Subscribe

Facebook sees your hacked account as a revenue stream

by Jay on February 15, 2010

: Image by aulia.m via Flickr

Frankly, we would have blogged about this sooner except we honestly thought Facebook would have been forced to reverse course by now. In any case, Facebook has an established policy in place for helping you “reclaim” an account that has been hacked — and that policy now includes forcing you to use McAfee antivirus software.

As part of the Facebook account-reclamation process, you’ll be given a free six-month subscription to a McAfee antivirus product (the same one that all Facebook users can get from the McAfee Facebook page). Facebook wants to verify that your desktop hasn’t been compromised with some sort of malware that led to the compromised account — a keystroke logger, for example, that snagged your Facebook password — which makes a certain amount of sense. The problem is that only the McAfee product is an acceptable proof of non-infection.

If, for example, you prefer another security product, you’ll still have to download and run the McAfee scanner at least once to get your Facebook page back. In the case of some corporate accounts, this will mean getting corporate IT involved, especially if company policy requires running another security product exclusively. It’s also unclear how much information about your PC is sent back to McAfee and/or Facebook by the antivirus scanner, but you can be certain it ain’t nothing.

While it’s understandable that Facebook wants a known security system to audit your desktop — although no mention is made of users that access Facebook from multiple machines and venues, including home PCs, work PCs, public kiosks, and mobile devices over public wi-fi — what’s really going on here is that Facebook is getting paid to generate customer leads for McAfee, and is using their own account suspension process to goose the numbers.

There’s a serious potential conflict of interest here. After all, you really only have Facebook’s word that they have evidence your page was “compromised.” While they may be entirely forthright and honest with every user on this front, the temptation is there to lower the security risk threshold such that an ever-growing number of users must re-verify their accounts and use the McAfee product to do so. From an extreme point of view, Facebook can hold your page “hostage” until you use the McAfee product they’ve agreed to promote.

How much safer do you feel about your Facebook data now? Hope you’ve got a backup plan.