Facebook — get your security act together, says frustrated expert

Dear Facebook,

I appreciate your service. I really do. I’m sure that many of your 400 million active users appreciate it as well. But now that you have a market value estimated at billions of dollars, it is time for you to start acting like a grown-up company.

That means you have to provide basic security for your customers. And it means responding when your customers try to contact you, as I did recently to talk about an important security issue. Do you think you will be able to hold on to 400 million users if you treat them that way, and if you put their computers at risk? I don’t.

As you can see, I have had to resort to writing an open letter, because all other attempts to get through to you were unsuccessful. I will be interested to see whether you respond to representatives from the media, or if you ignore everyone equally. Maybe you figure you have all 400 million of us over a barrel, since you provide a primary method of business contact and personal communication. Just keep in mind that MySpace was once the premier social networking site, and it was replaced – by you.

Here is what I wanted to talk to you about, though: you are leaving your users open to a major security risk. Five minutes ago, I clicked on a page on your site, causing a new window to open that urgently warned me that my system was loaded with viruses. I was encouraged to click a link in order to run a program that would rescue my machine, but I didn’t do that; I know malware when I see it, and I don’t allow scripts to run on my computer.

The problem is that many of your 400 million users don’t know very much about malware. And by allowing things like that pop-up window from your site, you are putting their computers at risk. And that’s bad news for all of us, since the likely result will be even more botnets in the world.

This was the fifth time in a month that something like this happened to me on your site. Now, if it happened to me that often, how many millions of times did it happen to all those other Facebook users?

Why are Facebook users being exposed to risk this way? Because you allow advertisers on your site who provide malicious links. Worse, you seem to do nothing to prevent such ‘ads’ from running programs when someone loads the page. A company with 400 million customers that’s worth billions should be able to filter out these attacks. I know plenty of sites run by much smaller entities that do as much. And I don’t know of any other major site that allows this sort of thing to happen.

And that is why I tried to contact you personally before writing this open letter. That experience taught me that contacting customer service at Facebook is clearly the biggest waste of time on the internet. That says a lot.

I know: I and all of your millions of other users are able to use your site for free. But is that really an excuse for exposing us to dangerous stuff? Like you, Google provides a free service and makes its money by selling ads. But I’ve never had a problem like this using Google. Compare that with five times in a month.

You also might be interested to know that I have grown to doubt that Facebook can be trusted as a place to conduct business. I can’t understand why you wouldn’t do more to avoid that perception. I don’t think I am alone in thinking it. In my case, I lost my faith in your reliability when, for some unknown reason, you deleted a fan page that I had created. I lost data in that incident, and (big surprise) all efforts to contact you to talk about how I might get it back went nowhere. If you’re reading this, let me tell you that I still want my data back.

I hope I hear from you. Ideally, you would respond with a carefully crafted plan of action. But a vague promise to do better would be pretty good. Heck, at this point, even a denial that there is a problem would be better than what I’ve seen from you so far.

But I think you can do better than that. I think that now that you’re a major company, you’ll want to start acting like a grown-up. I think you’ll do that because you know that users aren’t going to stand by a company that treats them badly.

So, Facebook, what’s it going to be?

Thanks,

Ira Winkler, frustrated Facebook user and Computerworld columnist