadable file.

Mr Bowes told BBC News that he did it as part of his work on a security tool.

"I'm a developer for the Nmap Security Scanner and one of our recent tools is called Ncrack," he said. "It is designed to test password policies of organisations by using brute force attacks; in other words, guessing every username and password combination."

By downloading the data from Facebook, and compiling a user's first initial and surname, he was able to make a list of the most common probable usernames to use in the tool.

The three most common names, he found, were jsmith, ssmith and skhan.

In theory, researchers could then combine this list with a catalogue of the most commonly used passwords to test the security of sites. Similar techniques could be used by criminals for more nefarious means.

Mr Bowes said his original plan was to "collect a good list of human names that could be used for these tests".

"Once I had the data, though, I realised that it could be of interest to the community if I released it, so I did," he added. I am of the belief that, if I can do something then there are about 1,000 bad guys that can do it too”

Mr Bowes confirmed that all the data he harvested was already publicly available but acknowledged that if anyone now changed their privacy settings, their information would still be accessible.

"If 100,000 Facebook users decide that they no longer want to be in Facebook's directory, I would still have their name and URL but it would no longer, technically, be public," he said.

Mr Bowes said that collecting the data was in no way irresponsible and likened it to a telephone directory.

"All I've done is compile public information into a nice format for statistical analysis," he said

Simon Davies from the watchdog Privacy International told BBC News it was an "ethical attack" and that more personal information had not been included in the trawl.

"This is a reputational and business issue for Facebook, for now," he said

"They can continue to ride the risk and hope nothing cataclysmic occurs, but I would argue that Facebook has a special responsibility to go beyond doing the bare minimum," he added.

Snowball effect
Mr Bowes' file has spread rapidly across the net.

On the Pirate Bay, the world's biggest file-sharing website, the list was being distributed and downloaded by thousands of users.

One user said that the list showed "why people need to read the privacy agreements and everything they click through".

In a statement to BBC News, Facebook confirmed that the information in the list was already freely available online.

"No private data is available or has been compromised," the statement added.

That view is shared by Mr Bowes, who added that harvesting this data highlighted the possible risks users put themselves in.

"I am of the belief that, if I can do something then there are about 1,000 bad guys that can do it too.

"For that reason, I believe in open disclosure of issues like this, especially when there's minimal potential for anybody to get hurt.

"Since this is already public information, I see very little harm in disclosing it."

Digital trends
However, he said, it also highlighted a new trend that was emerging in the digital age.

"With traditional paper media, it wasn't possible to compile 170 million records in a searchable format and distribute it, but now we can," he said.

"Having the name of one person means nothing, and having the name of a hundred people means nothing; it isn't statistically significant.

"But when you start scaling to 170 million, statistical data emerges that we have never seen in the past."

A spokesperson for Facebook said the list was "similar to the white pages of the phone book.

"This is the information available to enable people to find each other, which is the reason people join Facebook."

"If someone does not want to be found, we also offer a number of controls to enable people not to appear in search on Facebook, in search engines, or share any information with applications."

Earlier this year there was a storm of protest from users of the site over the complexity of Facebook's privacy settings. As a result, the site rolled out simplified privacy controls.

Facebook has a default setting for privacy that makes some user information publicly available. People have to make a conscious choice to opt-out of the defaults.


original article here

Do You Google Those You Meet Online?

Nearly two-thirds of daters use Facebook, Google and LinkedIn to scope out potential matches.

Online dating may no longer be taboo, but there's still the nagging question of safety associated with meeting someone over the internet.

Sure, some dating websites may begin screening their users, but in the land of "I'm-a-20-something-who-can't-pay-for-a-membership-or-for-your-fancy-background-checks" there's another alternative: total internet recon.

Yes, Google searching and Facebook stalking is good for more than just tracking the news on your former flames. In fact, the folks at JDate conducted a poll of their members to find out just how they gather information before meeting their online-interest in person.

Of the nearly 500 users surveyed, a whopping 59 percent of them use a combination of Facebook, Google and LinkedIn for investigative purposes. This makes a lot of sense—scan some photos, look for red flags in your search results and make sure your date has been honest about their work history. (note: if you find NOTHING - be suspicious. Better yet, don't meet people online.)

