Facebook’s Eroding Privacy

EFF’s blog post sets out a timeline showing how Facebook privacy has evolved. It’s gone from this

No personal information that you submit to Thefacebook will be available to any user of the Web Site who does not belong to at least one of the groups specified by you in your privacy settings

to this

When you connect with an application or website it will have access to General Information about you. The term General Information includes your and your friends’ names, profile pictures, gender, user IDs, connections, and any content shared using the Everyone privacy setting. … The default privacy setting for certain types of information you post on Facebook is set to “everyone.” … Because it takes two to connect, your privacy settings only control who can see the connection on your profile page. If you are uncomfortable with the connection being publicly available, you should consider removing (or not making) the connection.

And in another post they set out six things the new Facebook connections feature mean for the information in your profile. Matt McKeon visualises the chnages over time in a blog post The Evolution of Privacy on Facebook.

Adrian Perez sums it up like this

I joined Facebook under certain conceptions that it was a somewhat private place. [...] now it seems that there is something every month where they have started to sell or give more of my stuff to some company without my knowledge. Facebook, used to be fun and cool, but a large part of what I have to do on Facebook now is adapt to their changes on their terms….

Now I wouldn’t have posted about this [...] if I had not been personally affected by Facebook’s actions. I was with my girlfriend and we were listening to Pandora. I look at my Pandora player, and there is my girlfriend’s face (supplied by Facebook) staring back at me with some information about her tastes. This would not have been a problem, except she opted out of that program.

We quickly learned you had to also ban each of the groups Facebook was sharing this data with, as well as hitting the opt-out checkbox.

This immediately congealed a sense of loathing for Facebook. It was a combination of their confusing interfaces, reneging on their former commitments, lack of privacy, and spammy newsfeeds.

You can get an idea of how Facebook views your control of your information in this clip of an interview with their CEO.

So, feeling exploited yet?  Here’s how to delete your Facebook account

• Log in to Facebook
• Navigate to this URL http://www.facebook.com/help/contact.php?show_form=delete_account and follow the instructions.
• Log out and don’t log in again in the next 14 days.  After that time your account will be deleted.

In all likelihood your data will remain on the Facebook servers for an indeterminate period after this, so you probably want to start by deleting all your profile information, applications, inbox/sent folders, networks and everything that you’ve posted.

Update1 : More Facebook privacy problems.  Techcrunch is reporting that for a period of time private chats weren’t actually entirely private.  Facebook say this has now been fixed.

Update2 : Think it can’t get any worse? MacWorld is reporting that if you visited certain sites while logged in to Facebook, an app for those sites was quietly added to your Facebook profile. Facebook say this was a bug and it’s now been fixed.

Update 3: Facebook leaks your internet connection’s IP address when you send a message or write on a wall.  The person tha you sent a message to will get an email notification from Facebook.  The header of that email has the IP address of your internet connection.  That information can be used to discover, for example, where you are.  The mail header looks like this (actual value obscured)

X-Facebook: from zuckmail ([xxxxxxxxxjM1LjE1OQ==])

“xxxxxxxxxjM1LjE1OQ==” is the base64 encoded IP address. Decode it to an IP address with Python

>>> import base64
>>> base64.b64decode("xxxxxxxxxjM1LjE1OQ==")
'xxx.xxx.xxx.159'

and use a GeoIP service to find the user’s location – in this case, Christchurch, New Zealand.

Update 3: The issue of Facebook leaking IP addresses has apparently now been fixed.  Including the IP was apprently a spam control feature.