Digital Knowledge 101 ( DigiKnow?! )

Robert McMillan Robert Mcmillan – Wed Aug 11, 7:30 pm ET


Facebook is scrambling to fix a bug in its website that could be misused by spammers to harvest user names and photographs.


It turns out that if someone enters the e-mail address of a Facebook user along with the wrong password, Facebook returns a special "Please re-enter your password" page, which includes the Facebook photo and full name of the person associated with the address.


The feature helps people understand if they've mistyped their e-mail address at login, but it could be misused by spammers to get information on Facebook's 500 million users.


spammer with an e-mail list could write a script that enters the e-mail addresses into Facebook and then logs the real names. This could help make a phishing attack more realistic, said Atul Agarwal, the researcher who posted a note about the issue (along with a sample script that could harvest names) to the Full Disclosure mailing list on Tuesday.


Someone could also use the feature to generate random e-mail addresses and check to see if they really worked, Agarwal said.


The login page shows images of people, even when they've properly set their privacy settings to keep this information private, said Agarwal. "Harvesting this data is very easy," he said.


Facebook blamed the issue on a recently introduced bug.


"We have technical systems in place to prevent people's names and photos from showing to unrelated users upon login, but a recently introduced bug temporarily prevented these from working as intended," a company spokeswoman said in an e-mail message. "We are already working on a fix and expect to remedy the situation shortly."


Scraping Facebook for this type of information is prohibited, she added.


Scammers have taken a special interest in Facebook over the past few years, and criminals such as the people who wrote the Koobface worm may well take an interest in the bug, said Roger Thompson, chief research officer with antivirus vendor AVG.


"I would expect that the Koobface gang will be racing to try to take advantage of this before Facebook patches it," he said via instant message. "It'll be interesting to see who wins."


Robert McMillan covers computer security and general technology breaking news for The IDG News Service. Follow Robert on Twitter at @bobmcmillan. Robert's e-mail address is robert_mcmillan@idg.com

(CNN) -- Early each morning, millions of farmers around the world rise to toil in their fields. By night, gangs of mobsters scheme and legions of poker players shuffle up and deal.

Sure, none of it's real. But the overwhelming popularity of so-called social gaming -- simple games that let people play with their friends on networking sites such as Facebook -- is changing the face of video games, experts say.

And as the maker of popular titles like FarmVille and Mafia Wars, San Francisco, California-based Zynga has ridden the games' skyrocketing popularity to the top of that emerging market.

For Zynga founder Mark Pincus, the formula for gaming success on Facebook, MySpace and other sites was as simple as it might seem counterintuitive: create simple games that people like but can easily set aside.

"We built the games so they could be played in a tab on your browser while you're on a conference call," said Pincus, a veteran Web entrepreneur who created Zynga in 2007.

Of course, they've been helped by the massive growth of Facebook, where the games are so popular they've spawned "fan" pages devoted to complaining about having to watch friends play them.

Facebook, with its 400 million users, is where the vast majority of people play FarmVille and Mafia Wars along with other Zynga titles like FishVille, Vampires, Café World, YoVille and Zynga Poker.

In all, more than 65 million people play Zynga games every day, according to media tracking company Developer Analytics.

Zynga's top title, FarmVille, is played by an estimated 75 million people each month -- roughly equal to the number who have played the classic arcade and desktop game Tetris during its entire existence.

The massive growth was satisfying but not altogether surprising to Pincus, whose previous startups had included Freeloader, a Web-based information-gathering service; tech-support company SupportSoft; and Tribe.net, an early social networking site from 2003.

He said that starting the game company, which he named after his late English bulldog, was an effort to fill what he considered a surprising void in most people's daily Internet use.

"I thought in 2007 that something had gone oddly wrong with the whole Internet experience," Pincus said. "I would have thought games would have been one of the top two or three experiences people had on the Internet."

What Pincus got right, according to gaming expert Scott Steinberg, was a sort of return to the "golden era" of games like Pac-man and Super Mario Bros.

"Video games actually appealed to a huge cross-section. They appealed to everybody," said Steinberg, publisher of DigitalTrends.com. "What happened is, as we went through the mid-'80s to the mid-2000s, you started to see gaming become more incestuous in terms of 18- to 34-year-old males making games for people just like them."

By contrast, three of Zynga's top five games -- FarmVille, Café World and FishVille -- have mostly female players, with many players outside the traditional 18- to 34-year-old range.