Some still stick to one platform—27 percent use Facebook only, 13 percent use Google only—but some searching is done nonetheless.

Now, the concept of "online stalking" is nothing new, but I must convey some words of caution for all of you research-crazy daters out there. Yes, knowledge is power, but don't spoil all of the mystery. Try and limit your pre-date investigation to a few basic questions. Ask yourself: Will I feel safe? Is this person an axe murderer? Is he going to dress like Marty McFly? Once you've squared all of that away, leave some room for on-the-date discovery. (and only meet in public the first few times)


(This would only work if the 'date' was using their REAL name and REAL location/ job - EOPC)

original article here

In Just One Hour Online...

It took just one hour for internet experts to find out almost every private detail of one woman's life

Steve Boggan challenged web experts to see how much they could discover about his partner. The results were chilling...

As I sit writing this, I am feeling vaguely grubby — guilty even — in the way a neurotic husband might after hiring a gumshoe to go trawling through his wife’s secrets.

There is a 15-page report in front of me chronicling virtually every aspect of my girlfriend’s life: past and present. That includes her friends, education, embarrassing pictures, former boyfriends and long-forgotten relatives.

Much of the information is new to me. And the uses to which it could be put — uses I hadn’t dreamt of until this week — are chilling.

Armed with this information, criminals could use her identity to commit fraud or resurrect minute details of her past, her movements and friendships to lure her into scams or even dangerous liaisons.

It could be used to con her into revealing her bank details and credit card numbers.

My internet snooping began because the CEO of Google, Eric Schmidt — a man not known for worrying about internet surfers’ privacy — suggested recently that young people might want to change their identities in the future in order to separate themselves from a past lived too openly on the internet.

We all know Facebook pictures of you dancing at a party with a traffic cone on your head might come back to haunt you. But change your identity completely?

Surely, I wondered, there isn’t enough out there to warrant that.

So I decided to find out how much I could discover about my partner of 12 years, Suzanne, just by using the internet.

Before you think I’m a rat, I should point out that Suzanne, a 39-year-old with a soft furnishings business, agreed to it.

I began in the way lots of identity thieves do: with her name and address. Of course, I knew these details, but identity thieves often discover them by ‘dumpster diving’: looking through dustbins for a discarded piece of mail.

I passed Suzanne’s name and address — but no other details — to Adam Laurie, a 48-year-old computer security and internet privacy advocate.

He shared the information with Chris Sumner, 39, another security expert, who works for a multi-national corporation.

Or at least, that is Sumner’s day job; by night, he analyses vast amounts of information publicly available on the internet to see what it can tell him about criminal activity — in this case, how fraudsters are using social networking sites to choose their victims.

Using sophisticated and completely legal computer techniques, he looks for patterns in the behaviour of internet users to uncover otherwise hidden links.

In the case of social networking sites, he can see just how close two people, or groups of people, really are to each other.

He had met neither me nor Suzanne and knew nothing of her existence until given her name and address.

A day later, his findings dropped into my email inbox.

Picking Suzanne’s life apart, he told me, had taken him just over an hour.

This is because, in common with millions of people in Britain, Suzanne uses the social networking sites Facebook and Friends Reunited, and has signed up to the business networking site LinkedIn and Flickr, the photo-sharing website.

By also using the genealogy website ancestry.co.uk, Sumner was able to piece together the names of all but one of Suzanne’s relatives, including cousins.

Using electoral rolls on 192.com and by searching on Google, he found the addresses of her parents and lots of her friends and colleagues.

From her LinkedIn and Facebook profiles, he found the names of Suzanne’s primary and secondary schools, and a college she had attended in Derby. He also discovered she had studied fine art at Central St Martin’s College of Art & Design in London.

He also had details of Suzanne’s qualifications and pictures of her from her days at school. The snaps weren’t hers — an old schoolfriend had put them on Facebook.

There were some naff hairstyles, but that was as deep as the embarrassment went. Only you know whether a trawl of pictures of you would be more damaging.

But Sumner didn’t stop there. He was able to tell me that Suzanne had travelled extensively in Europe, Asia, the Caribbean and the South Pacific.

This was because she had used an application on Facebook that linked to the travel website TripAdvisor. You fill in where in the world you have been to keep your relatives up to date. But anyone can see it.

