The Strangers We Let See Facebook

It's been a while since I've written on my personal blog. This has been for a few reasons, the biggest of which I've been focusing on my fictional writing, trying to finish my crime novel.

Well, the draft of my crime novel is complete, and it currently in the hands of a developmental editor. While I wait patiently for his comments (and trust me, it has been a patient wait, as I'm not ready to delve back into edits yet), I thought I'd turn my attention back to something else that I'm just as passionate about.

Protecting ourselves on the internet.

For years, on the Editor's Blog on Black Wolf Editorial, I've been writing about some of the hidden traps associated with working online. Back in February, I decided to start a series here on my personal blog that delves into the mind of the bad guys who use the internet to prey on the innocent.

In the first post, I wrote about Twitter and how it's actually what we post that can be more of the security risk. Today, I want to look at some of the settings on Facebook, things that many of us never bothered to consider a risk.

It Start with New Accounts

Last year, my daughter got her first Facebook account. Youth need to be 13 years old before they can have an account of their own. While she didn't want one the moment she turned 13, it was a few months later that she asked if she could have one.

Now, some parents might totally object to the idea of their youth on social media, and with the creeps out there on the internet, I don't blame them for their reactions. In fact, if it wasn't for the fact that I'm the internet security nut that I am, I don't think I would have agreed.

I followed the practices that I recommend to writers when setting up their accounts (using a dedicated email for administering social media that is NOT your general communications email). And I'm so glad I did.

It became a bit of a joke among my own friends. She had her account for all of 2 hours, and it was blocked, the system thinking she was a bot. We got back into the account, but the access lasted a grand sum total of 3 days, at which point the account was dead. The email it was connected to was redundant and could no longer be used for the purpose it was set up. Funny that. But because of the fact that I had used a dedicated email for the purpose (not her general communications), her main email address was safe.

Round 2: start the process again. Near on a year later, and she now knows that you can't just go and like every single post under the sun.

But during that process of setting up my daughter's account(s), I noticed a few default settings that were just asking for trouble. So, let's take the time to look at them one by one, and we're going to put on the bad guy hat while we do it.

1) By default, anyone can send you Friends requests. AND anyone can send you a Private Message.

To build your contacts list on Facebook, you need to build your Friends list. For that to happen, they need to be able to find you. That might not seem like a bad thing, but is it?

So, you've been taking part in a discussion Group for some time, and you've really made a name for yourself in there. But there's this one person who always comments back on your posts and just gives you the heeby-jeebies in the way he interacts with you. You're happy to have the comments on your Group posts, but that's as far as you want to take the relationship.

One day, seemingly out the blue, you get the Friends request from him, and he's sending you private message after private message. Sure, you can block him, but there are actually settings that you can take advantage of to stop this sort of thing happening in the first place.

Start by changing the "Who can send you friend requests?" setting to Friends of Friends. This is the tightest you can make it. What it means is that only those who are Friends with people who you are already Friends with can send you those wonderful requests. Mr. Creepy-Group-Guy can't (unless he's a Friend of a Friend).

Note for Parents: The default setting on new accounts for "who can send Friends Requests" is Public for a reason — so you can find the account and actually have at least one Friend before you lock the account down. Upon creating an account for your teenage children (minimum age for Facebook is 13), I recommend that you Friend your child BEFORE you lock the account down to the setting of "only Friends of Friends can send Friend Requests". That way, only your Friends can find your child. Then it will snowball from there.

The Private Message issue is a little more problematic. Historically, Facebook did include a setting where you could specify that only your Friends could send you messages. For whatever reason, they decided to do away with it. I really wish they would bring it back.

But, you can opt to silence those private message from Mr. Creepy-Group-Guy permanently. That's at least something.

2) Your Friends list is publicly accessible.

The default setting on new accounts for "who can see your Friends list" is Public. I'm sorry, but I don't care who you are. No one needs to see who you're Friends with on Facebook. It's no one's business. However, it doesn't matter what your setting is, people can still see that you're Friends with someone if they haven't locked their own settings down.

Let's say that you were at some rip-roaring party and there was this guy there that was a little creepy in an almost stalker sort of way. You don't want anything to do with this guy, but he finds out that you're on Facebook. Okay, you've locked down your profile so that only Friends of Friends can send Friends request. He goes to your profile, and you've never bothered to change that particular setting from the original setup. He now knows who your friends are. No doubt one of them will be stupid enough to accept his Friends request, so now, he can send you a Friends request too.

Or, let's say that you have locked down your Friends list, such that only you can see it. But if by some fluke he is already Friends with one of your Friends. Their name will appear as a mutual Friend.

The best-case scenario with Mr. Creepy-Stalker-Guy is that he isn't already Friends with anyone you know on Facebook. However, at the party, he overhead the names of your buddies. He searches their profiles, and your best friend in all the world is not exactly internet security savvy. Their Friends list is still public, and there is your beautiful face sitting on that list. Time for Creepy-Stalker-Guy to gain access to information about you through your Friends, and your Friends are letting it happen.