Those games all operate on the same basic premise. Starting with a simple farm, fish tank or restaurant, the player works to make it bigger and fancier, sharing items with friends and helping each other along the way.

Some of Zynga's early titles simply mirrored existing board and card games. It was Mafia Wars -- in which players team up to whack other gangs -- that first exhibited what would become the hallmarks of social gaming: simple, single-player action that's enhanced by teamwork.

With FarmVille, that formula would become complete.

Players plant virtual crops that can be harvested hours, or days, later. Along the way, they invite online friends to become their neighbors and help each other by sending gifts or helping with the farming. There's no way to "win," but players take satisfaction in building big, fancy farms that they can showcase to their friends.

"A farm is something that is internationally understood and known. It's cross-cultural, cross-gender, cross-age," Pincus said. "A great social game should be like a great cocktail party. If you want it to appeal to absolutely everyone you invite, it has to be broad in its content so that everyone gets it."

Not that Zynga's success has come without criticism.

With hundreds of smaller companies vying for a piece of the social gaming market, some rivals have accused Zynga of using its hefty venture capital to crowd out less-financed competitors.

Many of its most popular games, including FarmVille, are similar to pre-existing games from smaller companies, a fact Pincus dismisses by noting that video games have always fallen into genres with similar titles from competing companies.

Psycho Monkey LLC, the makers of Mob Wars, filed a lawsuit claiming that Mafia Wars ripped them off. Zynga settled that case in August, said a spokeswoman for the company.

Zynga also was hit with complaints and lawsuits over its original business model, which let players earn in-game rewards for things like signing up for a credit card or video-rental membership.

Critics said some of the offers amounted to scams, leading players to download unwanted software or unwittingly sign up for memberships that appeared stealthily on their phone bills.

Pincus has acknowledged not being vigilant enough with the automated ads that appeared on Zynga games during the company's early days.

"We were playing whack-a-mole," Pincus said. "Every time we found one of these or got a complaint, we would take them down. Eventually ... we realized we had to take a much more aggressive stance than a normal Web site."

In November, Zynga removed all "lead-generating" ads, relying for revenue instead on the roughly 1 to 3 percent of the player base that pays for in-game items, such as a barn in FarmVille. It has since been putting the advertisements back in, with a new system that lets it more closely monitor what kind of ads show up, Pincus said.

"We'll see where this goes for the entire industry," Pincus said. "It was really important to us to maintain a trusted position with our users. We wanted to do the right thing, and I think we did."

Pincus offers a ray of hope for another vocal group of critics: the social-media users who say they're tired of seeing all of their friends' updates about Zynga and other social games.

On Facebook, a group called "I dont care about your farm, or your fish, or your park, or your mafia!!!" had more than 5.2 million members recently.

"Please. No more of this stuff," wrote one member. "I've had all I can take. About to hang up FACEBOOK. Just want a nice cozy place to talk with my friends!"

Pincus said he hopes that messages from games can eventually be targeted to a more select audience.

"We have to evolve," Pincus said "I think it's heading to a place that's more narrow-casting. I think you'll get to a place where Facebook will be better about showing feeds to people who have a registered interest in them."

For example, he said, there might eventually be a way to send game notifications only to people who play social games themselves.

"It's not just games. It's going to be true for music, for pictures, for status updates," Pincus said. "I think, over time, these networks are going to start to shape more to ... your [registered interests]."

Meanwhile, Zynga will be among the developers continuing to change how people look at video gaming. It's a change that Steinberg, the gaming guru, says will be for the better.

While heavyweights like Electronic Arts and the popular Civilization series are making inroads into social gaming, Steinberg said, the genre is also opening up opportunities for smaller developers.

"We're seeing, in many ways, a second renaissance for games," Steinberg said.

"There's been an epiphany among the developer community saying, 'Look at these millions of users that we've forgotten to speak to for years.' This can only be a good thing for the gaming industry in the end."

NEW YORK – Over the past week, Facebook has been nudging its users — first gently, then firmly — to review and update their privacy settings.

You may have procrastinated by hitting "skip for now," but Facebook eventually took away that button and forced you to update your settings before continuing to use the site.

After finally accepting Facebook's recommendations or tweaking the privacy settings yourself, though, you might have made more information about you public than what you had intended.

At the same time, Facebook has given users many granular controls over their privacy, more than what's available on other major social networks.

So if you want to stay out of people's view, but still want to be on Facebook, here are some things to look out for as you take another look at your settings.

