Facebook dubios: Spionage für Jedermann möglich

Wenn der Spion nicht bei Facebook angemeldet sind, reicht die Kenntnis Ihrer E-Mail-Adresse aus, herauszufinden, mit wem Sie Umgang haben.

Facebook speichert sogar die Daten von Nutzern, die sich nie auf der Plattform angemeldet haben.

Michael Arrington von Techcrunch machte auf diese Lücke aufmerksam. Er kannte die E-Mail-Adresse von Google-Chef Eric Schmidt. Bei der Anmeldung gab er sich als der Google-Chef aus. So konnte er leicht herausfinden, mit welchen Personen Schmidt Kontakt hat.

Das funktioniert auch mit jeder anderen E-Mail-Adresse. Facebook schlägt noch vor der Verifizierung der E-Mail-Adresse potenzielle Freunde für den neuen Facebook-User vor.

Facebook speichert ungefragt die E-Mail-Adressen aus dem User-Adressbuch und verknüpft diese mit ihm, wenn er den Zugriff auf sein E-Mail-Konto zugelassen hat.

Auf Facebook finden wir - ziemlich versteckt - folgendes:

Importierte Kontakte entfernen

Wenn du Kontakte von deiner E-Mail, deinem Handy, deinem Chat-Service oder einem anderen sozialen Netzwerk importierst, können wir diese Informationen verwenden, um Freundschaftsanfragen für dich und deine Freunde zu erstellen. Außerdem zeigen wir diese Kontakte in deinem Facebook-Telefonbuch an.

Wenn du deine importierten Kontakte entfernst, werden sie nicht mehr in deinem Telefonbuch angezeigt und die Freundschaftsvorschläge werden wahrscheinlich weniger relevant für dich und deine Freunde.

Um alle importierten Kontakte zu entfernen, deaktiviere bitte zunächst die Synchronisierungsfunktion von Facebook auf deinem Handy, wenn du sie zuvor aktiviert hast. Klicke danach unten auf „Entfernen“.

http://www.facebook.com/contact_importer/remove_uploads.php

Natürlich steht es jedem frei, welche Daten er Facebook gibt. Die Aufdeckung dieser Datenlücke zeigt jedoch, dass Facebook der sorgsame Umgang mit persönlichen Daten kaum interessiert. Es geht vermutlich nur um Geschäftemacherei mit Daten.

Die Weitergabe persönlicher Daten scheint eine Standardfunktion von Facebook zu sein. Nur so lässt sich der zunehmende Social Media Spam erklären.

Amplify’d from techcrunch.com

Being Eric Schmidt (On Facebook)

I’d like to apologize to Google CEO Eric Schmidt for impersonating him on Facebook today.

It’s actually pretty easy, too easy, to do this. A reader emailed earlier today letting us know that someone had been impersonating them on Facebook based on a real, but unused, email account.

I tested this by creating a fake Facebook account for Eric Schmidt based on his real email address. I tried to do this with a few Facebook execs first but it didn’t work because the emails I have for them are already associated with their real accounts.

The email address I have for Schmidt, however, isn’t associated with any Facebook account. It worked.

Of course I could have created a fake Eric Schmidt account without using his real email. But by using that email address Facebook immediately started suggesting friends to me – presumably people who have uploaded their contacts, including that email address, to Facebook in the past.

I created a profile and quickly started adding friends. YouTube founder Chad Hurley accepted, as did Facebook Vice President Elliot Schrage.

The profile isn’t particularly believable, but after a few high profile people became friends and were linked on the profile, the invites started pouring in.

You Don’t Have To Verify Email Addresses To Use Them With Facebook

As soon as the account was created I was asked to verify the email address. I ignored that and instead just turned off all email notifications. But I can still use the account to add friends, accept friend requests, like status posts, and send and receive messages.

Messages occasionally pop up saying “Before you can interact with other people on Facebook, you need to confirm your email address.” But most activity isn’t restricted at all.

I’m fairly certain that the account will be disabled shortly. But what if I had faked a less high profile individual, and didn’t write on TechCrunch about it?

The person being impersonated may see the Facebook confirmation email. But since they didn’t just create an account the obvious thing to do is to ignore that email, not to click on the link. But by ignoring it they are letting me continue to pretend to be them.

The fix for this is easy – Facebook shouldn’t let people do anything at all with an account until they’ve verified their email address. But that creates extra friction with account creation, which is probably why they let people do so much before they verify.

And lots of services do the same. But with Facebook, I immediately have access to a pretty robust social graph. All those suggested friends are people that have Eric’s email address, and as I showed it’s pretty easy to fool people into thinking I really was Eric. One person even sent a fairly private message to me.

If Facebook doesn’t change this there’s one easy way to protect yourself. Just add every email address you use to your Facebook account. If there are old emails you don’t have control over any more you can’t add and verify them, so there’s still some exposure though.

We’ve emailed Facebook for comment. I actually almost just messaged Elliot Schrage via the fake Schmidt account for comment, but that seems like poor form.

ps – Max Hoat, the CEO of Livestream, just sent an email in to tips@techcrunch saying how funny it is that Schmidt only has six friends. He asks us to credit him if we post, so we are. This shows how believable this is. Here’s his email:

get widgetminimize CrunchBase Information Facebook Website: facebook.com Location: Palo Alto, California, United States Founded: February 1, 2004 Funding: $836M Facebook is the world’s largest social network, with over 500 million users. Facebook was founded by… Learn More Information provided by CrunchBase Read more at techcrunch.com

See this Amp at http://amplify.com/u/czxr