Facebook offers a lot of ways to connect to friends, and is a very successful tool for making new friends. However, sometimes this kind of openness leads to security and privacy issues, even if they aren’t your issues, it can very quickly become one.
Below is a guide that works as of August 2020 to lock down your Facebook and be confident that your best security posture is applied when browsing Facebook.
This article is separated into a few different sections, as there are several ways to access Facebook, and several ways that Facebook can access your profile on other websites.
Facebook Settings
Login Security
Friend Recognition
This feature allows you to select a group of friends that can help you log back in if you get locked out.
It gives your friends security codes to give you over another medium, such that you can enter them to both verify your identity and grant you access to your account.
After you do this, go down to the Login settings on that page, and change your password:
I’d recommend changing your password using a password manager, e.g. 1Password, LastPass to ensure it’s randomized. Meaning you can’t be forced to disclose it if you don’t know it! All you have to remember is a master password to unlock the others, and I would advise to re-prompt for master password when using your password-manager saved password.
Disable your browser’s built-in password manager! – https://support.1password.com/disable-browser-password-manager/
I would advise that you NOT use the “Save your login info” feature, unless the device you’re signing into Facebook with is exclusively under your control and physical access.
Two-Factor Authentication
I cannot stress enough how important it is to use 2FA/MFA (2 Factor Authentication/Multi-factor Authentication)
Essentially, enabling this option means that not only do you have to know your email and password to login, but it will also enforce a 6-digit code which changes every 60 seconds to be input/copied from a device configured with e.g. Google Authenticator, Lastpass Authenticator. Once it’s enabled, you will not be able to login to facebook.com without it.
The direct page for the settings is 2FA Settings
For Backup authentication, I would recommend that you do NOT enable SMS, as SMS is vulnerable to Simjacking.
Security Key (U2F, e.g. YubiKey) and Recovery Codes (written) are a great idea to have enabled, as it’s something you must physically have in order to login. Recovery codes are better to be written on pen and paper, such that if your computer gets compromised, your recovery codes are not at risk.
Authorized Logins is useful if you don’t want to HAVE to login every time on e.g. a mobile device, so your device is pre-authorized. You can also use App Passwords to generate passwords which log you in but are not your actual password. Though not particularly recommended.
The above option sends you a Messenger, Facebook, and Email notification whenever a successful login is detected from a device you haven’t logged in with before, or in a location you haven’t logged in from before. Quite useful to have all notification options enabled.
Advanced – Signed/Encrypted emails from Facebook
Using this option is for expert users, which prefer to receive OpenPGP signed emails from Facebook. This means that you’ll need to import Facebook’s public key into your email program’s PGP keystore. In the text field, you would put YOUR OpenPGP PUBLIC key. Saving changes at this point will give others access to view your public key. Checking the box will mean that you must have Facebook’s public key imported as well as your OpenPGP public key saved there. Facebook will then sign/encrypt outgoing email notifications with Facebook’s and your public key, so that only an email program loaded with your PRIVATE key can read it, and the signature can be verified as coming from Facebook.
If OpenPGP is something that interests you, then you can read more about it here:
https://www.openpgp.org/software/
Your Facebook Information
This page contains the settings under the subheadings below, and is directly correlated with the visibility of specific information that you put on Facebook, otherwise it defaults to being Public, e.g. visible while not logged into Facebook.
OFA (Off-Facebook Activity)
Facebook has several programs and ad platforms which utilize a tracking pixel, JavaScript SDK and App integration to identify who you are via Facebook on sites that utilize the aforementioned methods.
The above URL will show you a list of websites that have shared your Facebook activity. It’s best not to “Clear History” as this will wipe out records of what you’ve used Facebook to log into. Instead, if there’s something you feel should no longer have associated with your Facebook account, then click on the item, and click the “Turn off future activity from [APP]”. The example below is from Pokemon GO, which requires that you log in via Facebook. If you don’t play it anymore, you should turn it off.
To set the future default for off-site activity, go to the link below.
Then you can toggle the slider to the off setting. Doing this may require that you log in every time manually when an app requires a Facebook login, and data should not be saved to your Facebook account if future activity is disabled.
Privacy
This page controls the settings for your visibility, and visibility of specific things. In the interests of time, I have saved a default which should keep your profile hidden, and only visible to friends and friends of friends. It’s not perfect, but it’s a lot safer than having it public, where anyone can message you anything, and limits your exposure.
If your profile has been on Public since it’s birth, you should use the Limit Past Posts option to set a custom visibility policy. I’ll usually set this to Friends of Friends, or Friends, so that prior posts where visibility or privacy was not set will be limited to what you set here by default. You can still override this per-post at the time of making the post.
Your likes and public group associations will still be Public, there’s no way to hide that.
Apps & Websites
This page control what apps or games you’ve logged into Facebook with. This setting used to be called “Platform”. The “Apps, Websites and Games” option controls the global ability to login with Facebook outside of a Facebook context. If you don’t want to allow this, and you only want to have Facebook login used to login to Facebook, turn this option OFF.
Ad Preferences
On this page, under the Your Information accordion, you can disable/enable specific information from being shared with advertisers. Pretty simple to manage, so not a whole lot of explanation needed here.
Browser Addons/Extensions
If you install this extension, it will remove specific ID tracking variables from URLs that are clicked on from Facebook as well as other websites. This helps to anonymize you while visiting links that are part of ad campaigns by stripping the campaign variables out and visiting the link regularly. This also puts less stress on cache based websites.
This extension sandboxes clicked links from interfering with other tabs you have open, and is useful for ensuring isolation between regular sites, such that your existing Facebook session is not available to websites configured to query currently logged in user information.
Best Practices
- Clear the Recent Logins when you log off of Facebook, so as to ensure that you are fully logged out.
- Ensure that when you login, you see https:// in the URL bar. If you don’t see the lock and https:// DO NOT LOG IN.
- Never use email or unencrypted mediums to transmit your password or email. This has the potential to give an attacker/hacker information about your account.
- Use an email that’s separate from your personal email, e.g. an email that’s for Facebook only.
- Don’t click on videos or strange looking links sent to you via Messenger, even from Trusted friends, and especially not from people you don’t know personally.
- Review your login history every once in a while. Go to Settings > Security & Login > Where you’re logged in. Ensure that your prior logins are valid and from the correct type of device and location. If you see one you don’t know, go ahead and change your password.
- You don’t want to share your personal profile URL on other websites where the visibility is public. Your profile will get spammed when search engines and spiders crawl the site your profile was linked from.
- If you receive a link that you’re unsure of, check the link using OG Debugger