Eric’s Guide To Facebook Security and Privacy

After seeing a number of Facebook privacy hoaxes flitting across my news feed, I looked for a single comprehensive resource to show people how and where they can change their privacy settings.  I didn’t find one that I like, so I decided to create one.  I have checked this step by step as I went, and believe it to be accurate and complete, although things often change, and there may be something that I missed or misunderstood.  So take this, like anything else you might find on the internet, with a grain of salt and an enquiring mind, and let me know if it falls short; but I haven’t seen anything else yet that is better.

 General Settings

 I’ve created a user with my dog’s name (Marco Polo – I had to add a bit to not get rejected), Marco DiPolo.  It has one of my lesser used email addresses, and correctly identifies him as male, but the birthday is fake, a step I generally recommend.

 

The next step wants you to input your email and password so you can find your friends.  This allows Facebook to log into your email account and check your contacts.  Bad idea.  Click “skip this step”.

This brings up a little box saying, essentially, “Oh, are you sure you want to skip this step?  You’ll be so lonely!”  Yep.

How about telling us where you went to school, or where you currently work, so your coworkers and boss can scan your posts?  Hardly.  Skip this step.

Profile photo?  Okay, sure.

Save and continue.

Then they try to get you to find your friends again by using your email address.  Sorry, no.

Add a photo for your timeline cover (optional), and you are now an official Facebook user, and have so far compromised your privacy to a minimum degree.

However, Facebook has already made a lot of decisions about what you want to share and with whom.  Let’s review those decisions and change them to be our own decisions instead.

Account Settings

You find Account Settings under a drop down arrow at the top left of your home page or profile page.

General settings is just where you can change your password.  Let’s go to security.

First thing to do here is set a security question.  Make it something you can remember, or add it in the notes in your password safe.  Put in your password and save.

Secure browsing forces your browser to use https:// instead of http:// when going to Facebook.  Https:// means that your web communications are encrypted to some extent and that there’s a pretty good chance that the web server you are talking to, such as the host for facebook.com, is in fact the web server that it claims to be.  (There are settings in your browser that will allow you to enable this for all websites where such communication is possible.  It’s a good idea to do that, too).  So check the box and save.

Next is login notifications.  This sends an email or text message to you whenever your account is logged in to from a different computer than the one you used when you created the account.  In conjunction with the following setting – Login Approvals – you can require the email or text message to contain a code that must be entered before the login can be completed.  This means that you had better be able to receive these messages whenever you log in from a different computer.  If you almost never do, choose to do this anyway.  It means that no one who isn’t you, or in possession of your computer and email account or cell phone, can hack into your account.  It does mean that you have to post your cell phone on Facebook.  We’ll lock that down later.  Unless it would be unworkable or incredibly inconvenient, choose to enable both of these.  Both of them will send codes when you enable them which must be entered to save and continue.

App Passwords is the next setting.  WTF are app passwords?  Here’s what Facebook says:

App passwords are one-time passwords you can use to log in to your apps. Using app passwords will help keep your Facebook password safe. And if you have login approvals turned on, when you use an app password you won’t have to wait to receive a code. Instead, you can skip login approvals and log in immediately.

This, I have to say, I can’t advise you on; I don’t connect apps to my Facebook account (Twitter, Skype, etc.).  Any app I use has a separate password.  I advise you to follow the same path.  There are computer and smart phone app versions of PasswordSafe or other password keepers where you can store them all.  Use that instead, and just leave this setting alone.

The following setting – Recognized Devices – just lists the recognized devices – the various computers you have used to log in to Facebook and been required to verify via the codes sent as texts or emails to you.  You would open this if you needed to remove a device; for example, if you had been visiting friends or family and logged in from their computer, and now want to disable that possible access point (yes, you should).

The final setting in this session – Active Sessions – shows where you are currently logged in from.  If there is more than one active session showing, delete the one that is not the one you are actually using.

Also note the link below; this is where you would go to close your Facebook account.

The next grouping on this page is Notifications.

There’s nothing you can do here about Facebook Notifications or Push Notifications so let them ride; you adjust those settings either in the apps you are using (in spite of the fact that I just told you not to link apps to your Facebook account) or in Facebook itself. You also can’t adjust Activity about you here. Back up at Email, though, we can edit here.

Trust me, you don’t want to get notifications from Facebook except the ones checked here.  And you don’t even want to get most of those, but you have to wait until you receive them and then unsubscribe.  Anything having to do with changes to your account, you want to receive, though.

Close Friends Activity should be edited and turned off, and edit Notification from apps by unchecking any apps that are checked.  You’ll notice that Marco has already got one app that he didn’t ask for.  You have to watch those things like a hawk.

Next section on this page, Support Dashboard, lists profiles or timelines you have reported (as spam, malicious, obscene, or whatever) and shows reports on what, if anything, has been done.  It also lists any support requests you have made.  We’re not very interested in this stuff.

Subscribers allows you to let anyone see your public posts, even if they aren’t friends.  By default, this is not allowed, so you can leave it alone.  Or just open it and make sure the box is not checked.

Apps is where we can turn off that app that attached itself to Marco’s profile without asking.  Turns out it is “Bing”.  Click edit and choose remove app.  If you have apps you want to connect with Facebook, in spite of what I said, at least choose Only Me and Never here.

Mobile is off by default.  Leave it there.  Payments is where you would set it up to make payments to various for-profit apps through Facebook. Do I even have to say it? Don’t do apps!  Don’t do apps that charge money even more!!  Stay away from here.

