Security news16 July 2008
Facebook privacy breach exposed users' hidden dates of birth Roll-out of new Facebook profile design marred by security slip-up
Sophos, a world leader in IT security and control, has warned computer users that Facebook accidentally publicly revealed personal information about its members, which could be useful to identity thieves. Earlier this week, the full dates of birth of many of Facebook's 80 million active users were visible to others, even if the individual member had requested that the information remained confidential.
According to Graham Cluley, senior technology consultant at Sophos, a security slip-up by the website during the process of a public beta test of its new design for members' profiles left birth date information exposed.
Sophos has published the following video on its YouTube channel, demonstrating the security hole:
Facebook revealed dates of birth of users, even if they are 'hidden' from SophosLabs on Vimeo
"I was shocked to see people's full date of birth revealed, even though I knew they had their privacy set up correctly to supposedly hide the information," said Cluley. "It's essential that users of social networks should have confidence that their privacy will be protected - and it's especially important with information like your date of birth, which can be a golden nugget for a committed identity thief."
Cluley says he informed Facebook as soon as he discovered the flaw, which now appears to have been fixed.
"It's good that Facebook fixed the problem - but can people feel confident that this kind of mistake won't happen again in future?" he asked. "My advice to Facebook users would be, even if your date of birth is set to be non-visible, change it to a made-up date in case this kind of blunder happens again. Facebook and other social networking websites need to be more careful about protecting their members' data, or risk losing users."
Sophos recommends that dates of birth on Facebook should not just be hidden, but also fictional.
Sophos noted that birth dates were exposed via the new design that Facebook is trialing for its personal user profile pages, which currently can be accessed via www.new.facebook.com. According to the Facebook developer’s blog, Facebook will start rolling out the new profile page design to users this week.
Facebook's new design for its profile pages, revealed members' personal information even if privacy settings had stated it should be hidden.
Last year, Sophos published results of a identity theft probe into Facebook which uncovered that 41% of users, more than two in five, would divulge personal information - such as email address, date of birth and phone number - to a complete stranger.
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
About Sophos
More than 100 million users in 150 countries rely on Sophos as the best protection against complex threats and data loss. Sophos is committed to providing security and data protection solutions that are simple to manage, deploy and use and that deliver the industry's lowest total cost of ownership. Sophos offers award-winning encryption, endpoint security, web, email, and network access control solutions backed by SophosLabs - a global network of threat intelligence centers. With more than two decades of experience, Sophos is regarded as a leader in security and data protection by top analyst firms and has received many industry awards.
Sophos is headquartered in Boston, US and Oxford, UK. More information is available at www.sophos.com.
