Proaktiv IT säkerhet
 

May we use your social network account, please

Introduction

Social networks have quickly become major communication devices.  They may be used to influence public opinion, and some argue that social media were crucial in this year's political changes in several countries in the Middle East.

It should therefore come as no surprise that new ways to utilize social networks arise. This article will examine one such initiative.

The Climate Reality Project

About the project

The Climate Reality Project's web site tells that this organization 

 (...)  is bringing the facts about the climate crisis into the mainstream and engaging the public in conversation about how to solve it. We help citizens around the world discover the truth and take meaningful steps to bring about change.
Founded and chaired by Al Gore, Nobel Laureate and former Vice President of the United States, The Climate Reality Project has more than 5 million members and supporters worldwide. It is guided by one simple truth: The climate crisis is real and we know how to solve it.

14 September, The Climate Reality Project will during 24 hours

(...) focus the world’s attention on the full truth, scope, scale and impact of the climate crisis. To remove the doubt. Reveal the deniers. And catalyze urgency around an issue that affects every one of us.

The project's use of social networks

In order to draw attention to this event, the project encourages using social media, in particular Facebook (climatereality) and Twitter (@climatereality account and hashtag #reality).

However, The Climate Reality Project also introduces another option - supporters may "donate" their Facebook and Twitter accounts to the project during 24 hours.


Click image to enlarge

 

Supporters may allow an application access to Facebook and/or Twitter accounts and spread information about the project through these channels.


Facebook application request

 

Many will agree with The Climate Reality Project's objective to spread information about changes in our planet's climate. In general, more information is a good thing.
The organization's proposal to use social network accounts however, may be a different matter.

We shall examine some aspects of this from a general perspective.

We would like to stress that we do not believe that The Climate Reality Project's social network applications will be used in any way other that what the organization's terms state!

A security perspective

The most worrisome issue regarding the proposed model is with respect to security. You are asked to allow an application access to your social network account(s).

Consider the following:

The request's authenticity

You may get a request from an organization you trust, an individual you trust, or an idea that you agree with, to allow an application to access your social media account.

This request may be perfectly legitimate and nothing bad will happen to you and your account.

However, we know from a plethora of examples that any request using the Internet as communication medium may be "spoofed" (pretending to be from someone that it is not). The request you believe is sent from your trusted friend next door may originate from a person in another country far away with malicious intent.

If you accept the request and allow the application access to your social media account, the result may be that you supply your followers/friends with information of a character that is not at all in line with what you expected (and agree with).

You may cause considerable harm to others, and your own reputation may be severely harmed before you are able to revoke the application's access to your account. 

The request's truthfulness

The application's terms of use may state that it will only perform certain actions.

How do you know that this is true?

Even if the request comes from an entity that is the correct one (see previous chapter), that person or organization may try to trick you into allowing the application access to more than you want. Just by lying to you.

If you are really unlucky you may experience that your account is abused and that you become associated with publishing information, which does not comply with your views.

In general, you should be very careful before you allow any application access to your social media accounts.
Rogue applications are probably the most popular way for criminals to exploit social network users.


A spam perspective

We may also view this from a perspective where we examine whether messages sent by this method should be viewed as spam messages.

In order to determine this, we must define what is meant by spam. Wikipedia uses this explanation:

Spam is the use of electronic messaging systems (including most broadcast media, digital delivery systems) to send unsolicited bulk messages indiscriminately.

Unsolicited and indiscriminately are the operative words in determining if a message is spam or not.

We will argue that if you have started to follow a person on Twitter and befriended someone on Facebook, you have made a deliberate choice and voluntarily accepted to receive information from that person. You accepted this even though you did not know which messages she might send at a later point in time. Seen from that perspective the messages you receive are not "unsolicited".

What about "indiscriminately", then? Almost the same logic applies here. Since the information is not sent to "a random group" or "everyone", but to a defined group that has agreed to receive such messages, we cannot say that they are sent indiscriminately.

We must therefore conclude that this type of messages cannot be defined as spam by using the spam definition above.

Another point altogether is that a flow of messages from e.g. one Twitter "followee" may be perceived as spam by her followers. The same applies to any message that the follower does not want, we should add.

Conclusion

You should exercise extreme caution if you are allowing access to your social network account from any application. This also applies for applications advocating "a good cause" with which you agree.

Allowing third-parties access to your accounts for sending messages may not be defined as spamming in a strict sense, it may easily be perceived as such by your followers and friends.