Here's Your Job Application. Now Give Us Your Facebook Password

Tuesday, March 20, 2012 by Common Dreams
Employers asking for employees' Facebook passwords; ACLU calls it "gross breach of privacy"

Some companies and government agencies are demanding Facebook passwords from prospective employees during job interviews. Civil liberties advocates including the ACLU have slammed the practice as a violation of privacy. Unfortunately, for many who are unemployed or under-employed, the pressure to submit to such a request may be high.

Orin Kerr, a George Washington University law professor and former federal prosecutor, told the Associated Press, "It's akin to requiring someone's house keys," and called it "an egregious privacy violation."

Frederic Wolens, a Facebook spokesperson, gave a statement to MSNBC indicating that an employer asking for a prospective employee's login information would violate the terms of Facebook. "Under our terms, only the holder of the email address and password is considered the Facebook account owner. We also prohibit anyone from soliciting the login information or accessing an account belonging to someone else."

Students have not been immune to this privacy invasion either. A minor student in Minnesota was coerced into giving her Facebook and email login information to school authorities, prompting a lawsuit from the ACLU-Minnesota.

* * *

The Daily Mail: Revealed: How colleges and employers ask for candidates' Facebook and email passwords during job interviews

Rather than trying to get around the pesky password protections of Facebook and email accounts, certain government agencies and colleges are cutting straight to the source.

Some extremely inquisitive employers are asking candidates to hand over to them their email and Facebook login information when they apply for a job.

Others strongly request that the candidate opens their pages in front of them and allow their would-be bosses to scroll through their private information during the interview. [...]

They say that while ‘shoulder surfing’, as the practice is called, may technically be voluntary, the vast majority of applicants feel obligated to open up their lives to their employers or risk losing the job.

* * *

Alexis Madrigal: The Atlantic
Should Employers Be Allowed to Ask for Your Facebook Login?

The ACLU calls this policy "a frightening and illegal invasion of privacy" and I can't say that I disagree. Keep in mind that this isn't looking at what you've posted to a public Twitter account; the government agency here could look through private Facebook messages, which seems a lot like reading through your mail, paper or digital.

* * *

Meredith Curtis: ACLU
Want a job? Password, please!

Maryland corrections officer Robert Collins approached the ACLU of Maryland late last year, disturbed that he was required to provide his Facebook login and password to the Maryland Division of Corrections (DOC) during a recertification interview. He had to sit there while the interviewer logged on to his account and read not only his postings, but those of his family and friends too.

"We live in a time when national security is the highest priority, but it must be delicately balanced with personal privacy," said Collins. "My fellow officers and I should not have to allow the government to view our personal Facebook posts and those of our friends, just to keep our jobs." [...]

The demand for Facebook login information is not only a gross breach of privacy for Officer Collins and his friends, it raises significant legal concerns under the Federal Stored Communications Act and Maryland state law, which protect privacy rights and extend protections to electronic communications.

* * *

ACLU-MN files lawsuit against Minnewaska Area Schools

St. Paul, Minn. – Today, the American Civil Liberties Union of Minnesota filed a lawsuit in Federal District Court against Minnewaska Area Schools and the Pope County Sheriff's office for violating the constitutional rights of a minor student. R.S's free speech and privacy rights were violated by the school district in two separate instances involving Facebook. (To protect the privacy of the minor defendant, she will be referred to as R.S.)

In early 2011 R.S. posted a comment, while at home, on her Facebook page about her dislike of a school staff member. The school learned about the comment, and R.S. received a detention and was forced to write an apology to the staff member. She was disciplined again when she cursed on her Facebook page, complaining that someone reported her to the school. This time she was given an in-school suspension and was prohibited from attending a school field trip. The ACLU-MN contends that these sanctions violate her First Amendment right to freedom of speech.

In a second incident R.S. was brought into a school administrator's office where she was coerced to turn over (against her will) login information to her Facebook and email accounts because of allegations that she had online conversations about sex with another student off-campus. Present at the search was a local deputy along with two school officials. During this process, R.S. was called a liar and told she would be given detentions if she did not give the adults access to her accounts. R.S.'s mother was not informed about the search until after it happened. The Deputy and school officials did not have a warrant to search R.S.'s private accounts. The ACLU-MN alleges in their suit that this violated R.S.'s Fourth Amendment right to be free from unreasonable search and seizure. [...]

