click to enlarge

Handle: www.GreenProphet.com

Specs: Inspired by Arthemia Theme by Michael Hutagalung, this theme was rebuilt from the ground up. Many premium themes offer so many features that they loose speed due to inefficiency. This was recoded with only the features the contractor needed, plus was better optimized for SEO and speed, achieving a grade A with YSlow and above 90 with senSEO for contractor’s desired keywords.

click to enlarge

Handle: www.promisec.com

Specs: Design by Steve Spinner, code/functionality by Jack Reichert.

]]> http://www.jackreichert.com/portfolio/promisec/feed/ 0 http://www.jackreichert.com/blog/a-users-guide-to-facebook-security-redux/ http://www.jackreichert.com/blog/a-users-guide-to-facebook-security-redux/#comments Mon, 28 Jun 2010 13:53:35 +0000 jack http://www.jackreichert.com/?p=320 When I joined Facebook, back in it’s early days in 2007, it was a walled garden. As time went on they realized that if they want to make money, they have to leverage their assets, INFORMATION ABOUT YOU, to make money.

Today: “Facebook’s data collection is among the most detailed.”

“For every user id, Facebook keeps a log of the IP address that accessed the account, the date and time, and what exactly the user did — clicking on an advertisement, looking at someone else’s profile, posting a photo or sending a message to a friend, etc.”

Personally, I think that it would have been better to leverage a much bigger asset – YOU and your confidence in them as a service provider. But obviously that’s not the route they decided to go in.

But they own everything you post on their network, so it’s all your fault anyway.

So there have been changes made due to the uproar against the Facebook’s privacy policies. Basically, they made the privacy settings nicer to look at. But that’s about it. It’s a coat of paint covering over a rotting structure.

Click to enlarge

There are still many settings hidden behind multiple levels of settings.

This IS a clear page explaining most of the privacy settings now and I applaud it.

But still, there are several sections dedicated to showing you how you share what. It’s still confusing and unclear how things are shared, what is seen. When I check out my “application settings” from the “account” menu I get a completely different list from when I go to “privacy settings” > “Applications, Games and Websites”.

This very fact tells me that there is probably more that they are hiding from me and I just haven’t found it yet.

But what bothers me the most is that they still reserve the right to opt you in to any new service or privacy setting that they decide to invent. Not to mention that Facebook reserve the right to your content, even if you delete it.

It’s been a rude awakening for me. And I’ve come to the conclusion that I will be not be using Facebook for personal connections, like it was originally built for, what I was lured into it for, but only as yet another way to manage my online presence. What a @#$%-ing pity. It’s such a great tool.

At least I own my own WordPress installations and I will be sharing tips in an upcoming post on how to decentralize Facebook’s control AND share your private life, without actually sharing the actual information via Facebook.

There have been thousands of articles (literally) over the past week about Facebook privacy issues. More and more people are announcing their decision to leave Facebook. And as of this writing, some 15 consumer watchdog groups have filed a formal complaint with the FTC over the changes that Facebook has made recently.

In this article I will go over some of issues involved – without the tech-talk – and explain why they are problematic, plus explain how you can make your account more secure. I will not even go into the security “bugs” that came out recently – with your chat and with hidden applications added to your account. This is about the over policies of Facebook and why they are dangerous to your personal rights.

Table of Contents

• In Defense: A Personalized Internet Experience
• What’s This New “Like” Button?
  • Prelude: “Fan” Pages
  • The Like Button
• Facebook’s Privacy Policy
• Facebook Owns EVERYTHING You Post…
• 6 Steps To Secure Your Account

In Defense: A Personalized Internet Experience

Internet services are trying to answer the question: How do I give the best, personal, experience to my clients? This is a good thing…

When I search in a search engine for an answer, it’s really great when I find what I’m looking for almost immediately. Google, Bing and the like understand this and constantly try to improve their search algorithms so that what YOU are looking for will come up in YOUR results.

Google explains:

“When you’re signed in, Google personalizes your search experience based on your Web History… When you’re not signed in, Google customizes your search experience based on past search information linked to your browser, using a cookie.”

That means that Google saves everything that you search for. This can be scary, the idea of Big Brother watching you all the time. But don’t fret, you can log in and edit your history without much trouble. Or if you’re not logged in, you can delete your cookies and they have nothing on you.

Facebook is trying to provide the same service, essentially. Here they have access to all the wonderful private personal information about you that you have shared… why not use it to provide a better experience for you? Sounds good! Right?

Well here’s the deal: It seems more like they are saying: “Now that we’ve made them comfortable with sharing their intimate details with us, (giving us ownership over their private information) why don’t we cash in on that?”

Let me explain…

Back to top

What Is This New “Like” Button?

aka Get Ready For The SPAM…

Prelude: the Fan Pages

I thought it was brilliant when you could “fan” things… Then I create a fan page myself.

When Facebook first came out with the fan pages I went “fan” crazy and fanned everything I liked. I thought that it was cool that I could tell all my friends that I like certain things, that here’s another way to share interests… After all, isn’t that what this whole social media thing is about? Let’s share ideas, our lives with each other.

Then I got a job to publicize a company. I built up a fan-page for them, hitting 10,000 fans in the first month. Pretty cool! But once I understood how the pages worked, I immediately went to the pages I had fanned, and un-fanned the pages that had been set up by people I didn’t know.

Why?

What I like About “Fan” Pages

Inclusion into your feed. When you “fan” something, it’s similar to “friending” them. When they update to their feed, it is incorporated into your feed. This turns your news feed into a glorified RSS reader. When you “friend” someone, you are giving each other permission to see each other’s feeds. Facebook integrates it all in your news feed.

When you fan a page, you are setting up a similar connection. Now, the fan page updates are integrated into your feed. You no longer have to visit your favorite sites to see what they are up to.

For the sites that set up these pages it’s good as well: their fans may not always visit their site, but they know that when people fan their site, they are keeping in touch. Someone who wouldn’t visit their site on a daily/weekly basis is still seeing updates and may click-through.

What I DON’T Like:

SPAM. When you fan a page, first of all, unlike groups, you really have no idea who it is that set up the page. You are not only giving the creator of the page permission to add content to your newsfeed, but also to send you a message. There ARE certain limitations, but not always. So essentially, when you “fan” something it is the equivalent of filling in the “subscribe to our newsletter” pop up when you visit a site. I have a special spam email address for those. Yes, I want their newsletter, just not to my primary mailbox.

Facebook likes keeping iron-fist control over how your data is organized on their site. This is why you can’t revert back to an old Facebook “look” or move content around the content on your page. So, yeah, no message filters to weed out spam, that would be too convenient.

Privacy. Most people don’t understand the Facebook privacy settings and would be surprised how much people they don’t know can see about them. When you fan a page a link to your profile appears on the “fan” page. As a former manager of one such page I would see who connected and how, and using this information I could create better content for my fans. Sounds good, right? Sure, if you don’t mind being spammed by some random stranger who decided to create a “fan” page for Coca-Cola, or the Evil League of Evil. Facebook only makes the creators of a fan page verify ownership after the page hits 20,000 fans.

Back to top

The “Like” Button:

When a site adds a “Like” button, it’s creating a fan page with all the bells and whistles. Not ALL like buttons do this, but in most cases you can assume that when you “like” something now, you are giving permission to Facebook to share all sorts of fun information about you with the creator of the “Like” button. (Note: The “like” buttons on Facebook.com itself – attached to status updates, photos, and such – will not create a fan page but only include the content you “liked” into your news feed. So keep on liking people’s statuses, and posts to their news feed.)

Above I spoke about the news feed and spamming issues but there’s more. Here’s what Facebook tells you it’s sharing on your privacy settings page:

“When you visit a Facebook-enhanced application or website, it may access any information you have made visible to Everyone (Edit Profile Privacy) as well as your publicly available information. This includes your Name, Profile Picture, Gender, Current City, Networks, Friend List, and Pages. The application will request your permission to access any additional information it needs.”

So when you “like” something, you’re not only telling the owner of the page that they should feel free to spam you, but also lots of personal information about yourself. Since Facebook forced everyone to change their likes, interests and activities into publicly viewable “fan” pages, all this content is easily streamlined into their new system for sharing your information with the world – the “Open” Social Graph.

(Yeah, I didn’t want to change my likes and interests, but Facebook blocked me from doing anything on its network until I made the change. The result? I removed all my “fan” pages and likes and interests…)

Brilliant! From a marketing perspective, this is AWESOME. So what’s the big deal? Why am I getting so upset about all this? It’s not really what they’re doing, it’s the complete disregard to my privacy that I don’t appreciate.

What’s the difference between this and adsense in your emails? Google manages the ads for that. I had no problems with the ads Facebook put in place until now, obviously targeted at me based upon my personal data. The “like” button, on the other hand, is the equivalent to Google sending companies the keywords you mention in emails.

Back to top

Facebook’s Private Policy

A History

When Facebook first came to the masses, it was a “walled garden” in which I could interact freely with my friends. I moved to Facebook from Friendster because I didn’t like how I was google-able there. But Zuckerberg seems to have installed webcams in this “eden” and is now selling tickets to the show… A classic bait-and-switch.

If you compare Facebook’s privacy policy from 2005 with the current one you’ll see:

Facebook Privacy Policy circa 2005:

“No personal information that you submit to Thefacebook will be available to any user of the Web Site who does not belong to at least one of the groups specified by you in your privacy settings.”

Current Facebook Privacy Policy, as of April 2010:

“When you connect with an application or website it will have access to General Information about you. The term General Information includes your and your friends’ names, profile pictures, gender, user IDs, connections, and any content shared using the Everyone privacy setting. … The default privacy setting for certain types of information you post on Facebook is set to “everyone.” … Because it takes two to connect, your privacy settings only control who can see the connection on your profile page. If you are uncomfortable with the connection being publicly available, you should consider removing (or not making) the connection.”

In 2005 they said that no personal information you used would be shared. In 2010 they share your information with any site you connect with. In some cases that includes sites that you visit while you are logged into Facebook.

By the way, did you notice the text I bolded? Yeah, basically they’re saying that they will add new privacy settings and automatically opt you in. The result being the following scenario:

I set up a photo album with photos I took at a private party. Since I didn’t want the rest of my friends to feel bad that I had held a party without them I set the permissions to that album to be shared with only the people who had been there. Sometime after that Facebook invented a new privacy setting for my photos and automatically opted me in. The result? The album was shared with the people on the list I had made of the attendees, the rest of my friends were blocked from seeing it–but if you weren’t my friend on Facebook, you COULD see the album.

Do you see the absurdity in that?

Back to top

Facebook Owns EVERYTHING You Post…

All Of It. Forever

You know that beautiful shot of you took on your last vacation to the French Riviera? Facebook can decide to do whatever they want with it, and you can go to h… Here’s what you agreed to in the Terms of Service:

“You hereby grant Facebook an irrevocable, perpetual, non-exclusive, transferable, fully paid, worldwide license (with the right to sublicense) to (a) use, copy, publish, stream, store, retain, publicly perform or display, transmit, scan, reformat, modify, edit, frame, translate, excerpt, adapt, create derivative works and distribute (through multiple tiers), any User Content you (i) Post on or in connection with the Facebook Service or the promotion thereof subject only to your privacy settings or (ii) enable a user to Post, including by offering a Share Link on your website and (b) to use your name, likeness and image for any purpose, including commercial or advertising, each of (a) and (b) on or in connection with the Facebook Service or the promotion thereof.”

So it says here that your privacy settings matter. But they also reserve the right to add new settings and automatically opt you in, so it doesn’t really matter what you set in there. Facebook owns it. And they retain the rights to the archived versions that you deleted as well.

“You may remove your User Content from the Site at any time. If you choose to remove your User Content, the license granted above will automatically expire, however you acknowledge that the Company may retain archived copies of your User Content.”

Back to top

Why I’m NOT Leaving:

Several articles have come out recently why one should leave Facebook:

• Reasons to quit Facebook
• Commit Facebook hara-kiri

It Wouldn’t Matter Much Anyway…

Your content is still in their archives, since they retain the right to keep it. Also the search engines have already indexed all this wonderful information about you, and it will remain in their indexes for weeks, months and possibly years. So to a large extent the damage is done.

You still CAN regain SOME control over what you have shared already.

In addition, I disagree…

The reason why I joined still remains. Many of the people I know are there, and share their thoughts with their “friends” on Facebook. I like that. It’s also a really easy way to connect with people.

Because Facebook was once a “safe” place, people feel comfortable sharing things they wouldn’t do otherwise, sometimes losing job opportunities, getting fired. But of the new Facebook is now only a glorified address book. Facebook, you can see my connections, my statuses, but that’s pretty much it from now on.

Is it too late to regulate Facebook? Honestely, I don’t know. But if everyone stopped using it, then it would go the way of MySpace… (what’s that?) Until a better solution comes out, I’ll still be there.

I’m going to assume that they have no respect for my privacy now, but there’s nothing wrong with having an internet presence, as long as you retain control over image. So if I’m going to continue using Facebook, it will be under my own terms now…

Back to top

6 (not so easy) Steps To (mostly) Secure Your Account

1. Take the following oath: “I solemnly swear to never share anything worthwhile again on Facebook. Pretend that your boss is looking over your shoulder. Because he probably is…”
2. Delete any “friend” you don’t know. I know that sounds a bit harsh, but with the security holes that Facebook has allowed I really don’t feel that I can trust Facebook to protect me from people with malicious intent.
3. Manage your account settings:
   • Change your password - Make sure that it’s a password that you don’t use for anything else. If the founder of Facebook hacked into people’s email accounts using their Facebook logins once, why would you trust him not to do it again?
   • Remove all extra email addresses - You need an email address to login to Facebook, but you don’t have to use your primary email address, or give them any more than they need.
   • Don’t Use Linked Accounts - That’s basically giving Facebook permission to follow you wherever you go, whatever you do. If you don’t really trust them with your information anymore, do you REALLY want that?
   • Change Your Account Security -
     “To help keep your Facebook account as safe as possible, we can notify you when your account is accessed from a computer or mobile device that you haven’t used before.
Would you like to receive notifications for logins from new devices?”
     YES PLEASE!
4. Manage your Pages, Likes and Interests: (remember, these are basically the same now) Here’s the rule: If you can answer the following 2 questions in affirmative, then go ahead, keep the page, or “like” that website
   • Are you okay with the page you are fanning/have fanned spamming you about their products?
   • Are you okay with (potentially) every marketing exec in the world knowing this about you?
   • Everything else, delete.

   Note: You may have to visit each page individually and find the “leave page” link on the left side.

5. Delete Every Unnecessary Application: Remember that quiz you answered? Yeah, the developer of the quiz application can access a whole heap of information about you. You may trust Facebook with your privacy, but do you really trust every company that has developed an app for Facebook with it as well?
6. Privacy Settings:
   • Personal Information and Posts – This is the information that is most public. Vet it carefully.
   • Contact Information – If you have any digital footprint, then most of the information found here can probably be found elsewhere. It still doesn’t hurt to make sure that only what you want to share is really there.
   • Friends, Tags and Connections – Have in mind that apps can probably see this information even if you block it. But I guess that’s part of the unspoken contract we have: “You offer me this great service, I’ll give you some information about me so that you can get money from advertising.” Still, if you took care of steps #4 and #5 then there shouldn’t be much there to share.
   • Applications and Websites – If the new “Open” Graph and privacy settings issues have been bothering you, this is where things get fun. There are THREE, count them ONE… TWO… THREE… different settings involved here so that your information isn’t shared with the world.
     1. What you share - Here Facebook explains that everything in your Personal Information is free to all (especially since they opt-you-in automatically to global sharing). It also explains that your interests and pages are a free for all. Pretty much no matter what.
     2. What your friends can share about you – Yeah, even if you make your data private, your friends can share it anyway…Unless you opt out here as well. And yet again, you were opted in to these automatically.
     3. Facebook’s instant personalization – Did you notice the fine print at the bottom of the page?
        “Please keep in mind that if you opt out, your friends may still share public Facebook information about you to personalize their experience on these partner sites unless you block the application.”
   • Search – If you do a good job re-crafting your image then it may be beneficial to have this set to “everyone” you never know when a long-lost best-friend from third grade will look you up. But if that concerns you, by all means, set it to “only friends”.

Back to top

Conclusion

Do I like what Facebook provides? Sure! But the honeymoon is definitely over…. Yes, I’m feeling hurt. I trusted it to be the walled garden it promised to be at the beginning, and I don’t appreciate the bait-and-switch tactics they’ve used to gain ownership over the things I’ve shared.
I like adapting new and exciting technologies, but in this case, I don’t think it’s worth the risks.
Zuckerberg explained that the idea behind the like button is to connect the internet through social connections instead of links. That’s a really cool idea. But considering his total lack of respect for my privacy, I am against it. I would much prefer a network in which:

• I owned my personal information
• I had control over how I could see and manage my connections
• I had to voluntarily opt in, rather than opt out of any new privacy changes

No, I won’t leave Facebook… yet. But I AM in the market for a better solution.

Back to top

<———

(Want one of these on your site?)

• If your content is super popular you don’t need to struggle to get it to the top of Google searches.
• Show your visitors what other people liked and automate it!
• Increase the reach of your popular content, help others share it further.

For more information… SharePulse info

click to enlarge

Handle: www.worldmate.com/travelog

Specs: Design and code by Jack Reichert

Handle: www.Jerusalem.com

Specs: Designed as Evangelical visual tour ebook of Jerusalem.
To become a media sponsor for this ebook contact: michael (at) gojerusalem (dot) com (mention I sent you)

click to enlarge

Handle: www.ImagesThroughTime.com

Specs: Photography site.

