Talk It Up!

How to optimize your Facebook privacy for business

One of the questions that arose during this week's Huzzah! event on Search and Social Revelations was the issue of Facebook profile versus a brand page.

While changes have been made that allow pages to act more like people (the ability to Like other pages, for example, and receive notifications when a fan has posted to the page), there are still many advantages to having a personal profile that business colleagues, leads and partners can connect with. However, many of the workshop participants had originally set up their personal profiles as just that--a way to connect personally with friends and family, without the intention of posting information that was for public consumption.

My current stance on the matter is to have both: a personal profile so that colleagues, associates and industry connections can connect with you personally, tag you in photos from industry events, and message you personally. And then, if you are also a consultant or sole proprietor, it's wise to take advantage of the benefits of a brand page for engaging with fans and promoting events. After all, Facebook is social networking, and networking has always relied on personal connections.

So how does one make the transition from a heretofore extremely personal profile to a more global, public profile?

HubSpot recently produced a quick, two-minute video on how to do just that by creating custom lists to limit which contacts see which information so that your Facebook profile can serve your business networking needs as well:

Facebook: now with minty-fresh hijack access

Firesheep Firefox plugin provides easy, three-step hacking to anyone's Facebook account

Tweet

If I were to make the statement, "Facebook doesn't value its users' privacy or security," would anyone disagree?

Time and again, Mark Zuckerberg has shown that his priority is universal access and functional awesomeness over privacy. And hey, Facebook is a pretty cool tool, and let's not forget that it's free, so perhaps we should file privacy and security considerations under "you get what you pay for." And I've always felt there was something rather juvenile and vaguely sci-fi about the complaint, "Hey, you made me completely dependent on this for communication, and even though I didn't pay for any of it, it's your fault that someone could hack into it and steal my identity!" Kind of reminds me of old Star Trek episodes when alien cultures have foolishly become dependent on some technology, drug or food source and resort to unseemly behavior when access is denied.

Privacy issues have led some famous technologists to quit Facebook in a very public manner. Personally, I've been of the "don't post it online if you don't want anyone to see it" school of thought.

But the new Facebook security concerns are of a different ilk. Eric Butler, Seattle web developer, has created a tool called FireSheep that serves one nefarious purpose: to hack into vulnerable Facebook accounts. To be clear, he created the Firefox plugin with the goal of drawing attention to Facebook's vulnerabilities in the hopes that the creators would make more substantial efforts to ensure secure access.

As I read over various technologists' responses to the plugin, the catch-22 we are in does seem vaguely reminiscent of Star Trekk plot dilemmas. The only real solutions to ensure secure access to sites such as Facebook and Twitter seem to be to set up your own Virtual Private Network (and even I am not geeky enough to do that), or to use a tool to force https access on the sites.

Or we could stop using Facebook.

But then again, we didn't stop using email when spammer got hold of our addresses; we developed spam filters and mailboxes and verification instead. And we didn't stop writing checks when forgers adopted check washing scams. And we didn't stop using computers when viruses and malware began their attacks. We just bought Macs instead of PCs.

Firesheep is the first step in creating tools that will allow us to adapt to Facebook's weaknesses. I predict that there will be a new market for Facebook and Twitter security widgets and plugins to correct this issue, just as there is a healthy market for antivirus and anti-malware software. Soon we'll all be downloading and updating those widgets just as readily as we update our current spam filters.

We humans are just crazy for adapting like that.

Facebook privacy: with great free-ness comes great responsibility

I've put this off for a while. I mean, honestly, do we really need another post about the Facebook privacy issues?

Apparently, we do. It comes up in almost every conversation I've had about social media in the last two weeks. And that's a LOT of conversations. Here's my take.

We pay for "free" in one way or another. Chris Anderson's Free was a great audio book listen, and I don't disagree that free is a business model and the way of the future for quite a bit of content. However, free does need to pay for itself somehow. Google isn't a charity working on donations, and neither is Facebook. Zuckerberg and the rest deserve to make a living through their business, as much as we'd like to believe that we, the public, deserve unlimited use of a free tool to connect with our friends. Chris Penn, of my favorite podcasters, has pointed out, we pay for free one way or another. He rants:

If you don’t like how these businesses – and they are businesses, seeking to make profits – treat you, don’t use them. Don’t sign up for them. Don’t give them your time, data, or mindshare. Build your own or use businesses that are more aligned with your values – and be prepared to pay cash out of pocket for them.

Google pays for free by mining data and revenue from ads correlated to that data. If you don't like Facebook's privacy settings, you have a few choices. Create your own social network and convince all your friends to join. Go to an open source, privacy-aware model such as Diaspora, and convince all your friends to join. Or just connect the old-fashioned way. You know, with LinkedIn.

In the words of a friend of mine, "If you don't like it, you can't have any."

If you don't want your grandmother to see or read it, don't publish it online. I don't subscribe to the philosophy that "there is no such thing as privacy" anymore. We do have the expectation of privacy in many situations. For example, I have the right to expect that my credit card information will be kept private; I will take legal recourse if it's not. My social security number, my home address--these are things I expect to be kept private. That, and other bits of my life I choose not to publish online. As C.T. Moore has pointed out in his post Facebook isn't evil; we're just naive, however,

When you're not in the privacy of your own home, your privacy rights are limited.

As comfy as we might feel online, the entire interwebz isn't "home." Our rights to privacy are limited. When information is published online, it's up to the publisher to determine and implement the desired privacy constraints.