He was not only able to list all 41 countries she had visited, but also the 162 towns and islands to which she had been.

Sumner was able to tell me Suzanne’s exact movements by cross-referencing her TripAdvisor entries with photographs she had posted on Flickr.

When you click on a picture on Flickr, a small box gives you access to detailed information that is entered not by you, but by your camera. So, the date and time of the shot are included.

Now that phones and cameras have GPS, there are even concerns that the location of where you uploaded the picture — normally where you live — might be visible.

From a mixture of all of these websites, Sumner listed Suzanne’s likes, dislikes, hobbies, the 34 towns and cities she had visited in Britain, the places where she used to socialise in her youth and details of her former jobs in the newspaper industry.

In fact, it’s fair to say that after just one hour’s trawling he knew more about many aspects of my girlfriend’s past than I did.

Shocking? Perhaps. Yet also astonishingly easy. Suzanne had voluntarily signed up to these websites and, bit by bit, put most of this information out there herself — and forgotten much of it.

However, what I found even more disturbing is that much of what Sumner found was supposed to have been visible only to people whom Suzanne had accepted into her inner circle of ‘friends’ on each networking website. This turned out to be dangerously naive.

Over the years, standard privacy settings— notably for Facebook — have changed, so what you once thought was private has become public.

You are notified about these changes, but if you forget to adjust your individual settings to return to the old level of privacy (which can be fiendishly complicated) then some of your private information becomes available for everyone to see.

‘There are some weird, strange quirks that let you into places you aren’t supposed
to go,’ says Sumner.

‘For example, on Facebook you may not be allowed to see someone’s photographs because they’re private. But if they post a message with one of their photos attached, you are given the option of seeing their whole album. And as you can imagine, that can be embarrassing.’

According to Sumner and Laurie, organised criminals are using this information
in increasingly sophisticated ways to target victims.

‘Criminal gangs are carefully fishing for victims,’ says Laurie. ‘In the past, they would have sent out thousands and thousands of spam emails in a scattergun fashion — and many still do.

‘These are called phishing scams and involve fake requests from banks asking
people to confirm their account details, passwords and so on. The hope is that, once in a while, someone would be silly enough to reply.

‘Today, they are much more targeted. For example, with the information we got about Suzanne from Flickr, you would be able to see where she visited, when, and, if there were captions on the pictures, with whom.

‘After that, the criminals (or romance scammers) would tailor a scam. If they noticed that, say, she was a regular visitor to Malawi, they would make an introduction online, claiming they were a friend — for example, called Dave — of someone she visited there with five years ago.

‘Surely she remembers them? From that beach — her friend was there, too ... yes?

‘Usually people are too embarrassed to say they don’t remember. Then ‘‘Dave’’ claims he is setting up an orphanage — would she like to make a contribution towards it?

‘Or they might simply say they’re a friend of a person you were with and say he’s gone back there, broken his leg and they’re having a fund-raising collection to airlift him home. It’s crude, but effective.’

Sumner says it can get even more complex, with software tools that can work out who is friends with whom among your online groups of contacts.

‘Once you have established a person’s inner network, you go back into their history to find someone they knew at school who isn’t in that network of close friends and who hasn’t signed up to networking sites,’ he says.

‘Then you join those sites in their name, establish yourself with their online identity and ask your original target to accept you as a friend on, say, Facebook.

‘Before you know it, you are inside their life as a trusted person they think they used to know.

‘Once you are in, you can read about what your target and their friends are up to, such as when they are going on holiday. With that information, you can burgle their homes.

‘You can even ask to be Facebook friends with their children. This is a particularly frightening way for someone to stalk you or your family. They can introduce themselves as a Facebook friend of Mum or Dad. And then it’s only a couple of steps away from something awful happening.

‘Teenagers, in particular, are very indiscreet and post hundreds of pictures of themselves, sometimes drunk with their friends in the living room in front of the plasma screen TV or home cinema.

‘Not only are these the sort of pictures that will come back to haunt them in the future — potential employers aren’t supposed to look at these, but they do — but it’s also a dumb way to show burglars what property you have and where it is.

‘Especially after your children have told all their “friends” when the house is going to be empty.’

