Social Networking Site Safety Questioned 73
An anonymous reader writes to mention a TechNewsWorld article about social networking sites. Researchers are finding these places are goldmines for social engineering exercises. Between worm attacks and simple human observation, sites like MySpace are the perfect place to obtain saleable personal information. From the article: "The danger is real, according to a study conducted by CA and the National Cyber Security Alliance (NCSA). In October, the alliance issued its first social networking study examining the link between specific online behaviors and the potential for becoming a victim of cybercrime. Despite all the publicity about sexual predators on sites like MySpace and FaceBook, the alliance took a different approach by measuring the potential for threats such as fraud, identity theft, computer spyware and viruses. Although 57 percent of people who use social networking sites admit to worrying about becoming a victim of cybercrime, they are still divulging information that may put them at risk, as Boyd suggested. Social networkers are also downloading unknown files from other people's profiles, and responding to unsolicited instant messages that could contain worms, the NCSA reported."
it holds true for myspace (Score:2, Insightful)
Yeah, well you know what you have wherever there's a goldmine. Gold diggers.
Re: (Score:3, Interesting)
Aren't your local White Pages more dangerous by default? I mean those are opt-OUT, while MySpace is opt-IN
Re: (Score:2)
1) What I look like
2) My ethnicity
3) My age
4) My interests
5) My apparent level of intelegence
6) My buying habits
7) How I react to different situations
Heck, the white pages tell you my name, number, and where I live (white pages do have address, right? I have never bothered looking in them as I livei n NYC and it is an exorcise in futility)
Re: (Score:2, Informative)
True, the white pages are an opt-out system. All you have to do when you sign up for new phone service is ask for an unlisted number; some operators will give you the option during the call. If you choose to have your number listed, while it will be available through directory assistance, your number will not be listed in the local white pages until the new book is published. Even then, with the local white pages your number is only seen locally.
With MySpace, your information is instantaneously av
Re: (Score:1)
If you choose to put it out there - you don't have to put your address and phone number on. I don't see why posting on MySpace is inherently more risky than posting on Slashdot.
Another problem with MySpace, people can create accounts for you and post information about you and you may be completely unawares.
This is true of everywhere on the Internet. Maybe someone could post all your
Re: (Score:1)
Fix the ohter end? (Score:3, Interesting)
all the best,
drew
Re:Fix the ohter end? (Score:5, Funny)
General:
Music:
Mother's Maiden Name:
Movies:
Television:
Social Security Number:
Books:
Heroes:
Re: (Score:1, Redundant)
Favorite Color:
First Pet's Name:
Date of Birth:
City where you were born:
Drivers License Number:
Credit Card Numbers and Expiration dates:
Your Password:
Re: (Score:2)
You have the wrong "other end" identified. The "other end" that needs to be fixed is the human creating the profile. People should not be entering data that can be used against them (birth date, sex, full name, etc).
"If someone tells you to jump off the Empire State Building, would you do it?" Just because the form asks for your personal info does it mean you
Re: (Score:2)
Or they should use a system that lets them display only the appropriate profile details for each group or person or whatever - like indi [getindi.com].
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Insightful)
Ah, yes, people revealing incredibly personal details like their name is the problem. Phone books must scare the crap out of you.
No, the problem has nothing to do with myspace or any other directory of names, the problem is that it's trivially easy to do things (like getting a credit card or a
Re: (Score:2)
I suggest you read my signature.
Re: (Score:2)
Bingo, and yet you are liable. My take is that the whole thing comes down to laziness and a desire for convenience on the part of businessmen.
Well, plus, this thread shows how many want to blame the public for the results of an insecure system.
I should be able to put out all my personal details a
Re: (Score:1)
You know the answer: because some of that information is used to verify that you are you.
If we used (for example) public keys for identification, then it would be foolish to send someone your private key. And I guarantee: some people would do that on request.
If we used biometrics for identification., then it would be foolish to send someone your genome. An
Re: (Score:2)
But it obviously doesn't verify that I am me as others can use it to pretend to be me. That is a large part of my point.
