4 ms·
"Secure" and "Facebook" in the same headline. Please allow me to regain my composure. To elaborate, I measure security by three metrics: Confidentiality, Integr
by ax0n 16y ago
"Secure" and "Facebook" in the same headline. Please allow me to regain my composure. To elaborate, I measure security by three metrics: Confidentiality, Integrity, and Availability. Facebook has been fighting Confidentiality tooth and nail since its inception. Therefore, I say Facebook wholly fails the security test.
If you want confidentiality, you have to be certain to share only that which you are comfortable being made totally public. This goes for information written or spoken pretty much anywhere. Long gone are the days of ephemeral communication.
For what it's worth, Facebook's Availability (uptime) is pretty good, and these measures have the potential to improve Integrity, but only if implemented and used properly both by Facebook and the end users.
- Timothee 16y agoPutting aside one's opinion on Facebook's stance around privacy, I think Facebook is one of the sites with the best measures to insure integrity of the site, at least for a consumer site. A few times, I was warned that someone tried to accessed my account from a different computer, and went through a multi-step process to prove that I was indeed me. And, though it was multiple steps, it wasn't too much of a hassle actually. Another time, one of my friends' account was compromised by a scammer and I got the account shut down in a couple of hours. Recent activity and global logout is pretty useful. I imagine Facebook will offer a two-factor authentication at some point down the road.
- tptacek 16y agoA nonsensical comment. Software security is one of the many things that can be purchased using money. Facebook has a lot of money, and they have used it to buy serious software security talent. I trust Facebook with my data more than I trust WePay. And I like WePay.
- Groxx 16y agoTrust them to do what, precisely? Give it away for free, when they change your security settings to "public" by default, while doing a good job at preventing people from hacking in to get almost identical information?
- ax0n 16y agoThat was mostly my point to begin with. At best, these new "security" controls prevent attackers from stealing my account and defacing my data. Facebook loses the confidentiality battle and thus the war.
- tptacek 16y agoSo, we're not allowed to reason about the security of Facebook's actual software, because you disagree with their business practices? Sorry, it simply does not follow that because they don't revere your privacy as much as you do that their service must be insecure.
- ax0n 16y agoYou're allowed to reason about the security of Facebook's software. I simply posit that the security of their software makes little difference when they've already taken a compromising stance with their business practices. Also, I don't disagree with their business practices. It's their place. They can run it however they like just as pg runs this place however he likes. I respect that, and I compensate by being cautious (and wish more people would do the same.) Notice that throughout the entirety of this, I've stated my opinion. No more, no less. I even lauded this move as a way to potentially increase Integrity assuming proper implementation and use, yet I get buried.