Facebook and privacy settings: The lock is still broken

by Cinda Baxter on May 14, 2010

in internet, Marketing

Confused by the moving target known as Facebook privacy settings? Join the club. Seems every other week, there’s yet another set of new changes (theoretically) designed to allow users better control over who has access to what on their personal profile pages. The problem, however, is that in spite of the added settings, more of our Facebook info continues to find its way to public eyeballs, including posts that pop up in Google searches, depending on whether or not you’ve discovered the Holy Grail of FB privacy settings.

Which appears to be a fairly short list of folks.

As opposed to the long list of folks who have had it with the confusion.

Earlier this week, Facebook tried to address the problem by breaking down how the myriad of privacy settings work in tandem with one another. Click here to see the roadmap.

I’d hoped Thursday’s announcement of better control over who’s logging into an account might be a partial solution. While this sounds a bit odd to some, the reality is that there are scammers out there who find ways of logging into people’s FB accounts, then spamming everyone in their address book, without leaving a trail. One very savvy friend of mine has been hit three times in the past six months; another, twice. Facebook heard the angry outcry over security, addressing it here with new Login Notifications that alert you any time an entry attempt has been made from a device you haven’t pre-approved.

To register your devices, you need to set the security, log out, then re-log in from each device. That means if you typically visit Facebook from your computer at work, your computer at home, and your iPhone, you’ll need to log out from the computer you’re at now, then log back in to register it…plus log in from the other two devices to register them too. Each additional device will need permission to enter; you’ll see them pop up on your list of approved devices, allowing you to control who gets into your account.

The first problem? These settings aren’t found on your Privacy Settings page. They’re on your Account Settings page. (Gee, any question why people find all this a tad bit confusing?)

Second problem? It doesn’t work. After changing my settings, I was able to log in from both my LG Dare and my iPod Touch without being asked for the additional security hint. Making matters worse, no security notification was sent to my laptop, to email, or to my Facebook messages panel to inform me two other devices had successfully logged in and out of my account.

Third problem? The intent of the new setting isn’t to prevent unauthorized devices from accessing your account. It’s after-the-fact notification someone has wormed their way into your account. Welcome to full blown damage control mode (and that your friends have probably already been hit by the spammer, since they don’t have a tendency to sit around and wait to see if someone catches on before hammering away at one’s address book).

So much for security.

While I do believe Facebook is a valuable tool for business (ie, group or fan pages, whatever we’re calling them this week), I grow increasingly protective of my personal page. Several months ago, I “shuffled the chairs around the room,” paring down the list of people who had access to my page (mainly because I had to keep self-editing when wanting to chat with long time friends, aware there were ears in the room who’d never met me in person, and didn’t know my sense of humor first hand). That gave me a whole new level of comfort when it came to my “voice” in posts.

Since then, I’ve pared back a second time, fine tuning further to limit the group to folks I’d feel comfortable plunking down on the back deck with, over a couple of icy beers. Makes for a much more personal, more familiar experience, in my opinion, while limiting potential damage from spammers. Besides, I’m *highly* visible on The 3/50 Project page, so it’s not like I’m not already out there.

Given the continual unraveling of Facebook’s privacy net, my decisions to pare back seem to be sound ones. Am I happy? Happy enough for now.. Am I convinced my personal account is completely safe? Nope. Not until this alternate device thing gets fine tuned to (a) block unapproved, unregistered devices, and (b) actually works. Then, I’ll only feel comfy until the next cretin figures out how to breach that.

The upside—and downside—to modern technology. Play at your own risk.

Leave a Comment

Previous post:

Next post: