Be careful who you befriend on Facebook

Jan 21, 2010, 16:24 GMT

Munich - People who use a symbol - a rubber duck or a pair of cats, for example - as their profile photo on Facebook couldn't be all bad.

That must have been what quite a few recent Facebook users thought when they received friendship requests from people with just such profile photos. They accepted them without checking who they were and thereby got themselves into some unpleasant business. That's because not every friend request is from a person of a similar age and with good intentions.

When in doubt, reject the request, is a good rule of thumb. Not every person that a user knows fits into every friendship list.

The Facebook profiles with the rubber duck and cats in fact didn't belong to a bad person. The IT security company Sophos of Mainz, Germany was behind them. It wanted to find out how generous internet users are with their data.

The answer is they are seemingly quite generous. Almost half - 46 per cent - of the 100 Facebook users who were sent the messages added them as friends. Similar to other internet-based social networking services designed for professionals, friending gives the person access to the user's profile. The profile is where users have the option to fill in information about themselves such as marital status, hobbies, religious beliefs, political preferences and where they have worked in the past. The information is only a few clicks away and, depending on how thoroughly the user has described himself, can provide a lot of personal data.

Who would be interested in getting listed as a friend or added as a contact by a complete stranger? Often it's the same people who are interested in gathering e-mail addresses: Spammers.

'Behind these friend requests is an interest in finding out more about you,' said Guenther Ennen of Germany's federal office for security in information technology in Bonn. People who know what hobbies a particular network user has and in which industry another user works can send out targeted advertisements. Or the information can be sold to spammers.

Security experts say it can be worse for careless users when their supposed friends send them an undesired programme. This is achieved more and more frequently through personally addressed emails that sound trustworthy and encourage the recipient to click on a link.

In light of the risks the recommendation of Christian Spahr of the industry association BITKOM in Berlin is very straightforward.

'We advise users to accept as friends or contacts only people they know personally,' Spahr said. This has the advantage of limiting the list of friends to people the user can identify with, he added. 'I don't understand what motivates people to have 300 or 500 friends,' Ennen said.

There's no rule saying every friend request must be answered positively.

'Basically, no-one is required to add another user to their list,' said Spahr. This applies to strangers in any case and even to people whom the user knows, but that he or she doesn't want to take into his list: Distant acquaintances who always were annoying, pushy former lovers, colleagues and even one's boss.

Spahr advises against mixing friend and contact lists. Don't put your boss on the friend list and don't put friends on the list of contacts. This prevents the boss from seeing embarrassing photos posted by the user's friends.

Putting friends and employers on the same list is recommended only when using sites that allow the user to differentiate between them. Then they can set their profile to allow certain friends access to all information, while the others can look at only part of it.

Denying business partners and one's boss access to wild party photos can't hurt. It's also clear that all consideration about who gets on the list of friends and who doesn't only makes sense if the profile is set on private or not published. Otherwise anyone can see all the user's information.