Sumner described how some of the information he gained from Suzanne would have helped him to get hold of her bank and credit card details. I won’t reveal exactly how he did it, but it involved using some of her social networking information to gain her confidence, then posing as a friend and asking if her business would make some curtains for him with a sample of material he’d seen on another website.

The catch would be that he had set up that other website himself and when she visited it some rudimentary programming he had installed would help him acquire her credit card details.

I ask Suzanne if she would have fallen for the scam. ‘It’s hard to know, but based on what he said, why wouldn’t I have gone along with the requests of a potential customer?’ she says.

There are other ways, too, that criminals can use personal information harvested from the internet. For example, people often use the names of their children or
pets as passwords for online shopping sites.

If criminals can find these names, by gaining access to your social networking circle, they can try to hack into your accounts on popular shopping sites such as Amazon and view your shopping history, or even order expensive goods to be sent to a pick-up address. (I did not ask Laurie or Sumner to attempt this because it would be in breach of data protection law.)

What can we do about all this? Well, not a lot, other than to be aware your information can be used in more sinister ways than you can possibly imagine, and to be on your guard.

As for your children, they can be warned to modify their behaviour and to think twice about what they write and post online and whom they accept as ‘friends’.

According to Linda Weatherhead, principal policy advocate for the campaign group Consumer Focus, social networking sites bear much responsibility for this explosion of potentially useful information.

‘It is a complex problem, but one simple way of making things safer would be to have all our information kept private as the default setting,’ she says. ‘Then it would be up to you how much you want to relax them as you decide to share more of your private
information.

‘Beyond that, we just have to be careful what we put out there — you can advise children about what they are doing, but you can’t wrap them in cotton wool. You can never make anything completely safe.’

But if Adam Laurie and Chris Sumner are right, then the risks of social networking extend far beyond a few embarrassing photos.

In particular, be careful who your ‘friends’ are; they could turn out to be your worst enemies.

original article here

Private or Public Communication?

By Doug Lacombe

(CANADA) Attendees at my social media seminars often ask how to keep business and personal separate in social media.

The older they are, the more likely that question comes up. It's generational angst on the death of privacy. They seem unaware that privacy is virtually dead already.

The only privacy filter you can trust is the one in your head. If you don't want something on the web, on the news or spread around the office, don't say or share it. No amount of reassurance will convince me Facebook or any other social network has the privacy settings right. As a result, I assume everything I say and do on the Internet is on the public record.

This collision of the private and public is causing some consternation in the workplace.

The International Bar Association (ibamedialaw.wordpress.com) recently blogged: "Experts have stated that 'the intersection of social media and the office is a potential minefield," creating numerous possibilities for a wide variety of lawsuits. A manager 'poking' an employee on Facebook might give rise to a sexual harassment claim. Or perhaps an employer may rescind a job offer to an employee after learning via Facebook that the applicant is of a particular religion or sexual orientation."

Granted this is the litigious U.S.A. we're talking about here, but it's true in Canada, too. A little over a year ago I served as an expert witness in a case where a group of workers who harassed a co-worker, both in person and on Facebook, were fired. They claimed their communications on Facebook were private. I was able to dispel that myth, leading to the case being settled. In that case the employer prevailed, but in the absence of case law, that's increasingly uncertain.

original post here

DON'T TAKE GOOGLE FOR GRANTED!

Instead of taking Google for granted, we need to remember that criminals get the same easy access to information we get from a capable and quick search engine.

To see what the Internet knows about you, start by going to the Google site or by using the Google toolbar. Next, either type your name in quotations or, for a more refined search, type intext: (intext with a colon) immediately followed by your name in quotes. Now type your address or phone number, and Google may turn up a church or a social group directory listing. If this doesn't surprise or outrage you, type into Google your social security number or credit card numbers. (You can also use metasearches such as Mamma.com, Dogpile.com or others)

So never put anything personal, such as your social security number on a resume, on the Internet, not even temporarily. Be careful about using the same nickname over and over - especially if you have posts on sites you'd prefer others don't see. Sites like Archive.org can have incriminating posts of yours cached for years.

