How would you feel if you knew that your Facebook could be hacked by company technicians without needing to have your credentials?
Earlier this week, Anjunabeats record label CEO Paavo Siljamäki drew attention to this issue by posting a very interesting story on his Facebook wall. During a visit to Facebook’s Los Angeles office, a Facebook logged into his account after getting his permission, but the strange thing was that he was able to do so without using a password.
After that, Siljamäki contacted Facebook wanting to find out how many of the company's staff have this kind of access to their Facebook account, when exactly they can access users' personal data, and also, how each of us will know that someone from Facebook has logged into our account.
Facebook issued the following statement according to Venturebeat:
"We have strict administrative, physical and technical controls in place to limit employee access to user data. Our controls have been independently assessed by third parties and have been confirmed on multiple occasions by the Office of the Irish Data Protection Commissioner as part of our audit of our practices."
The company did not explain exactly who can have access, but assured its users that account access is tiered and limited to specific job levels. Access to accounts is granted to employees in order to respond to a customer request regarding information or platform errors.
"Specialized employees can only access the amount of information necessary to perform their duties, such as responding to bug reports or account support inquiries. We have a zero-tolerance approach to abuse, and inappropriate behavior."
In short, the company appears to have a customer service tool that can grant Facebook employees access to any user’s account. The company runs two separate monitoring systems that produce weekly reports of suspicious behavior that are then reviewed and analyzed by two independent security teams, made up of a specially selected group of employees. These employees, according to the company, are considered trustworthy…
Source: secnews.gr
