Researchers find social networking sites Facebook and Google+ are prime targets for easy attacks

Dec 03, 2012

The law created to protect children's online privacy actually increases risk, according to new research from Polytechnic Institute of New York University (NYU-Poly).

The researchers found the Children's Online (COPPA), enacted to protect the privacy of children under the age of 13, indirectly puts their privacy at risk because some children lie about their ages when registering on social media sites.

To protect children's privacy, online social networks – such as and + – take additional precautions such as not listing minors in searches of a high school or city and displaying only minimal information in minors' public profiles no matter how they configure their .

In order to bypass these restrictions and join a social media site, children under 13 will sometimes lie about their ages, often saying they are over 18 years of age. The social network will then consider them adults and no longer take special precautions to protect their privacy. By gathering and statistically processing the friend lists of these lying minors, the research team showed that it is possible to find most of the students in any target high school – including those registered truthfully – and create detailed profiles of them. The analysis strongly suggests there would be significantly less privacy leakage to third parties without the COPPA law.

The NYU-Poly Department of Computer Science and Engineering research team led by Professor Keith Ross, the Leonard J. Shustek Professor of Computer Science, with doctoral students Ratan Dey and Yuan Ding, found that by using Facebook – with modest online crawling, and simple data-mining practices – an attacker can create extensive profiles of most of the minors in any target high school. These profiles include full name, hometown, , grade and profile picture, and for many students much more. This amounts to significantly more information than what is available in a minor's public profile on Facebook.

To demonstrate the attack, the researchers applied it to three high schools in different regions of the United States. An attacker could use such profiles for many nefarious purposes, including selling the profiles to data brokers, large-scale automated spearphishing attacks on vulnerable minors, as well as physical safety threats such as stalking, kidnapping and arranging meetings.
The NYU-Poly researchers calculated how much privacy leakage there would be with and without the COPPA law. The results suggest that an attacker can discover significantly more minors and build more extensive profiles than what would be the case without COPPA.

"The problem with the COPPA law is that it introduces an incentive for minors to lie about their age," Ross said. "Lying about their age not only puts their own privacy at risk, but those of other minors who do not lie. However, there are solutions that both the federal government and Internet services can implement independently or together to make online social networks safer for young users."

One possible solution is to repeal the law. But Ross said sites could also significantly improve children's privacy by disabling the friend reverse-lookup feature, by which
a user who hides her friend list can still be discovered on a friend's page.

"It is also important that parents assess the risks of their children in light of this new study," Ross said. "Children need to know that, just as in the physical world, the actions of their virtual friends affect them."

The full report can be viewed at research.poly.edu/~ross/HighSchool.pdf .

Explore further: Facebook lets users squirrel items away

add to favorites email to friend print save as pdf

Related Stories

Why parents help their children lie to Facebook about age

Nov 02, 2011

A major new nationwide study released today, co-authored by Eszter Hargittai, associate professor of communication studies at Northwestern University, shows that many parents know that their underage children are on Facebook ...

Facebook explores access for kids under 13

Jun 04, 2012

Facebook is working on technology that would permit children under the age of 13 to use the social network site with parental supervision, people familiar with the effort said Monday.

Recommended for you

Putin signs law seen as crimping social media

47 minutes ago

President Vladimir Putin on Tuesday signed a law requiring Internet companies to store all personal data of Russian users at data centres in Russia, a move which could chill criticism on foreign social networking ...

User comments : 0