"Students do not shed their First Amendment rights at the school house gate," stated Charles Samuelson, Executive Director for the ACLU-MN. "The Supreme Court ruled on that in the 1970s, yet schools like Minnewaska seem to have no regard for the standard."

* * *

MSNBC: Govt. agencies, colleges demand applicants' Facebook passwords

Employers and colleges find the treasure-trove of personal information hiding behind password-protected accounts and privacy walls just too tempting, and some are demanding full access from job applicants and student athletes. [...]

Student-athletes in colleges around the country also are finding out they can no longer maintain privacy in Facebook communications because schools are requiring them to "friend" a coach or compliance officer, giving that person access to their “friends-only” posts. Schools are also turning to social media monitoring companies with names like UDilligence and Varsity Monitor for software packages that automate the task. The programs offer a "reputation scoreboard" to coaches and send "threat level" warnings about individual athletes to compliance officers. [...]

 on colleges, while spreading quickly among athletic departments, seems to be limited to athletes at the moment. There's nothing stopping schools from applying the same policies to other students, however. And Shear says he's heard from college applicants that interviewers have requested Facebook or Twitter login information during in-person screenings. [...]

The practice seems less common among employers, but scattered incidents are gaining attention from state lawmakers. The blog Tecca.com last year showed what it said was an image of an application for a clerical job with a North Carolina police department that included the following question:

"Do you have any web page accounts such as Facebook, Myspace, etc.? If so, list your username and password."

Hacking Weak Passwords

As my email got hacked recently, this is timely...

***

How I’d Hack Your Weak Passwords

Internet standards expert, CEO of web company iFusion Labs, and blogger John Pozadzides knows a thing or two about password security—and he knows exactly how he'd hack the weak passwords you use all over the internet.

Note: This isn't intended as a guide to hacking *other people's* weak passwords. Instead, the aim is to help you better understand the security of your own passwords and how to bolster that security.

If you invited me to try and crack your password, you know the one that you use over and over for like every web page you visit, how many guesses would it take before I got it?

Let's see… here is my top 10 list. I can obtain most of this information much easier than you think, then I might just be able to get into your e-mail, computer, or online banking. After all, if I get into one I'll probably get into all of them.

1. Your partner, child, or pet's name, possibly followed by a 0 or 1 (because they're always making you use a number, aren't they?)
2. The last 4 digits of your social security number.
3. 123 or 1234 or 123456.
4. "password"
5. Your city, or college, football team name.
6. Date of birth – yours, your partner's or your child's.
7. "god"
8. "letmein"
9. "money"
10. "love"

Statistically speaking that should probably cover about 20% of you. But don't worry. If I didn't get it yet it will probably only take a few more minutes before I do…

Hackers, and I'm not talking about the ethical kind, have developed a whole range of tools to get at your personal data. And the main impediment standing between your information remaining safe, or leaking out, is the password you choose. (Ironically, the best protection people have is usually the one they take least seriously.)

One of the simplest ways to gain access to your information is through the use of a Brute Force Attack. This is accomplished when a hacker uses a specially written piece of software to attempt to log into a site using your credentials. Insecure.org has a list of the Top 10 FREE Password Crackers right here.

So, how would one use this process to actually breach your personal security? Simple. Follow my logic:

• You probably use the same password for lots of stuff right?
• Some sites you access such as your Bank or work VPN probably have pretty decent security, so I'm not going to attack them.
• However, other sites like the Hallmark e-mail greeting cards site, an online forumyou frequent, or an e-commerce site you've shopped at might not be as well prepared. So those are the ones I'd work on.
• So, all we have to do now is unleash Brutus, wwwhack, or THC Hydra on their server with instructions to try say 10,000 (or 100,000 – whatever makes you happy) different usernames and passwords as fast as possible.
• Once we've got several login+password pairings we can then go back and test them on targeted sites.
• But wait… How do I know which bank you use and what your login ID is for the sites you frequent? All those cookies are simply stored, unencrypted and nicely named, in your Web browser's cache. (Read this post to remedy that problem.)

