Facebook and Zuckerberg have found the news again, but this time it's about sharing data with the Chinese. This is not exactly a surprise, especially after what was revealed earlier this year. Lawmakers and government officials have the right to be up in arms about this, because sharing of data was independent of any privacy settings that you might have had on your accounts. However, do we really have the right to complain about Facebook sharing data that we already share publicly?
Don't get me wrong, I think this breach of privacy and security is a serious issue. Earlier this year, I posted about how to access some of the hidden Facebook features that were associated with synced contact details from smartphones. However, there is another whole range of security and privacy settings that most people either can't be bothered with or don't know about. Yet, many are complaining about data being shared when they themselves are the ones publicly sharing the data.
Internet security starts with the user.
Security issues on any social media platform falls into two categories: platform settings and user stupidity. It might be harsh to phrase it like that, but what good is it to complain about your address being leaked when you have a photo on your feed that shows your address on that envelope in the background? Or maybe you were a complete fool and actually posted a photo of the envelope itself, focusing on the address label.
Don't laugh. I've actually seen it happen. I won't name names, but two of my friends on Facebook, with zero connection to one another, did exactly the same thing on separate occasions: posted photos of envelopes showing their address and the sender's addresses, boasting about the letters they've received. I just wanted to scream at them for their idiocy. You would think that my family and friends would know better by now, but nope…
(Did you know that the concave of your palm matches perfectly to the curvature of your forehead?)
Platform privacy and security settings can only do so much. You, as the user, need to do the rest. I have written about the dangers associated with those photos and GPS settings on social media before. Perhaps now is the time to go and remind yourself of those dangers.
For the moment, I'm going to assume that you are actually being smart about what exactly you are sharing on social media. So, it's time to turn our attention to Facebook settings.
Who can see what on your profile?
For this post, I'm focusing entirely on private profiles. There is a BIG difference between pages, groups and profiles, but there is no need to confuse that issue now. EVERY user of Facebook will have a private profile. Whether they use it or not is a different story, but exactly what settings do you have?
Historically, Facebook was public, as in any user on Facebook could see what you were doing. Over the years, more privacy settings have been implemented, with a whole range of new settings that showed up earlier this year. Defaults for new accounts were locked down to Friends only, but any account that was grandfathered into the system might still be using older settings. Some of these old historical settings are actually putting yourself AND your Friends at risk.
The image below is the Privacy settings available as accessed through a web browser on a computer. You will have similar settings on iOS and Android, but it's much easier to show you these settings from the web.
The privacy settings as seen via the desktop web browser version of Facebook. Note the settings. My personal account is locked down as far as it can be. (Click on image to see the full-sized image.)
The top setting is who can see your posts on your private feed (also known as your Facebook wall). If this is set to Public, then anyone with a Facebook account can see what you are doing. In my opinion, this is not smart, but I do know some who do things this way. It tends to be authors who wrongly believe that this is the best way to advertise their books. Never mind, they are actually in breach of Facebook's Terms of Use, but that is an entirely different issue.
Your activity (i.e. your posts) should only be visible to your Friends or a subset thereof. (I have my personal feed visible to Friends except acquaintances. It's photos of my children that I'm protecting.)
Then, we get to settings related to who can send Friends requests and who can see your Friends list.
Within the last month alone, I have visited the profiles of 20 different people, all of whom I'm NOT Friends with. It was for varying reasons — for some, it was actually to do an assessment of their internet security (at their request). Of those 20 profiles, on at least 15 of them, I was able to see who their Friends were, see everything that I ever wanted to know about their pets and home — and for some of them, their private contact details was in pride and place, ready for me to hack (if I was so inclined).
People, there is ZERO reason why anyone but you should be able to see your Friends list. Not even your Friends should be given the rights to know who your other Friends are. There simply is no need. If you are a public figure, you do not want to be getting Friends requests from just anyone, so lock that baby down. And if people just happen to have your email or phone number, good on them. Don't let people find you using them. It's just not worth it.
I'm highly active on Facebook. If anything, my activities on Facebook have increased, constantly chatting with other industry professionals about writing, editing, and marketing. Regardless, I follow strict rules for myself regarding my associations and what I post where (and how it is shared). However, the first thing that always enters my mind is how something would look if it was ever made public.
There are other settings on Facebook too, which I won't go into detail here, but I would strongly encourage EVERYONE who uses Facebook to take the time to go through their personal privacy and security settings. Make sure you know exactly what it is that you are deliberately sharing with the public. What Facebook has secretly shared with others is an entirely different issue.