Facebook has added new security tools amid a reported panic as pressures from privacy advocates and the U.S. government mount. One new Facebook tool lets users control what devices access an account and sends notifications about unauthorized access attempts. Facebook also blocks suspicious log-ins with an additional verification question.

Is Facebook panicking over its latest privacy crisis? The leading social-networking Relevant Products/Services site has seen its share of privacy backlash in its brief lifetime. However, with criticism mounting from privacy advocates and the U.S. government alike, the young company may be feeling the pressure like never before.

Facebook held a company meeting to discuss privacy issues in what some bloggers have described as a panic-stricken response to public attacks on how it handles member information. Facebook also announced two new security measures Thursday that aim to keep member accounts and personal information secure.

“It would definitely appear that Facebook is moving at a very fast pace, perhaps, in many cases, too fast for some of its users,” said Michael Gartenberg, a partner at Altimeter Group. “On the other hand, the market almost demands that type of fast pace, and consumers need to understand the implications of what they are doing online and take responsibility.”

Securing Your Facebook Account

One way consumers can take responsibility is to use the new Facebook tools that work to keep the bad guys out and keep members aware of any suspicious activity so they can take action to correct it.

“Over the last few weeks, we’ve been testing a new feature that allows you to approve the devices you commonly use to log in and then to be notified whenever your account is accessed from a device you haven’t approved,” explained Lev Popov, a software engineer on Facebook’s site-integrity team. “This feature is now available to everyone.”

The security feature lets users select the option to receive notifications for log-ins from new devices. You can save your home computer, your school or work computer, and your mobile phone, for example. When you do this, Facebook will ask whomever logs into your account from a device that is not on the list to name the device and send you an immediate notification that someone tried to access your account. That notification offers details on how to reset your password and remove the device, in case it was accessed by a cybercriminal.

Facebook also built in a new system Relevant Products/Services to block suspicious log-ins before they happen. When Facebook notices you (or someone who is not you) is trying to access your account from a device not listed in your account security settings, the person will be asked to answer an additional verification question to prove person’s identity as the authentic account holder. After you confirm your identity, you can review recent log-ins and reset your password if you see log-ins you don’t recognize.

Will Friends Be Appeased?

Still, the new moves may not be enough to appease critics, even as some members are permanently deleting their Facebook accounts. But many analysts agree with Facebook that some of the onus should fall on consumers to protect themselves.

Gartenberg said there are strong privacy settings on Facebook. Users who are concerned about the public seeing their status updates and conversations on search engines should take a closer look at those settings.

“You just have to do a search for something like ‘my stupid boss’ to see how many people are putting things out there that they may regret or may not understand are public, and that’s where the disconnect is,” Gartenberg said. “Facebook just needs to connect with users to make sure they understand what’s being shared publicly and what is a private conversation.”

No related posts.

Google will begin letting users run encrypted searches on its flagship search site Google.com starting next week, the company said in a blog post Thursday.

Allowing users to search using https – the web security system which many associate with online banking and shopping — would mark a first for a major search engine, and could begin a move by web services such as social networks to begin offering encryption for more than just log-ins. Such increased adoption would cut down on network eavesdropping and also have the added benefit of preventing some online attacks.

Ironically, the announcement of the upcoming change came in a long blog post explaining that the search company had been “mistakenly” eavesdropping and recording what people were doing on unencrypted wi-fi networks as its Street View cars were taking pictures of cities around the world and recording the IDs of wifi networks and routers. That data is used to help geo-locate people using devices without GPS, but the company has said for years it was not collecting session data.

Google turned on encryption — better known as https:// — as a default for Gmail users earlier this year. That encrypts the data sent between a user’s browser and Google’s servers, making it nearly impossible for someone in the middle to read the contents of that e-mail. When not using SSL, a user of a school or corporate network can have their e-mail and web traffic content read by authorities who control the network, while anyone using an open Wi-Fi connection can have their traffic sniffed by a hacker using simple tools.

Gmail was the first major webmail service to offer encryption for full sessions, rather than just for log-ins. Google allowed power users to use https:// for years, and under pressure from privacy and security advocates turned it into the default for all users earlier this year. In contrast, Gmail’s competitors including Yahoo Mail or Microsoft’s Hotmail don’t even offer https sessions as an option.

Using https, rather than http, is not technically difficult, but the authenticating handshakes between a server and a browser do require more resources from both a server and the browser. That means it costs a company more to run a service and can slow down an application.

Read More http://www.wired.com/threatlevel/2010/05/google-encrypted-search/#ixzz0o7LP1Gnt

No related posts.