Original URL: https://www.theregister.com/2011/05/13/facebook_security_criticism/

One thumb up for Facebook security improvements

Outstandingly mediocre

By John Leyden

Posted in Security, 13th May 2011 15:28 GMT

Security changes designed to curtail the spam and scams that have become endemic on Facebook over recent months have received a cautious welcome from security watchers.

Facebook has introduced a raft of features including: a known-bad-site blacklist (via a partnership with crowd-sourced blacklist outfit Web of Trust); protection against clickjacking; and limited support for two-factor authentication. As an opt-in service, Facebook will send users an SMS every time someone logs in from "a new or unrecognised device".

Net security firm Sophos welcomed the changes as a step in the right direction but criticised the dominant social network for not going far enough towards creating a genuinely safe online environment. Further measures Facebook ought to introduce include a popup confirmation dialog every time a user "likes" something, and an option to apply two-factor authentication for every login, not just for those from new devices.

"There's much more they could be doing, so we all need to maintain pressure on Facebook to keep on improving," said Paul Ducklin, Head of Technology, Asia Pacific at Sophos.

A blog post by Sophos, explaining its take on the changes, can be found here. ®