The slide shows on the homepage randomly choose thumbnails from galleries of the client’s choosing. Each time the page reloads different images are chosen randomly. Not all are shown at each refresh to optimize the load time.

Note: The image shown above is one of the sketches I proposed. Due to specific needs of the client we chose a variation which can be seen at the link above.

SharePulse ranks, in a sidebar widget, your site’s most popular articles of the week. Stats are tabulated from the Twitter, Digg and Facebook APIs.

Inspired by the “Most shared this week Powered by TweetMeme” widget found on the single article pages on Mashable.com, this plugin takes the concept one step farther…

Since adding “ReTweet” buttons to my site I noticed a sharp increase in the amount of articles that were tweeted and retweeted. The same holds true with your most popular posts, your readers want to know what your best content is, and what others think they should be reading. If you show them what other readers like it will create a positive reinforcing cycle and make those posts even more popular and the reach of your site will grow.

SharePulse tabulates the stats returned for the Twitter (actually, Topsy), Digg & Facebook APIs of the most shared articles in the past week and displays them in an attractive sidebar widget. Not only that, but it offers Retweet, Digg and fShare buttons for each link right next to the article, along with the stats of how many times your article was shared on each site.

This plugin compliments another plugin I developed ShareLinks which will add social buttons to your posts.

Download:

Installation

1. Upload the `SharePulse` folder to the `/wp-content/plugins/` directory
2. Make sure that the permissions for the “SharePulse” & “cache” folders as well as the file timthumb.php are all set for 777. (Note: This is only applicable if you will be using thumbnails.)
3. Activate the plugin through the ‘Plugins’ menu in WordPress
4. Drag `Share Pulse` widget into the sidebar via admin area ‘Appearance>Widgets’.
5. All settings are accessible from there.

Settings

Header text: SharePulse allows you to customize the widget title

Create thumbnails? The widget has two standard sizes, with thumbnails (300px) and without thumbnails (190px).

Theme: Currently we offer two themes for Sharepulse: “Bullet Holes” icons designed by Gopal Raju and “Social.me” icons designed by jwloh. (see screenshots below)

Twitter Source: You can also change the Twitter account that is RTed @ when the articles are tweeted.

Awe.sm api key: If you have an awe.sm account you can enter your api key here so that you can track the stats of your shortened urls.

Display stats from the past… You can choose to display the stats from the past month, week or day.

Number of posts to display: You can choose the number of posts to display in the widget. If the APIs do not return enough info to display as many as you like, which can happen if your site is young, then SharePulse will take random posts to fill in the missing posts.

Allow linkback at bottom of widget: We did not ask for payment to develop this widget yet we are sharing it freely, if you like it please show your appreciating by allowing the linkback.

FAQ (Frequently Asked Questions)

I just Tweeted/Dugg/Shared a post, why isn’t it showing up?

In short, SharePulse relies on the stats from different APIs (Application Programming Interface) they sometimes take a while to process the data.

The full answer: Basically, APIs are ways that different sites/services provide for programmers to access tools that they develop. In this case, I ask Topsy (a service that collects data about articles being shared on twitter), Digg and Facebook for the articles that were shared in the past week from your website, SharePulse then calculates which articles were shared the most and presents that to you. Sometimes it takes time for the APIs to update the data they are providing. In addition, to avoid overloading the APIs SharePulse will only request data no more than every 3 minutes. If it tried more often it would be blocked from the APIs for up to an hour (trust me, I tried).

The bottom line. It’s not me, it’s them. But be patient, they provide a great service. This too will update.

I just installed SharePulse and I think it’s broken. It’s just showing random posts…

Until you share a minimum number of articles SharePulse displays random posts. Once you have shared more posts than the number of posts you requested to display in the widget settings SharePulse will start tabulating.

If you are having any issues whatsoever, please, please contact me via the form at the bottom of the page. I want to make this plugin the best it can be. So your feedback is welcome!

The Thumbnails are not showing up?! Help?!?!?!

What do the different themes and views look like?

I would like to make a suggestion, how do I contact you?

Praise, suggestions, comments and even bugs found are welcome.

WordPress Requirements

Requires at least: 2.7

Tested up to: 2.9.2

Download:

SharePulse

SharePulse, your site’s social statistics for Twitter, Facebook and Digg

Donations

If you like this plugin, buy me a beer!