Enabling https on Facebook

Below is a screenshot of how to enable https on Facebook.

This will protect you from people trying to see what is being transmitted over the network, and also things like Firesheep, a free Firefox extension that allows people to log in as YOU.

A more secure Facebook connection

Nice! Facebook is now making secure connections to it possible.

From today's Facebook blog entry:

Starting today we'll provide you with the ability to experience Facebook entirely over HTTPS. You should consider enabling this option if you frequently use Facebook from public Internet access points found at coffee shops, airports, libraries or schools. The option will exist as part of our advanced security features, which you can find in the "Account Security" section of the Account Settings page.

This protects any information (including profile pages, contact information, location of you and your friends, etc) sent to/from your browser and Facebook's server from any eavesdroppers. So, if you are in a public area, such as an airport, library, coffee shop, where there are many people (possibly malicious), you'll definitely want to enable this. Because you have to log in to turn it on, you'll probably just want to go ahead and enable it.

I tried going to the "Account Security" section of my Account settings, but did not see the option available yet. Maybe tomorrow.

See my previous blog entry about using free public internet.

Facebook remote log out

Have you logged into Facebook at the library or your friend's computer, and forgotten to log out?

Facebook also has a remote log out feature.

"...you can see if you’re still logged in on other devices and immediately log out on those devices from one central control in your account."

BTW, you can also have Facebook send you a message via SMS or email whenever a new computer or mobile device logs into your account.

Facebook one-time passwords

Facebook is enabling a feature that I wanted Gmail to have a long time ago: one-time use passwords. These are passwords that you can only use one time. This is helpful if you're using a not-as-secure computer and are worried that someone might have captured your password (and you don't want others to be able to use your password.) In order to use this, you have to register a mobile phone with your Facebook account, and send a text to Facebook to receive a one-time password (that must be used within 20 mins.)

From the Facebook blog:

First, we're launching one-time passwords to make it safer to use public computers in places like hotels, cafes or airports. If you have any concerns about security of the computer you're using while accessing Facebook, we can text you a one-time password to use instead of your regular password.

Simply text "otp" to 32665 on your mobile phone (U.S. only), and you'll immediately receive a password that can be used only once and expires in 20 minutes. In order to access this feature, you'll need a mobile phone number in your account. We're rolling this out gradually, and it should be available to everyone in the coming weeks.

I try not to use other computers/devices to access personal information unless absolutely necessary. And nowadays, with all the smartphones out there, you don't really need to use someone else's computer. But it's nice to know there's this feature for passwords.

Don't get scammed on Facebook

Imagine this scenario: Mr. Stranger guesses/steals your password, hijacks your Facebook account, and sends messages to all your friends that you are in trouble, stuck in some foreign country, and need money to be sent to you immediately. Some of your friends may fall for it and actually send money to Mr. Stranger trying to help you.

This kind of Facebook scam has happened many times, and a couple friends I know have even been affected (but were smart enough not to believe it.)

A few basic principles to remember:
- Any person contacting you online (through Facebook, email, instant messaging...) may not be who you think it is. It could be an impersonator.
- Use a good password that others can't easily guess. Some suggestions on how to choose a password here.
- Don't enter your password into fake (phishing) look-alike sites or pretend emails, which are just waiting for you to put in your personal info.

Facebook security settings

There's so much that can be discussed about Facebook and security. I'll start off with a short post.

Facebook provides a number of security settings which you can adjust. By default, Facebook shares a lot of your information with everyone, and I suggest tweaking your security settings.

Perhaps I'll post my favorite Facebook security settings one of these days. Below are a couple sites that do a pretty good job of describing Facebook security settings which you probably will want to use:

• Sophos - recommended privacy settings for Facebook
• AllFacebook - 10 privacy settings every Facebook user should know