Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 4 down vote favorite

While I was not surprised at all by Facebook stating that "8.7 percent of accounts belonging to its 955 million monthly active users are fake"; link is a news story that providers a summary of their statements and a link to the source of those statements, Facebook's full 10-Q report.

Here's the thing though, to me it seems like identifying fake accounts would be easy, what would be hard would assigning a value of authenticity to a given account.

Has Facebook publicly stated how they are identifying accounts as "fake" or real? If not, how would this be done?

share|improve this question
I'd imagine it's based on statistical analysis of activity associated with accounts (account played farmville is less likely to be a like bot...), however unless facebook actually publishes their methodology I would just say the figures quotes are just as likely to be pure fiction. Even if not, there is likely some flaws in the methodology somewhere. – ewanm89 Aug 4 '12 at 15:47
1  
The full report has a lot of "we estimate" "may have" and similar phrases in the one paragraph related to false accounts. – ewanm89 Aug 4 '12 at 15:51
@ewanm89: Agree, sounds fishy to me too. That said, there must be some way to do this and understand the accuracy of a authenticity rating given to an account; meaning seems like this would be related to topics such as the detection of fraud, intrusion, etc. – blunders Aug 4 '12 at 16:08

1 Answer

up vote 3 down vote accepted

Facebook relied on user generated "abuse reports" as leads for identity investigation. Meaning, you can report a suspicious account and it will be review by FB team (I`m guessing we are talking about log checks, "believable" friend pool and etc)

They got no automatic policy for account identification besides the following:

Feature overuse: Simply Checking the rate of usage for features (i.e. Too many messages/reoccurring content)

Unwanted contact: High "deny friendship" rates/repeat "friendship request" are deemed suspicious.

I actually think they got the right idea here, as behavior-based challenges are probably the best way to find fake FB users.

There are maybe few other things you can do (having a a "suspicious contact pool" signature for example and some Bot challenges like JS/Header and others) but, for me, the main issue here is their Enforcing Policy. Currently, you have to work pretty hard to get banned from FB, and in the end - with all of their cash flow problems - a large user base is still Facebook's main claim-2-fame and I don`t see them messing with it any time soon.

As for the numbers, I`m assuming they've just based on an avg. or previous fake/real user statistics.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.