And if you find such information on a cached Web page - find out how to get it removed and do so, if possible. (google cache can be PERMANENT)

ORIGINAL POST

Minimize What People Can Find Out About You Online

People Search Engines: They Know Your Dark Secrets … and Tell Anyone
By JR Raphael, PC World

Social search engines can turn up your Amazon Wish List, photos of your kids, where your kids go to school, your address, your business, where you went to school, your musical tastes, your medical problems, all about your breakups & divorces, your mental health status and much, much more. What else is out there that you don't want everyone to know, and what can you do to protect yourself?


I know things about my lawyer I absolutely should not know. He's 55 years old, listens to the music of the band Creed, and screams like a little girl when riding roller coasters. He also relaxes with New Age spa treatments and is thinking about getting an electronic nose-hair trimmer. And that's just the start.

Now, let me be clear: I've never spent a single moment outside the office with this guy (and for what it's worth, I'd just as soon not be privy to his personal grooming habits). I learned all of these details by tracking his social footprint across the Web -- and he probably has no idea that he has left such a vivid trail behind.

In our age of social sharing, we expect some of our thoughts to be public. But as we slowly put more and more pieces of ourselves online, specialized search engines are making it easier than ever to pull them together into a highly detailed (and potentially invasive) profile of our virtual lives (read "Online Stalking Made Easy").

I'll let you in on a little secret: The picture isn't always pretty. And even if no rap sheet turns up, do you really want the world to know that you look at bad-breath cures online or post awful "Star Trek" fan fiction?

The depths of the Deep Web
You hear a lot of terms bounced around when you talk about this growing breed of search engines. Some services like to be called "social search" utilities, while others prefer the phrase "people search." Many boast of their ability to delve through the "Deep Web" that even Google doesn't touch.

"Even though most people think the size of the Web is basically the Google crawl index, there's actually a lot of information that Google doesn't crawl," says Harrison Tang, founder and CEO of Spokeo -- which, taking a mash-up approach to its identification, describes itself as a "social people search engine" service.

People search engine Spokeo is upfront about what it thinks it can find on anyone.
Spokeo, like its competitors Pipl and CVGadget, is designed to let you dig up information on friends, foes and anyone in between. Spokeo goes a step further than many of the other services, though, by importing your entire e-mail address book.

Then, for a few bucks a month, it continually monitors your contacts and lets you know whenever anyone has done anything new, anywhere online. (The site's home page promises to help you "uncover personal photos, videos and secrets," including "juicy" and "mouth-watering news about friends and co-workers.")

Each individual bit of information may seem insignificant, but the cumulative effect of seeing it assembled in a neatly packaged portfolio is enough to give almost anyone pause.

"Aggregated identity is actually a new type of identity," Tang says, theorizing about why so many people seem to use the word "spooky" when describing his service. "A lot of people know that they have a public MySpace page, a lot of people know that they have a public Twitter album. But, when combined together, it's not one plus one equals two -- you actually create a new identity."

How Spokeo works
Spokeo's system uses your contacts' e-mail addresses to track their activity on a few dozen services, ranging from basic blogs and social networks to a slew of photo- and video-sharing sites. That means the random photos of your kids you shared on Flickr two years ago (or perhaps those less innocent images from your spring-break trip a decade earlier) will pop up right under your name, seconds after someone searches for you.
Less obvious sources such as Amazon Wish Lists, Pandora playlists and movie rating sites fill in the colorful details that you may not have realized were out there at all -- things like (in my lawyer's case) an affinity for New Age jams and nasal maintenance.

I found Mr. Attorney's age on an old MySpace profile and his roller coaster behavior on a personal YouTube video, but Pandora divulged his cravings for Creed and his suggested usages for the "Spa Radio" station he had created. As for the nose-hair trimmer, he can thank his Amazon Wish List for sending that factoid my way.

For sale: Your information
Rapleaf gathers information from the Deep Web -- often posted by you -- and sells it to marketers.

Other services access the same data and then sell the information under the banner of marketing research. One highly visible example is Rapleaf, a company that describes its services as "data and people lookup." Clients pay thousands of dollars to have detailed social profiles of individuals compiled in their own customer databases. As is the case with the data that Spokeo assembles, the information is all publicly available -- Rapleaf just brings it together. "Things that people have posted are out there for anyone to come and see," says Joel Jewitt, Rapleaf's vice president of business development. "As long as you're not going beyond that, that's within the privacy norms today."