Let me put it another way, if you use this info to do business with "me" and it turns out not to be me at all, the risk should be entirely yours.
all the best,
drew
Re: (Score:2, Funny)
Hi, my identity was recently stolen so for today I'm going to be... Bob. I'm a middle aged career... actuary? Actuary, is that right? Okay. I have... three kids and a mortgage that's 2 months overdue. But I didn't buy that house, this is just my backup identity. Wait, what do you mean there's a warrant out for my arrest. I've never even been to Georgia.
Ex-fricking-actly (Score:3, Interesting)
Of course, the only really reliable way of proving identity is some kind of private key crypto backed up by high-end biometrics (eg, retinal scan, or dna), and the odds of something like that being implemented are hilariously low, for about a million reasons.
At the very least there needs to be some sort of private ID that is us
Yeah, why is this just now an issue? (Score:2)
Re: (Score:1)
the answer to this is so simple... (Score:5, Interesting)
One of our HR people just to prove a point attempted to look at my profile, and then sent me a friend request which I denied for that reason. Making a definitive wall between work and whatever it is that I do at home is very important.
Re: (Score:1)
Perhaps I'm being trite but wouldn't that fall into the same category as "Don't put that information up there in the first place"?
Consider that you're telling people to make their profile private when they were naive (dumb) enough to publish their personal info for everyone to see to begin with.
Re: (Score:2)
Re: (Score:1)
The problem isn't that people aren't making their profiles private, the problem is people are
"Slashdot" is not Facebook's target audience (Score:2)
The mention of children leads me to believe you are not a university student.
I take a lot of pictures. A lot of pictures. As in, I've taken 12 gigabytes of photographs since March 2006. And every time I'm at a party or barbeque or Frosh Week or some audition, taking pictures as I'm wont to do, people always say the same thing. "You're going to put these pictures on F
Re: (Score:1)
The claim that people aren't interested in the pictures rather preclude that poster from being a parent too. We parents all know just how deperately the world awaits our next couple of Gig of pictures (and video!). And when I take pictures at various events (ie. a school field trip), all the parents want to see the pictures.
On the other hand, Facebook is far too limited. My "alumni" account from grad school has long since aged a
Re: (Score:1)
That's the funniest thing I read all week. What do you mean you denied him..your HR staff want to be your friend! Don't be such an ass. Besides, you don't want him to report to your boss saying that he sent you a friend request on Myspace and you declined. Oh wait, maybe you do.
Re: (Score:1)
In other news (Score:5, Funny)
Re: (Score:1)
Re: (Score:2, Interesting)
Nooooooooooow ya tell me!
Actually, I think, in a bit of irony, I caught this one from the UPS man the last time he handed me a crate of Kleenex through the basement window, 'cause I don't remember leaving home lately. I'll have to wear gloves and soak them in Vodka for a week before handling them next time.
In a bit of further irony today I had intended to be far away from anywhere with a net connection, or people, but I couldn't leave home, becasue I have
of course (Score:2, Interesting)
Myspace, hi5, bebo, is just to name a few i see around here in job corps,
ever wonder why AOL Userers got the most phising emails, because most AOL users where morons
Newsflash: People are STILL stupid. (Score:5, Funny)
Re: (Score:1)
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
I used to work for a large multinational company. Occasionally customers would be asked to prove their identity for certain services. For this, they would be asked to send/fax in photocopies of documents proving their identity. Which is of course normal practice for many companies.
Regularly, and I mean at least one a week, people would send in things like their passports. Not copies, their actual
Re: (Score:1)
Obviously (Score:1)
People don't find these sites anymore. They go online specifically to accumulate profiles, with no knowledge of what they're doing. Of course it's going to go horribly wrong.
Nosey sites (Score:2, Interesting)
Re: (Score:1)
> compromised and they cannot log in) and a date of birth (COPPA requirements).
