We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

Security firm to Facebook: Clean up your act

Security firm Sophos has published an open letter to Facebook about its security and privacy measures on the popular social networking site, and the message is clear: It's time for some changes in order to better protect users.

In its Naked Security blog, Senior Technology Consultant Graham Cluley tells Facebook that protecting users is easily accomplished with three changes. They include:


"No more sharing of information without your users' express agreement," states Cluley in the post. Users should be able to opt-in to sharing, not the other way around, he said.

"Whenever you add a new feature to share additional information about your users, you should not assume that they want this feature turned on."

Also see: 10 security reasons to quit Facebook and Social media risks: The basics


"It is far too easy to become a developer on Facebook," said Cluley. "With over one million app developers already registered on the Facebook platform, it is hardly surprising that your service is riddled with rogue applications and viral scams. Only vetted and approved third-party developers should be allowed to publish apps on your platform."

Cluley and other security and privacy advocates have long criticized Facebook over the lack on controls it has in place for application development. As a result, many applications are actually scams that lure users into traps by promising them a download of 'the dislike button' or by appealing to their vanity and promising them an application that will show them who is viewing their profile. Instead users end up with a survey scam or with a malware download on their computer.


More about Facebook security and privacy

Facebook recently introduced a HTTPS option, a move that was lauded by security professionals. But the feature is turned off by default, noted Cluley, which means many users are not even aware that it is possible to enable it.

"Worse, you only commit to provide a secure connection 'whenever possible,'" Cluley said."Facebook should enforce a secure connection all the time, by default. Without this protection, your users are at risk of losing personal information to hackers. "

Read more about data protection in CSOonline's Data Protection section.

IDG UK Sites

Best camera phone of 2015: iPhone 6 Plus vs LG G4 vs Galaxy S6 vs One M9 vs Nexus 6

IDG UK Sites

In defence of BlackBerrys

IDG UK Sites

Why we should reserve judgement on Apple ditching Helvetica in OS X/iOS for the Apple Watch's San...

IDG UK Sites

Retina 3.3GHz iMac 27in preview: Apple cuts £400 of price of Retina iMac with new model