Most of Rapleaf's clients, Jewitt says, are simply trying to understand how to use social media more effectively for marketing. An auto manufacturer, for example, might want to know which car models its customers are checking out and discussing on social Internet services. Armed with the company's list of customer e-mail addresses, Rapleaf would crawl the Web and track down the information, person by person.

"It's pretty standard Web spidering," Jewitt says. "We re-create in an automatic way what someone from the general public would be able to do if they were looking."

Electronic exposure
Whether they target businesses or individuals, the services have one thing in common: Unlike the public-record-driven search tools of the past, the new people-tracking utilities build a highly detailed dossier about you solely from information that you yourself published -- a circumstance that may give you a distinct feeling of discomfort.

"What it does is make the ubiquity of the Internet and the sheer openness of the world tangible," says Internet privacy expert Kevin B. McDonald, executive vice president of Alvaka Networks, a network management firm. "It makes the whole concept of the world sharing of information and the 'no-walls' approach that the Internet was designed for very real to people."

The reality can be chilling if the information is going to certain interested individuals: a curious client, a boss big on background checks or an obsessive ex, say. A recent study reported that half of all British Internet users surveyed admitted to having used the Internet to look up information on a former flame. The ease with which someone can arrange to monitor your every electronic move certainly adds a new dimension to the idea of fixation.

"It is a little 'stalkery,'" says Marc Rotenberg, executive director of the Electronic Privacy Information Center. "If the information is distributed, that's actually a form of privacy. When it's gathered up in one place, it creates some new risks."

Rotenberg is no fan of companies that assemble nuggets of personal but public information to turn a profit. "The fact that someone's made something public doesn't mean that someone else can sell it," he contends. "I would say even with affirmative consent, if there's going to be a market for personal data, the user should get some percentage of whatever value the data has."

Taking control
The thing to remember, of course, is that these services aren't doing anything illegal. The information they gather is information that anyone who knew where to look -- and had the time to do it -- could find. So rather than ignoring the king-size file that may have been collected on you, McDonald suggests, you should try to use it as a tool to understand and control your online identity.

"I've come to the point where rather than be driven by the Internet, I intend to drive it to the degree that I can," he says.

"All you can do is learn to live with it," McDonald says. "That's the confines of the world that we live in."

For suggestions on concrete steps you can take to reduce your online exposure, see "People Search Engines: Slam the Door on What Info They Can Collect."

ORIGINAL

'Rob me' Site = Dangers of Social Networking

By Zoe Kleinman

A website called PleaseRobMe claims to reveal the location of empty homes based on what people post online.

The Dutch developers told BBC News the site was designed to prove a point about the dangers of sharing precise location information on the internet.

The site scrutinises players of online game Foursquare, which is based on a person's location in the real world.

PleaseRobMe extracts information from players who have chosen to post their whereabouts automatically onto Twitter.

"It started with me and a friend looking at our Twitter feeds and seeing more and more Foursquare posts," said Boy Van Amstel, one of PleaseRobMe's developers.

"People were checking in at their house, or their girlfriend's or friend's house, and sharing the address - I don't think they were aware of how much they were sharing."

Mr Van Amstel, Frank Groeneveld and Barry Borsboom realised that not only were people sharing detailed location information about themselves and their friends, they were also by default broadcasting when they were away from their own home.

Simple search
The website took just four hours to create.

"It's basically a Twitter search - nothing new," said Mr Van Amstel. "Anyone who can do HTML and Javascript can do this. You could almost laugh at how easy it is."

He said that the site would remain live but stressed it was not created to encourage crime.

"The website is not a tool for burglary," he said. "The point we're getting at is that not long ago it was questionable to share your full name on the internet. We've gone past that point by 1,000 miles."

Mr Van Amstel added that in practice it would be "very difficult" to use the information on the website to carry out a burglary.

Charity Crimestoppers advises people to think carefully about the information they choose to share on the internet.

"We urge users of Twitter, Facebook or other social networks to stop and think before posting personal details online that could leave them vulnerable to crimes including burglary and identity theft," said a spokesperson.

"Details posted online are available for the world to see; you wouldn't hang a sign on your door saying you're out, so why would you post it online?"

original article here