And how fast could this be done? Well, that depends on three main things, the length and complexity of your password, the speed of the hacker's computer, and the speed of the hacker's Internet connection.

Assuming the hacker has a reasonably fast connection and PC here is an estimate of the amount of time it would take to generate every possible combination of passwords for a given number of characters. After generating the list it's just a matter of time before the computer runs through all the possibilities – or gets shut down trying.

Pay particular attention to the difference between using only lowercase characters and using all possible characters (uppercase, lowercase, and special characters – like @#$%^&*). Adding just one capital letter and one asterisk would change the processing time for an 8 character password from 2.4 days to 2.1 centuries.

Remember, these are just for an average computer, and these assume you aren't using any word in the dictionary. If Google put their computer to work on it they'd finish about 1,000 times faster.

Now, I could go on for hours and hours more about all sorts of ways to compromise your security and generally make your life miserable – but 95% of those methods begin withcompromising your weak password. So, why not just protect yourself from the start and sleep better at night?

Believe me, I understand the need to choose passwords that are memorable. But if you're going to do that how about using something that no one is ever going to guess AND doesn't contain any common word or phrase in it.

Here are some password tips:

1. Randomly substitute numbers for letters that look similar. The letter ‘o' becomes the number ‘0′, or even better an ‘@' or ‘*'. (i.e. – m0d3ltf0rd… like modelTford)
2. Randomly throw in capital letters (i.e. – Mod3lTF0rd)
3. Think of something you were attached to when you were younger, but DON'T CHOOSE A PERSON'S NAME! Every name plus every word in the dictionary will fail under a simple brute force attack.
4. Maybe a place you loved, or a specific car, an attraction from a vacation, or a favorite restaurant?
5. You really need to have different username / password combinations for everything. Remember, the technique is to break into anything you access just to figure out your standard password, then compromise everything else. This doesn't work if you don't use the same password everywhere.
6. Since it can be difficult to remember a ton of passwords, I recommend usingRoboform for Windows users. It will store all of your passwords in an encrypted format and allow you to use just one master password to access all of them. It will also automatically fill in forms on Web pages, and you can even get versions that allow you to take your password list with you on your PDA, phone or a USB key. If you'd like to download it without having to navigate their web site here is the direct download link.(Ed. note: Lifehacker readers love the free, open-source KeePass for this duty, whileothers swear by the cross-platform, browser-based LastPass.)
7. Mac users can use 1Password. It is essentially the same thing as Roboform, except for Mac, and they even have an iPhone application so you can take them with you too.
8. Once you've thought of a password, try Microsoft's password strength tester to find out how secure it is.

By request I also created a short RoboForm Demonstration video. Hope it helps…

Another thing to keep in mind is that some of the passwords you think matter least actually matter most. For example, some people think that the password to their e-mail box isn't important because "I don't get anything sensitive there." Well, that e-mail box is probably connected to your online banking account. If I can compromise it then I can log into the Bank's Web site and tell it I've forgotten my password to have it e-mailed to me. Now, what were you saying about it not being important?

Often times people also reason that all of their passwords and logins are stored on their computer at home, which is safe behind a router or firewall device. Of course, they've never bothered to change the default password on that device, so someone could drive up and park near the house, use a laptop to breach the wireless network and then try passwords from this list until they gain control of your network — after which time they will own you!

Now I realize that every day we encounter people who over-exaggerate points in order to move us to action, but trust me this is not one of those times. There are 50 other ways you can be compromised and punished for using weak passwords that I haven't even mentioned.

I also realize that most people just don't care about all this until it's too late and they've learned a very hard lesson. But why don't you do me, and yourself, a favor and take a little action to strengthen your passwords and let me know that all the time I spent on this article wasn't completely in vain.

Please, be safe. It's a jungle out there.

EDIT: You might also want to listen to my interview on Connecticut Public Radio about password security.

How I'd Hack Your Weak Passwords [One Man's Blog]