Why do I need to `confirm that the email is my own`? Why not just let me create a user name and password so I can log in in future. Messages could be sent to an account on the site, and not email. I don't want any more email, thanks - I get all the email I desire from friends, family and work. You
This...just in! (Score:3, Funny)
Automated Privacy Rights (Score:3, Insightful)
I'm really annoyed every time I have to type my name/address/email into a Web form. How many times have I typed that info in the past 10 years of the Web? Why can't forms include either Javascript or even standardized APIs for requesting the same personal info? In increasing scopes with simple descriptive names. So I don't have to let my info sit cached at so many remote servers with which I do intermittent business, any one of which can leak my info at any time.
I want to see a Web GUI show submittable form sections tagged by their target org. I'd like to subscribe to a service that rates forms by their risk, demonstrated by proven vulnerabilities in distributed reporting databases (or whatever my selected advisor uses to decide its ratings). Many people would pay for such a service to advise how much info to disclose to a given recipient. And many organizations would pay to make using them free, like insurance and bank corps, not to mention governments with insight into the preventive value of informing consumers of disclosure risks, without slowing down acceptable transactions.
People can protect ourselves even more than with just tech fixes. We have the right to privacy in our "papers and effects" [wikipedia.org]: our personal data. We produce a government to protect that privacy. We should specify how they protect it, like requiring all disclosed personal data to be redistributed only within the context of the transaction into which it was delivered, unless explicitly agreed otherwise by the sender. Maybe even a Constitutional Amendment, to make more clear the privacy rights implicit in the Constitution, explicit in the 4th Amendment, but still not protected enough for adequate security in the modern age.
Easy Sum: (Score:3, Funny)
Re: (Score:2)
On the other hand, (Score:5, Interesting)
Re: (Score:2, Interesting)
I agree. I think there is a difference between caution and paranoia. As long as you aren't stupid, and don't make available information such as credit card numbers, social security numbers, and so forth, I don't see much wrong with posting basic demographics like age, sex, and even locations. It's the type of information that can be obtained by someone who wants it, anyways, and can potentially add to the sense of the online "community." I don't have a MySpace, but I do have a Facebook profile. I keep
Poison the Well (Score:2)
So spammers and marketers and others are data mining social networking sites. Great, I think it is the duty of each of us to go create a fake site with a fake name and link to a few other people. Heck we can even get creative and talk about "favorite" products. Maybe I'll accidentally post the number of a local law firm claiming it is my home number :)
Teach internet responsibility in school (Score:3, Interesting)
We need to teach the kids that not everyone on the internet is your friend. Not everyone on the internet is who they say they are. You can protect yourself from malware by using safe browsing behavior (don't click OK at every message that pops up, smiley face add-ons are not so smiley). Never give out personal information on the internet unless you are absolutely positive that the person you are giving it to is in fact who they say they are, and there is a legitimate reason for it. This means no SSN, phone number, credit card/bank numbers, address, etc.
Like I said earlier, when I was in school, all of this was not really a concern, so I'm not sure if schools are actually teaching this kind of stuff.
Re: (Score:2)
Re: (Score:1)
I agree that this information needs to be taught at a very early age. School would be a great place to teach and reinforce good browsing habits and behaviors. However, I would endeavor to guess that most schoolteachers are not themselves 'up-to-speed' on the latest exploits and tricks.
Despite it being fairly available at the time (mid-late 90's), my house didn't have internet access until I was a junior or senior in high school. Why? My dad didn't know enough about it beyond the basics of his business
Re: (Score:2)
Re: (Score:1, Flamebait)
Without these sites, Chris Hanson is unemployed (Score:2, Funny)
The industry alone should be salivating, for all the pedo-rific jaw dropping action that goes on in a pedo bust.
Without myspace or any of these, what kind of pedos would we watch get busted on Friday night.
There's only so much Michael Jackson to go around.
If you'll excuse me, I just met a 19 (12) year old kid and am going to drive 300 miles away to meet them. (And yes, I always have protection, erotica, booze, and
Brilliant! (Score:2, Funny)
So...places where lots of social networking occurs are good places for social engineering?!
Next you'll be telling me that places with lots of water, fish food, and fish habitat are good places to go fishing!
Re: (Score:2)
For the last time, there is NO FISHING in my aquarium.
Re: (Score:1)