If you must post the photo of yourself licking the frozen flagpole in your birthday suit, it's your responsibility to filter if from public search so that your next employer doesn't see it. Or better yet, don't post it at all, and keep it as a happy memory of the day you left part of your tongue in Canada. Likewise, if you're out drinking with friends and someone snaps a photo of you licking the frozen flagpole in your birthday suit, it's your responsibility to let that friend know that that photo is for personal viewing, not for posting online.

With free tools comes some responsibility on the part of the user. I've made my share of online slip-ups; I'll admit it. I've published angry Tweets, unflattering photos of friends into their cups, posted content intended for a personal account to a work account and vice versa. But none of those were Facebook's fault; they were mine.

Facebook could stand to be more user-oriented. All the above being said, Facebook could stand to be responsive to its users' needs, even though those users aren't paying for the service. Zuckerberg has claimed that he truly believed that more sharing was the default that users preferred. I find that hard to believe, since every progressive shift toward less privacy has been met by user uproar. Has Zuckerberg really not noticed that users are pushing back on every move he's made in the last six months?

Shauna Causey, Seattle's own Energizer Bunny of customer service and social media, was quoted in this article on Facebook privacy:

Facebook is walking a very thin line of trust with its users right now... Many users are looking for alternatives to feel like they are in control of their information online.

True that. Moore says Facebook is just acting like a business, promoting its own interests. Fair enough. But many of us have learned that in business, it's a good idea to listen to your customers. Will Facebook step up and do that?

Please rob me: the truth about online privacy risks

Last night, Social Media Club Seattle featured a stellar panel on Ethics, Money and New Ideas, with panelists Andru Edwards of Gear Live Media, Izabelle Gorczynski (privacy attorney for Microsoft), Matt Haynes of Wunderman and moderated Andy Boyer of Spring Creek Group. Some interesting questions were raised, not the least of which was "What would you do if you had run across the iPad at the bar before release?"

If you're curious, answers ranged from "I'd take pictures of it and then give it to the bartender to return" to "It's abandoned; I'd keep it. But I wouldn't sell it for $5,000."

More interesting to me was the fairly tired debate over location-based services and privacy/safety. I'm considering establishing a new drinking game: when the subject of privacy comes up with respect to social networking sites and/or location-based services, the first person to mention Please Rob Me loses--and everybody drinks.

Does social media put its users at increased risk?

Frankly, it's pretty silly to believe that an average level of participation in Foursquare or Facebook mean that you're a significantly more likely target for burglars. First of all, as was explained to me when my own Chicago apartment was robbed eight years ago, long before Facebook was more than a gleam in Mark Zuckerberg's eye, robbery involves taking something of value by force or threat of force and or by putting the victim in fear. For robbery, the victim is present and threatened. Burglary refers to a crime involving breaking and entering, usually for the secondary crime of theft of personal property. So the site should be entitled "Come Burglarize Me."

Grammar aside, I'd also like to point out that that particular burglary managed to take place without the aid of Twitter, Facebook, Foursquare or Gowalla. Some kids (we think) climbed onto the garage and in a window when I was at Fourth of July festivities in another part of town. They had no way of knowing I was gone; the building had no assigned parking spaces.

Crimes of opportunity happen, but I'm not convinced that participating in social networking sites, microblogs and location-based services heightens the risk significantly, provided the user takes a moderate level of precautions. So the question isn't "does participation in these sites put the user at risk?" it's "does participation in these sites put the user at increased risk?"

Consider the following:

• It's uncommon to publish a home address on Facebook. One panelist suggested that it was common for Facebook users to publish street addresses publicly on their profiles. A poll during the question-and-answer session showed that only one person out of 150 attendees published a home address on Facebook. It's not a common practice.
• It's uncommon to publish a precise home address on Foursquare. Despite the fact that my buddy Mike Foley will check in to "Foleymo World Headquarters," he doesn't include an exact address, just a neighborhood. with his exact address ("It's 1510 23rd Ave. And I don't care who knows it," he Tweets), most users don't publish their home addresses. It's more common to list a title such as "The Homestead" with mention only of a neighborhood, such as "Fremont." If someone wants to hit every home in Fremont, he could be our guest, but I suspect a burglar's time would be better spent actually casing homes to physically see who isn't home and has valuables to steal. And most people don't check in at home, just to social venues.
• Just because one person is out doesn't mean the home is empty. Spouses, children, housesitters and petsitters are often still present in the home, so simply because one resident checks in at a hotel in Hawaii doesn't mean the home is abandoned and free game. In my case, a burglar would have to make his way through a concierge, a secure building and some pretty feisty house- and pet-sitters. And frankly, my most valuable assets, my laptop and electronics, will usually with me. Sadly, there is no hidden stash of Tiffany diamonds or Faberge eggs in the back of my closet (that I know of).

None of this is to say that another burglary couldn't happen, but is the risk increased? A few months ago, five scant months after my move to Seattle, my car was stolen out of the building's "secure" parking garage. Again, it was a crime of opportunity for joyriders looking for a nondistinct ride to take on a crime spree--and nothing was more nondistinct than my silver Honda Civic. Would my checking in on Foursquare and indicating that I was on foot, nowhere near my car, have made that particular burglary any more or less likely? Doubtful.

If you're concerned about your online presence increasing the chance of your becoming the victim of a crime, just take these basic precautions:

• Don't publish your address anywhere. Not on Facebook, not on Twitter, not on Foursquare or Gowalla.
• Don't mention the name of the street on which you live.
• When away for extended periods of time, make it known that others are occupying your home and that you are checking in frequently
• For extra security, don't publish your work address, either.

I'd welcome your anecdotes with social sites and increased risk of crime--what has been your experience?