When it comes to the web, convenience is king and data is the core currency. The internet has undoubtedly simplified our lives, of course, the reason we use things like Facebook Login is the convenience, both for the site developer and the end user. Rather than create a user name and password for every random website, developers can simply piggyback on Facebook’s (or Google’s) generosity. With Facebook Connect, the social giant streamlined account registrations for the web at-large. But below the surface, Connect it’s not all it’s cracked up to be. So, what is Facebook Connect, and why shouldn’t you use it?
What is Facebook Connect?
Facebook Connect allows Facebook users to sign onto third-party websites through their Facebook accounts. It expedites the account registration process completely. Users can avoid the added time of filling out all required fields, such as full name, address, and birthdate by providing third-parties with access to their Facebook. Of course, it does simplify the users’ online lives as it avoids the need for remembering another set of login credentials.
When a user signs up with Facebook Connect, they provide the associated third party with access to their entire profile. This includes full name, photos, wall posts, and friends list. It can also mean the third party can post to Facebook on the user’s behalf (though this is rarely practiced).
Facebook’s Drive for Data
It’s common knowledge that Facebook requires users to forfeit a considerable amount of privacy. Years ago, founder Mark Zuckerberg argued that privacy is “no longer a social norm”; later Facebook attempted to backtrack. Yet despite the ongoing public declarations that privacy is important, Facebook’s business model and controversies indicate otherwise.
Ads run rampant on Facebook, and they’re not of the general one-size-fits-all variety. Instead, they’re specifically catered to each user’s demographic, location, personal interests, and past clicks. It follows then, that Facebook would want to solidify relationships with as many third parties as possible – it’s beneficial to all involved.
As part of Facebook Connect’s setup, Facebook gets third-party data, and third parties get Facebook data. The level of information goes far beyond what standard cookies would pick up. Remember, when you use Facebook Connect, you’re essentially handing over access to your entire account. That means they can see everything. And if this all wasn’t bad enough in abstract, the Cambridge Analytica debacle drives the point home. The fiasco has led to many publicly proclaiming their intention to delete Facebook. The fallout illustrates just how much data Facebook and its affiliated third parties harvest, and how untrustworthy these entities have become.
In a world where data is in high-demand and pried from users unknowingly, simply handing it over is not a wise choice. Users should be making concentrated efforts to protect their privacy, not sacrificing it entirely in the name of convenience. The risks from giving your data away dwarf whatever time you save from a Facebook Connect sign-up.
In the wake of the Cambridge Analytica scandal, Facebook assured us that it was going to limit how much data its partners receive (user’s name, profile photo, and email address upfront, with access to Facebook posts upon further permission), and restricting access to a user’s data once they stop using the partner’s app.
While this certainly sounded good, it’s not clear how Facebook actually audits its partners to ensure compliance, and beyond saying the partners “will sign a contract”, it’s not really clear how tight the restrictions are anyway. This is, after all, Facebook, and a strict focus on user privacy is hardly what it’s known for.
Additionally, while Facebook claims to be tightening access to personal data for its partners, there’s apparently no limit on its own appetite. How Facebook will use that data – perhaps to enrich a profile and then serve ads from a competitor? – is a black box to the businesses using Facebook Login, and an even “blacker box” for consumers.
Not to worry at this point. It gets worse.
The unintended exposure of Facebook data to third parties is not due to a bug in Facebook’s Login feature but rather the lack of security boundaries between the first-party and third-party scripts in today’s web. Facebook has called scraping of Facebook data a “direct violation of (our) policies”. It said it would investigate all issues raised but, just to be careful, a spokesperson said:
We have taken immediate action by suspending the ability to link unique user IDs for specific applications to individual Facebook profile pages, and are working to institute additional authentication and rate limiting for Facebook Login profile picture requests.
Remarkably, Facebook only reacts to security holes, rather than proactively making it harder to exploit its lax approach.
As just one example, Facebook doesn’t always read the terms and conditions imposed by its partners, as it revealed in Parliamentary hearings. So, should we really think it is going to instigate deep investigations to ensure the partners that feed it data are in turn respecting user data? It’s not likely to bite the hand that feeds it.
Hack One, Hack All
Facebook Connect isn’t merely a privacy risk – it’s a major security risk, too. The problem with linking a handful of online accounts with your Facebook, is simple. If one account is compromised, they all are compromised.
Should that occur, the privacy fallout would be severe. It’s bad enough giving all your personal information to those looking to make money off of you. It’s even worse if that data falls in the lap of someone with even more malicious intentions.
What to Do Instead
Short of deleting Facebook and other social profiles entirely, creating separate logins for every account is a must. That includes a strong, unique password for every account. That may seem overwhelming, but with the help of the Insta Password Generator, it’s simple!
Once you’ve created individual passwords for each account, use a password manager to keep track of them all. This eliminates the need to memorise dozens of long, complex combinations. And of course, remember, whenever you connect to the internet, you should do so through a VPN to shield your internet traffic with encryption, so you can surf freely without ISP monitoring.