Note for Parents: You can specify a special category of "Friend" as a "Parent" and have your children share their Friends list with only those listed as a "Parent" on their accounts. This is what I have done for my daughter's account. I'm the only one, besides her, who can see her Friends list. There is also an option to share your Friends list with specific people only. This would be a "Custom" setting.

3) Information in a phone directory can be used to find you.

Once upon a time, located on the corner of every street, you could find these things call payphones. Within each of these payphone boxes, there was a copy of the White Pages and the Yellow Pages (phone directories that you could use to find the numbers for the people you wanted to speak to).

The concept of the payphones has pretty much died in the wake of cellphones, but the phone directories are still lingering around, except now, they're online. To make it worse, you can ask your local phone provider to add your email address and your cellphone number to your directory listings. This might seem innocent enough, until you discover that there is a setting on Facebook where complete strangers can use your email address or your phone number to find your profile.

The whole purpose of a phone directory is so you can find the contact information of people that you only have the name of. So, by keeping the "Who can look you up using..." settings on Public...

Doesn't anyone else see of problem with this, or am I just too old school?

If you honestly don't see the problem with this, I would like to direct you to a science fiction classic known as Terminator. There were only a handful of Sarah Connor's listed in the phone book, and all but one ended up dead.

To solve this particular issue, you have two separate issues to deal with. First, change the Facebook settings for "Who can look you up using..." to Friends. Unfortunately, it doesn't get any tighter than that. I wish it did, but nope. Second, contact your phone provider and have your name taken out of the online directory. Be advised that you might need to call them a few times about this. (It took me three months, and I don't know how many phone calls, to get my own details removed from the online public directory.)

4) Search engines outside of Facebook can link to your profile by default.

This particular setting is just as bad, if not worse, than allowing those to track you down via your email or phone number. You have no idea who might be searching your name (or where they are in the world). Just don't.

Note for Parents: This setting is set to No for any account for a youth under the age of 18, and can not be changed. The moment they turn 18, the setting can be switched to Yes. I don't know if this happens by default, but my daughter is only 14 and my son turns 18 in September. I'll be able to look at what happens to the settings then.

5) Your posts on Facebook by default are only visible to your Friends, but what about your other platforms?

Instagram has become the next big thing among the youth. Images are so much faster, and they seem to be big on selfies. However, through Instagram, you can cross-post your messages to Facebook. In fact, there are systems that you can use (particularly through IFTTT) where you can authorize an applet to scrap almost any social media profile and cross-post it to another social media profile. I use them myself, cross-posting my Instagram images to Twitter and Pinterest. (Cross-posting from Instagram to my Facebook is handled by Instagram.)

My Instagram is public. My Twitter is public. The page they are cross-posted to on Facebook is public.

On Instagram and Twitter in particular, there are only two settings for account privacy: public and private. Private means that you have to approve those who follow you. Only those who follow you can see what you post. For youths, this is the setting I recommend. For writers and authors, you want your Instagram and Twitter to be public, or what is the point?

Just remember that because the public can't see it on Facebook, especially if you are cross-posting to your private feed, doesn't mean that the public still can't see it.

Note for Parents: For Instagram and Twitter, there are no default settings for Private accounts for youth. This is something that you need to set yourself. But do make sure that your personal account is following your child's account. You want to be monitoring what they post.

Another Note for Parents: As a secondary hint for Instagram, have your child's account cross-post by default to their private feed on Facebook. Then, within Facebook, set your "In Your News Feed..." setting for their profile to See First. This means that you will ALWAYS see their posts, and they will be right at the top of your news feed every time (cross-posted from Instagram within a matter of seconds). Even if you're not on Facebook for a few days, whatever they posted since you last longed into Facebook will appear at the top of your feed.

It was because of these settings that I was able to catch my daughter out on her nighttime activities some months back, when she should have been sleeping. It's a bit suspicious when she says that she's in bed asleep and I see a post on my Facebook feed of something she's uploaded to Instagram just after midnight — and she wasn't even supposed to have her phone in her room. She lost her internet privileges for a month after that — restricted access while Daddy was sitting right next to her (talk about cramping a teenager's lifestyle). 

Social media is fun — if you're smart about it!

Social media can be a fun playground, but if you honestly believe that it's filled with fairy godmothers who are going to grant your most grandiose dreams, then think again. The internet is filled with trolls who are determined to ruin it for everyone.

It's a breeding ground for spreading hate and animosity. Normal social boundaries seem to go out the window, because the monitor actually creates this imaginary boundary between yourself and the rest of the world. It's odd how some people can be the nicest people that you would ever meet in real life, but you get them on social media, where that monitor boundary exists, and they turn into monsters.

As a parent, I feel it is my duty to teach my children how to navigate the nasty world of social media safely. Because of who I am as a whole, I share whatever information I collect along the way as far and wide as I can.

Social media is still in its infancy. Sure, Facebook has been around since 2004, but that's only 15 years. We're still dealing with only the first generation of users, and trust me, we are making A LOT of mistakes along the way.

Don't be scared of social media. Don't be scared of the internet. Just learn what you can, and take the steps necessary to keep yourselves and your loved ones safe. Social media can be a rewarding experience and lots of fun, but only if you're smart about it, and do the best you can to avoid the Hidden Traps.