Design and Implementation of FAITH, An Experimental System to Intercept and Manipulate Online Social Informatics

Social informatics is the core of Facebook's business and its most valuable asset which consists of the social graph and the private data of over 500 million users of the social network. However, without secure methods of managing this data, Facebook has become vulnerable to privacy risks and devaluation. In Facebook's model, users are asked upon access to grant applications the required permissions without sufficient knowledge of the applications intentions. As a result, if they are deceived, users risk the exposure of sensitive and personal data. This paper presents a system dubbed FAITH (Facebook Applications: Identification, Transformation & Hypervisor) to mitigate or eliminate these issues by enhancing the management of social data. First, FAITH allows users to adjust the visibility of their social informatics for each individual application depending on how much they trust the application. Users can configure to let non-trusted applications run with the least privileges (least amount of social informatics) to minimize potential privacy leakage. Second, FAITH logs the activities of applications to assist users in make more secure decisions. Users can closely monitor each activity performed by applications to adjust their privacy settings more securely. Third, FAITH allows users to transform their social graph such that different applications see different social graphs to prevent the formation of friendship inflation caused by applications. The implementation of FAITH needs only the resources and tools made available to public by Facebook, and requires no further cooperation from the social network. FAITH is a prototype system; thus, the design and the concept can be extended to secure other OSNs (Online Social Networks). Currently, FAITH contains thirteen Facebook social applications and has been officially released for public usage with approximately two hundred monthly active users.