Facebook's Mandatory Anti-Malware Scan Is Invasive and Lacks Transparency

I thought the same thing. That's really bad. It's going to train users to be more susceptible to phishing attacks. I can't tell my grandmother that any site that tells her to install software is a scam, because Facebook just made this a legitimate user workflow

I figured this would be satire. It's not satire. https://techcrunch.com/2018/02/12/facebook-starts-pushing-it...

Along the same lines, FTA: "An antivirus product can collect a lot of useful information from the user machine—telemetry data; beyond what Facebook gets through their website—and share it with Facebook. Facebook should make their agreements with antivirus partners public."

Personally quite shocked that anyone in this community would endorse FBs behaviour in general by being users.

A closed version of the internet controlled by a corporation? We should be yelling from the rooftops not nitpicking things like this story

If you're waiting for a sign, here's one:

just get it overwith, you'll be better off.

I think the Russians already won ;)

The article fully explains it; using Facebook doesn't really provide any additional insight. Facebook has decided to lock people out of accounts if their undisclosed mechanisms of detecting a potentially compromised client machine is tripped, and will continue to lock them out until they run a Facebook supplied (but apparently sourced from one or more of a shifting set of partners) malware scanning application is installed on the users machine and run, with all the intrusive level of access that antivirus type of applications tend to have.

There's no other practical means, other than to create a separate account. Facebook in theory will kill your account if somehow it came to their attention that you operate a non-personal account for that purpose. If you kill off your personal account, set up a new account and link it fresh from day one to new advertising & pages, are they likely to ever know? Coin toss. It'll be suspicious to their systems that you don't have any friends, so it might get flagged as a fake account or similar at some point.

The first time I get a Facebook demand to scan my computer, while locking me out of the account, is the last time I use my Facebook account.

I have an account with no friends and that is an admin of one page, which I buy ads for. It’s not my real name, but obviously has my real CC info in there.

Interestingly, a friend showed me his contact list entry for me (I believe created through a 3rd party OSX app), and in the Facebook field it had the name used on the admin/ads account I have. Given I don’t use my real email address on the Facebook account I am amazed (but not particularly surprised) that the connection was made.

Maybe detect browser extensions that malware might drop? Other than that, no idea.

To the common person, what you have outlined is rocket science. You have to remember that most people are not as advanced in computers as you are. What Facebook is doing here is wrong. They are actively indexing files on people's machines and sending that data back to Facebook and their partners. This is a gross invasion of privacy.

Another reason not to use Facebook.

Yeah, totally. I’ll just tell my grandma who uses Facebook to look at family pictures that she just needs to spin up a new VM if she gets locked out.

Is it? Since Facebook knows which browser you used to login, it would be reasonable to expect one scan for each computer you sign in.

I guess you could copy the entire browser profile so it thinks it's the same machine, but that's even harder for your regular user.

"Yes, father. VirtualBox.org... Yes, .org, not .com... Without spaces, yes... Remind me, do you have Windows 32bit or 64bit?"

As far as I could tell from the article, FB pops up this block each time it detects signs of an account being opened on a compromised device.

So this would probably work, but if you go back to your main machine then whatever config was mistaken for malware will trip the alert again.

Run the antivirus in a qubes os disposable vm

The one part that struck me as genuinely evil is refusing to offer a guarantee about the data use.

I realize internet companies all always hate offering info about data use, much less binding agreements. But "let us and a third party touch and modify every single byte on your machine to use our product" is a gigantic ask, and deserves at least some good-faith effort to keep the results walled off from everything except security initiatives.

Beyond that, the intent seems fine. I still think it's hubris, though - Facebook is ostensibly just a website, and attempting to remotely diagnose and treat malware is something they ought to acknowledge they're not going to do well.