Analyzing Facebook’s Security Mechanisms

For my Privacy, Security and Cryptography class, we studied a set of 13 principles for secure systems:

1. Security is Economics
2. Least Privilege
3. Use Fail-Safe Defaults
4. Separation of Responsibility
5. Defense in Depth
6. Psychological Acceptability
7. Usability
8. Ensure Complete Mediation
9. Least Common Mechanism
10. Detect if You Cannot Prevent
11. Orthogonal Security
12. Don’t Rely on Security Through Obscurity
13. Design Security in, From the Start

For our midterm, we were asked to analyze how Facebook exemplifies or does not follow these principles. It was an interesting assignment, which finally forced me to think more thoroughly about Facebook’s security policies, and I’m happy to attach my findings here.

For some people these may be rather run of the mill notes. For others, you may be surprised at poor security of the world’s biggest photo and social networking site.

Enjoy.