This is a widely known problem that has been talked about to death, yet very popular websites continue to fail at protecting their users. The only effective fix for this problem is full end-to-end encryption, known on the web as HTTPS or SSL. Facebook is constantly rolling out new “privacy” features in an endless attempt to quell the screams of unhappy users, but what’s the point when someone can just take over an account entirely? Twitter forced all third party developers to use OAuth then immediately released (and promoted) a new version of their insecure website. When it comes to user privacy, SSL is the elephant in the room.

Today at Toorcon 12 I announced the release of Firesheep, a Firefox extension designed to demonstrate just how serious this problem is.

While I don’t come down too heavily on one side or the other of the debate over who is responsible for end user privacy, I still come down heavily on end user privacy itself. Enter the Firesheep extension for Firefox (and hopefully for Chrome, soon?) and my burning desire to try this out at some coffee shop the next time I’m out. I have a feeling, though, that more end users would blame the messenger (Eric for creating it, me for trying it?) than be able to accurately pinpoint the problems with the infrastructure leading to these sorts of vulnerabilities…

Looks like Mark “Dumb F***s” Zuckerberg is attempting to save some face (pun intended) on Facebook’s privacy issues as of late. After a month of getting slammed by pretty much every major media outlet and their own users, the powers-that-be at FB are going to be rolling out new privacy controls that should allow you to set them and forget them. Until, of course, they change their privacy settings again. Don’tcha just love being a test subject in a massive open beta project? via Lifehacker:

After a months-long privacy fiasco, Facebook has taken it upon themselves to revamp the privacy settings to make them simpler and quicker to set and forget. While the new settings are definitely easier to use, Facebook has thrown in a few surprises that the privacy-conscious may not be too happy with. Unfortunately—in some ways—with simplicity comes a lack of control, and Facebook has made sure that the control you don’t have is over information that is made public.

Still holding out for social networking alternatives, I tell you…

What is it?

Enter your Diaspora “seed,” a personal web server that stores all of your information and shares it with your friends. Diaspora knows how to securely share (using GPG) your pictures, videos, and more. When you have a Diaspora seed of your own, you own your social graph, you have access to your information however you want, whenever you want, and you have full control of your online identity. Once we have built a solid foundation, we will make Diaspora easy to extend to facilitate any type of communication, and the possibilities will be endless.

The project is receiving funding using Kickstarter.com, and will most likely be getting some of my coffee money shortly…

via The New York Times, which should say something

My lovely wife might disagree, but I’ve been on Facebook for a while – since you had to petition to have your non-.edu account opened up to it (she’s been on since, like, day 2). At one point I completely destroyed my FB account over drama and “friends” and whatever. Now I’m just getting more and more concerned with privacy and how much Facebook seems to be willing to erode what little of it we have left. From hard-to-understand privacy settings to the latest:

Today, Facebook removed its users’ ability to control who can see their own interests and personal information. Certain parts of users’ profiles, “including your current city, hometown, education and work, and likes and interests” will now be transformed into “connections,” meaning that they will be shared publicly. If you don’t want these parts of your profile to be made public, your only option is to delete them.

So I’ve now deleted all that info from my profile. But I’m getting that uneasy feeling that Facebook is becoming more of a worry as far as my privacy is concerned vs. how much I get out of it. The consideration of deleting my account continues, I guess.

Google has updated Gmail to include a “Buzz” tab, where you can prevent the public from seeing your followers list, remove the Buzz inbox from Gmail, and, as the nuclear option, completely kill your Buzz account

That last link, with the warning sign and red text, completely removes Buzz from your Google Profile, according to its wording. A commenter notes that it might also kill your Google Profile entirely, so be cautious if that’s something you want to keep around.

I’m blocked from Gmail at work and can’t bring up the full desktop version from my iPhone, so I guess I’ll have to wait to do this until later this eve. But there is that note about deleting your Google Profile that will be interesting to watch. I find it interesting that Google is taking a course of action here that will not just bring you back to where you started before Buzz, but actually to a lower level of end-user engagement by deleting profiles. If anything, this privacy debacle has made me take a good look at what I use my Google account for besides email, if not thinking about pulling my personal email from Google entirely – with the full support from my lovely wife who noted that it’s not like I haven’t changed my address a bunch of times recently.

UPDATE: Yup, it works as advertised from what I can tell. No more Buzz and no more Google Profile.

You’ve got to wonder how badly you foobered up your product release when the Electronic Frontier Foundation has this to say about Buzz:

If you’re going to use Google Buzz, we recommend that you opt-out during profile creation. If you have already created a profile,¬†change it to private immediately. Then go through the suggested list, and edit it as appropriate before making it public again. PC World has a helpful¬†privacy checklist to help users understand the privacy implications of Google Buzz options.

How many people are going to want to read through such checklists and really tweak their profile/settings in order to actually take advantage of Buzz while maintaining some semblance of privacy? I just turned it off and removed anything I could find related to Buzz in my profile. If anything, it made me take a closer look at how open my profile was on Google.

Fail, Google. Really really really huge fail.

Didn’t realize that Google Buzz gets turned on with some really, really huge privacy-nuking options. WTF, Google?

From the Silicon Valley Insider:

A Google spokesperson asked us to phrase this claim differently. Like this:¬†“In other words, after you create your profile in Buzz, if you don’t edit any of the default settings, someone could visit your profile and see the people you email and chat with most (provided you didn’t edit this list during profile creation).”

I guess I could take some time to figure out how to protect myself, but instead I’ll be sitting it out for now with a tech tip from Consumerist:

You can go into Buzz and selectively follow/unfollow certain people to avoid this kind of incident, but the best evasive maneuver is to scroll down to the bottom of the screen and click “Turn off Buzz.”

Wow… just wow, Google.

Make sure you never upload anything you don’t feel comfortable giving away forever, because it’s Facebook’s now.

Queue the millions making FB groups denouncing Mark Zuckerberg, and so on. It now looks like the people at FB are taking a longer look at their decision:

Over the past few days, we have received a lot of feedback about the new terms we posted two weeks ago. Because of this response, we have decided to return to our previous Terms of Use while we resolve the issues that people have raised. For more information, visit the Facebook Blog.

If you want to share your thoughts on what should be in the new terms, check out our group Facebook Bill of Rights and Responsibilities.

Whether you decide to keep your Facebook account or not, you might want to get just a wee bit more paranoid about who can see your stuff. And thus the recommendation of an excellent article over at AllFacebook: 10 Privacy Settings Every Facebook User Should Know. There were more than a few good suggestions in there that I had no idea you could do. Read it. Facebook it.