Why Your Facebook Settings Are Not as Private as You Think

By Scott Wright - March 2015

I run a simple exercise in my security awareness workshops. I ask participants to open their Facebook profile on their phone and hand it to the person sitting next to them. Then I ask: "Is there anything on that screen you would not want a stranger to see?"

The room goes quiet every time.

Most people believe their Facebook privacy settings protect them. They set their posts to "Friends Only" at some point and assumed that covered everything. It does not.

What "Friends Only" does not cover

Setting your default post audience to "Friends Only" is a good start, but it leaves several things exposed:

• Your profile information - Name, profile photo, cover photo, and often your workplace, education, and city are public by default. Facebook requires your name and profile photo to be public.
• Old posts - Changing your default to Friends Only only affects future posts. Everything you posted before that change may still be public. You need to use the "Limit Past Posts" tool separately.
• Tagged photos - When someone else tags you in a photo, that photo's visibility is controlled by their settings, not yours. If their post is public, your tagged photo is public.
• App permissions - Every game, quiz, and third-party app you have ever authorized has access to some of your data. Many of these apps have been abandoned by their developers but still hold valid permissions.
• Friends lists - By default, your complete friends list is visible to anyone who views your profile. This is useful for social engineers building a picture of your network.

The settings you should check today

Open Facebook, go to Settings and Privacy, then Settings. Work through these one at a time:

1. Privacy > Who can see your future posts - Set to "Friends"
2. Privacy > Limit past posts - Click "Limit Past Posts" to retroactively change all old public posts to Friends Only
3. Privacy > Who can look you up by email/phone - Set to "Friends" (default is "Everyone")
4. Privacy > Search engine indexing - Turn this off unless you want your profile appearing in Google results
5. Profile and Tagging > Review tags - Enable tag review so you approve tags before they appear on your timeline
6. Apps and Websites - Review every app listed and remove any you do not actively use
7. Friends list visibility - Go to your profile, click Friends, click the pencil icon, and set to "Only Me"

Why this matters beyond privacy

This is not just about privacy preferences. The information visible on your Facebook profile is the raw material for social engineering attacks. An attacker who can see your workplace, your friends, your interests, and your recent activity has everything they need to craft a convincing phishing message or impersonate someone you trust.

In my Honey Stick Project research, social media profiles were one of the first things we checked when profiling targets. The amount of actionable intelligence available from a single Facebook profile is remarkable.

Take fifteen minutes today and review your settings. It is one of the highest-impact security actions you can take.