Yep, I’m on Facebook. And so are many of you. And a bunch of us are all friends with each other. It is fun. It can sometimes be a bit addictive. And I’ve talked with old friends from high school and college that I had not heard from in more than 30 years! All good.
Facebook is also one of the most targeted sites for phishing scams. Latest statistics for the month of March show that Facebook was the seventh most phished site on the web. At that time, 104 phishing sites were identified as targeting Facebook. Thats an average of three different phishing campaigns per day.
And it is no surprise. Facebook is a prime target. It continues to be the third most popular web site for users in the United States, having topped the 200 million user mark just this month. Of those users, more than 100 million log on each day. With that much traffic, a good scam can catch a lot of people.
The most recent identified phishing attack was just yesterday. That attack encouraged users to enter their Facebook login information on a screen that looked real - but wasn’t. It doesn’t seem any attempt was made to gain financial advantage directly from this, but it was an attempt to steal login names and passwords so the user could co-opt profiles which they can then use to get your friends to download malicious software.
Facebook is very good at catching and stopping the bulk of these attacks before they become widespread. But it never hurts for you to exercise caution.
So how can you use Facebook and still be safe? When you go to log in, add the “s” to your http. So enter “https://www.facebook.com” into your browser when you want to reach the login page. You’ll notice your browser changes and shows a green name strip with “Facebook, Inc (US)” in the bar. If you wanted, you could click on that green bar and get additional information about the site. But just by using that address to reach the login screen, you are doing all you can to guarantee that you are reaching the secure login screen for Facebook.
What makes that little green bar pop up there? Something called “extended validation” (”ev certs” for short). This is a technology that companies can purchase to help inform their users. Buying into the program is somewhat costly and requires a background check that can take several weeks. At this time, it is the most secure option for banks and other large web sites to help their customers feel peace of mind.
And all it takes from you is just that extra “s”.