1. Some of your information is viewable by everyone.

Everyone can see your name, your profile photo and the names of work and school networks you're part of. Ditto for pages you are a fan of. If you are worried about a potential employer finding out about a quirky fetish or unorthodox political leaning, avoid becoming a Facebook fan of such groups. You can't tell Facebook you don't want those publicly listed. Your gender and current city are also available, if you choose to specify them. You can uncheck "Show my sex in my profile" when you edit your profile if you don't want it listed, and you can leave "Current City" blank.

2. Your list of friends may also be public.

Facebook also considers your friends list publicly available information. Privacy advocates worry that much can be gleaned from a person's list of friends — even sexual orientation, according to one MIT study. But there is a way to hide the list. Go to your profile page and click on the little blue pencil icon on the top right of your box of friends. Uncheck "Show Friend List to everyone." Either way, those you are already friends with can always see your full list.

3. You can hide yourself from Web searches.

There is a section for "Search" under Facebook's privacy settings page, which is accessible from the top right corner of the Web site under "Settings." If you click the "Allow" box next to "Public Search Results," the information that Facebook deems publicly available (such as photo, fan pages and list of friends), along with anything else you have made available to everyone, will show up when someone looks up your name on a search engine such as Google. The stuff you've limited access to in your profile will not show up.

This is useful if you want people you've lost touch with, or potential work contacts, to be able to find your Facebook page. If you'd rather not be found, uncheck this box.

A second setting, controlling searches within Facebook, lets you refine who can find you once that person has logged on. Limit searches to friends only if you think you have all the friends you need and don't want anyone to find you when they type in your name to Facebook.

4. Beware of third-party applications.

Quizzes and games are fun, but each time you take one, you first authorize it to access your profile information, even if you have made that available only to your friends. You're also letting the app access some information on your friends.

Under "Application Settings," Facebook lists all the apps you have opened your profile up to. If you no longer want to authorize access to "Which Golden Girl Are You?" you can always remove it by clicking on the "X" next to its name. Apps you use regularly, such as Facebook for Android if you update your status from your mobile phone, should stay.

Next, by clicking on "Applications and Websites" on the privacy settings page, you can edit whether your friends can share your birthday, photos and other specific information. Remember that applications can access your "publicly available information" no matter what.

The security firm Sophos recommends users set their privacy settings for two of Facebook's own popular applications, notes and photos, to friends only.

5. Go over your list of friends.

The average Facebook user has 130 friends. But many people interact with a much smaller group when commenting on status updates, photos and links. So it doesn't hurt to occasionally review your list of your friends to get an idea of just who can view your status posts, vacation photos and funny links you've shared over the years. Don't feel obligated to add anyone as a friend, even if that person adds you first. For professional acquaintance you don't want to snub, send them to a LinkedIn profile you can set up. Some workplaces and schools have rules about Facebook interactions between bosses and employees or students and teachers.

6. Create custom friends groups.

If you have friended a lot of people, sort them. Think of the groups you interact with in real life — co-workers, college buddies, girlfriends, grandma and grandpa — and organize your Facebook friends in these groups, too. Go to "All Friends" under the "Friends" button up top, click on "Create New List" and fire away. Then decide what aspects of your profile, and which status posts and photos, these people will have access to. Or, simply create a "limited" list for acquaintances or distant relatives and limit their access.

7. Customize your status posts.

Type "I'm hungry" into your status update box. Click on the little lock icon. You'll see a range of privacy controls pop up, letting you either allow or limit access to the post. If you want, you can even hide it from everyone by clicking "Only Me" under the custom settings. Click on "Save Setting." Repeat with each post, or create a default setting for most updates and increase or decrease privacy as you see fit.

8. Let your friends know you have boundaries — in person.

Many of us have woken up on a Sunday morning to find that an overzealous friend has posted dozens of photos from that wild party we barely remembered — the good, the bad and the hideous. Chances are, they didn't do this to embarrass you, though if they did you have bigger problems. Rather, they probably don't know that you don't want these photos posted. Sure, tweak your photo privacy settings on Facebook. But if someone starts snapping pictures of you at a party, ask them to check with you before posting it anywhere.

9. Never assume complete privacy.

Even for the most tech-savvy person, unflattering photos, incriminating text messages or angry status posts about work have a way of worming their way out in the open. Just saying.

By BARBARA ORTUTAY, AP Technology Writer Barbara Ortutay, Ap Technology Writer – Thu Dec 17, 3:54 pm ET