Facebook Ads is the place to go instead.

So, you want to be featured in ads without being paid or even asked?  You want to help Facebook send ads to your friends?  I didn’t think so.  Edit both of these like this:

Gifts – the final section on this page – ignore.  We’ll cover privacy settings next, but first click the link below Gifts to edit your timeline.

Had you entered any information beyond your name (required) and birthdate (required, but can be faked) when setting up your account, here is where you can edit who can see that.

Most of this stuff you can suit yourself on.  Fill it out if you want.  But at least restrict valuable information – Contact info, Work and Education, City and Hometown and Relationships.  My recommended setting?

Okay, I understand if you want to advertise yourself a little.  Other options you can choose for non-sensitive areas are Friends or Close Friends, or you can customize it for specific people.  But don’t use public.

Now on to Privacy Settings, which means starting back on your profile or home page.

Privacy Settings

First thing to do is to set your default for posts.  Friends is a good starting point.

Later on you may want to create lists.  Lists categorize your friends; so that, for example, if you were foolish enough to include coworkers, or your boss among your friends, you could categorize them on a “Work” list.  Then, when making derogatory comments about your workplace or those your work with or for, you could use a custom privacy setting – block “Work” list – to keep them from seeing it.

You have the option of using a different setting every time you post.  However, remember that when you change the privacy setting for a post, Facebook assumes that as a new default; unless you change it back, all subsequent posts will be set the same way. Here’s how to do that.

But I digress.  Back to privacy settings.  Next up is How You Connect.  Here are the settings I recommend.  These settings keep anyone from looking me up by phone or email unless they are already friends, allows both friends of my friends to send me friend requests, and limits private messages to friends.  I think that is open enough to allow you to expand your circle of friends on Facebook without being too open.  Make “Everyone” a word that is not in your vocabulary.

Next section is Timeline and Tagging.  This sets parameters for who can post things on your timeline or tag people in pictures you post, and allows you to have control on whether or not those posts or tags are allowed on a case-by-case basis. Here are my recommendations, which are set to allow people to post on my timeline or tag people in my pictures, but only after I review and approve those actions.  The second setting, Who can see what others post on your timeline, allows others to see posts on your timeline that are made by people other than you; I choose only friends here. Note that if you want something to remain somewhat private between you and someone else, use a message, not a post. The final setting would permit Facebook to say to others, “Hey, this picture looks like this guy, do you want to tag it as him?”  I don’t choose to permit that.

Next section, Ads, Apps and Websites, refers to connections between Facebook and other entities (like advertisers and other websites), and how your information can be used.  This is pretty key.  You don’t want your information to be used by anyone other than you (as much as possible).  The first item, Apps you use, gives a link in the text to turn off interaction between Facebook and other entities.  Clicking on this will grey out the next three items and the last item.  I recommend doing this.  If you get to the point where you want to allow some interaction between certain other apps, you can also edit it here.  Try not to get to that point.

One item remains on this section, Public Search; this displays your Facebook information to people searching using internet engines like Google or Bing.  This is off by default.  Check to make sure, but  leave it off.

The next section back in Privacy Settings is Limit Audience for Past Posts. This allows you to make past posts that you may have set as public be restricted to friends.  I recommend doing this.  Click Limit Old Posts”.

The final section is Blocked People and Apps.  This gives you a number of options.  First, you can add friends to a Restricted list, which means they would only see posts you choose to set as public.  This would be another option to use to block people from your workplace, rather than creating a work list.  Either way is functional.  You can also enter people you want to permanently block in Block users, like the lover who you just dumped, don’t want to hear from on Facebook again, and don’t want to see anything you post.  You can block them by Facebook name or by an email address.  If you have followed my suggestions on privacy so far, defriending them would have the same effect except there would still be a point of contact if you still had friends in common.  If you really want to block them, do it here.

Block app invites can be done here to automatically block invitations to games and other apps from specific people.  This would be pretty tedious.  I just do that on an individual basis when people send invites; I block the apps themselves, as the invites appear on my timeline, so I won’t see them no matter who in the future sends them.  You can also Block event invites or Block apps in this section.  Again, I do that on my timeline as needed, not here, but it is just as well to know this tool is also available.

Good job.  You have some decent privacy settings if you have followed this advice, and know where to change it in the future if you want.

Finally, here’s where you can restrict how much information you see from other people, a process that was at the basis of one recent Facebook hoax.  You can hover over the highlighted name of a friend and a thumbnail will appear with their relationship to you (for example, “Friends”) appearing with a check mark in a box.  Click the box to get a drop down menu and choose Settings.

Here you can choose what kinds of posts show up from others on your news feed.  The settings I use as my default are shown in the following picture.  I am fairly restrictive for most people – I choose to see most updates, but only those that are Life Events, Status Updates, or Photos.  For particularly noisy individuals or people I know only peripherally, I might choose Only Important; for those who don’t abuse it, I might add Music and Videos; for those I am stalking, like particularly close friends or family, I might turn All updates and check everything except Games.  I don’t do Facebook games (they generally require you to permit access to your information).  Despite the claims of the hoax, these settings do not directly impact your privacy, or that of your friends; they simply control what you see in your news feed.  However, it is still a very useful feature, and I recommend using it to keep from being overwhelmed with posts you really aren’t interested in.

I hope you have found this guide useful and accurate.  Feel free to use it and pass it along; and if you find any inaccuracies or additional information which should be added, please let me know.