Phishing for Convenience on Facebook

We often talk about the trade-offs between security and convenience, especially as it pertains to Web 2.0.  Much of the technologies utilized by Web 2.0 sites were built for collaboration and a rich user experience, which has really fueled the explosion of social networking sites like MySpace, Facebook, and others.  Today I bit the bullet and created a Facebook account, only to observe a prime example of security taking a backseat to convenience.  Here I’m not criticizing the security of Facebook’s servers or applications so much as the expectation the site is establishing with its user base.  The pages in the screenshots below are served over a secure HTTPS connection, but the information Facebook is asking for is what you’d expect to find in a typical phishing attack.

The page in question is https://register.facebook.com/findfriends.php.  When navigating to this page without logging in, it appears as follows:

This page is tame compared with the version you get once you’ve logged in:

To recap, for your convenience, Facebook is allowing you to enter in the following information:

”¢Â Email username and password
”¢Â AOL Instant Messenger username and password

The site also asks you to click “Yes” when prompted to display “nonsecure items” so that you can the download and execute an application named “facebook.exe” (from an insecure site), so that the program can then harvest your Outlook contacts and upload them to their server.

I’m not suggesting that Facebook has anything other than good intentions here, but training users to handover confidential information for a little convenience is not a good thing.

P.S.  The CAPTCHA is real.