73% of Indian pre-teens use Facebook inspite 13 years of minimum age: ASSOCHAM

The study, conducted by the Associated Chambers of Commerce and Industry of India (ASSOCHAM). The survey was conducted on 4,200 parents of children aged between 8 years and 13 years in major metropolitan cities like Delhi-NCR, Mumbai, Bangalore, Chennai, Kolkata, Ahmedabad, Hyderabad, Pune, Lucknow and Dehradun, among others, 75% of parents whose children are in the age group of 8-13 years were aware of their child signing up for the website. "Minors lack the experience or judgement to use a social network and this raises the scary possibility of predators tracking down kids who reveal their age in an online chat, to cyber bullying and sexual abuse," Chairman of Assocham Health Committee B K Rao said, Reports, PTI Nearly 25 percent of 13-year-olds, 22% percentof 11-year-olds and 15 percent of 10-year-old are on Facebook, while 5-10 percent of 8 and 9 year-olds are also active on the site. The survey also revealed children with working parents are addicted to technology.                                              Facebook has emerged as the most preferred social networking site among this age group. Other sites like flick.com, Google Plus, Pinterest are being used by 85 percent of children in the age group of 10-16 years. The Indian government has issued strict directives against underage users accessing Facebook in order to deal with problems such as cyber bullying and online sexual abuse among other things. But this trend is dangerous as it can make children vulnerable to cyber bullying and online sexual abuse.

bit.ly urges users to change account details after hackers break in

Link-shortening service bit.ly has issued a warning to its users that account information may have been compromised. The firm says there is no indication that any accounts have been accessed, but that it has taken proactive steps to ensure that accounts have been secured.

In order to help protect users, Facebook and Twitter accounts that were linked to bit.ly accounts have been disconnected. bit.ly has advised users to change their API key and OAuth tokens, reset their passwords and reconnect any Facebook and Twitter accounts that may have been disconnected.

Security guidance

The following guidance has been issued to users to ensure the security of accounts:

• Log in to your account and click on 'Your Settings,' then the 'Advanced' tab.
• At the bottom of the 'Advanced' tab, select 'Reset' next to 'Legacy API key.'
• Copy down your new API key and change it in all applications. These can include social publishers, share buttons and mobile apps.
• Go to the 'Profile' tab and reset your password.
• Disconnect and reconnect any applications that use Bitly. You can check which accounts are connected under the 'Connected Accounts' tab in 'Your Settings.'

No specific details of how the suspected attack was carried out have been provided, but bit.ly's CEO Mark Josephson said in a blog post, "We have already taken proactive measures to secure all paths that led to the compromise and ensure the security of all account credentials going forward."

As part of his blog post, Josephson apologized to bit.ly users and advised that further updates would be announced on the company's Twitter account.

Facebook, Google users threatened by new security flaw

A serious flaw in two widely used security standards could give anyone access to your account information at Google, Microsoft, Facebook, Twitter and many other online services. The flaw, dubbed "Covert Redirect" by its discoverer, exists in two open-source session-authorization protocols, OAuth 2.0 and OpenID.

Both standards are employed across the Internet to let users log into websites using their credentials from other sites, such as by logging into a Web forum using a Facebook or Twitter username and password instead of creating a new account just for that forum.

Attackers could exploit the flaw to disguise and launch phishing attempts from legitimate websites, said the flaw's finder, Ph.D. student Wang Jing of the Nanyang Technological University in Singapore.

Wang believes it's unlikely that this flaw will be patched any time soon. He says neither the authentication companies (those with which users have an account, such as Google, Microsoft, Facebook, Twitter or LinkedIn, among others) nor the client companies (sites or apps whose users log in via an account from an authentication company) are taking responsibility for fixing the issue.

"The vulnerability is usually due to the existing weakness in the third-party websites," Wang writes on his own blog. "However, they have little incentive to fix the problem."

The biggest danger of Covert Redirect is that it could be used to conduct phishing attacks, in which cybercriminals seize login credentials, by using email messages containing links to malicious websites disguised as something their targets might want to visit.

Normal phishing attempts can be easy to spot, because the malicious page's URL will usually be off by a couple of letters from that of the real site. The difference with Covert Redirect is that an attacker could use the real website instead by corrupting the site with a malicious login popup dialogue box.

For example, say you regularly visit a given forum (the client company), to which you log in using your credentials from Facebook (the authentication company). Facebook uses OAuth 2.0 to authenticate logins, so an attacker could put a corrupted Facebook login popup box on this forum.

If you sign in using that popup box, your Facebook data will be released to the attacker, not to the forum. This means the attacker could possibly gain access to your Facebook account, which he or she could use to spread more socially engineered attacks to your Facebook friends.

Covert Redirect could also be used in redirection attacks, which is when a link takes you to a different page than the one expected.

Wang told CNET authentication companies should create whitelists — pre-approved lists that block any not on it — of the client companies that are allowed to use OAuth and OpenID to redirect to them. But he said he had contacted a number of these authentication companies, who all shifted blame elsewhere.

Wang told CNET Facebook had told him it "understood the risks associated with OAuth 2.0" but that fixing the flaw would be "something that can't be accomplished in the short term." Google and LinkedIn allegedly told Wang they were looking into the issue, while Microsoft said the issue did not exist on its own sites.

Covert Redirect appears to exist in the implementations of the OpenID and OAuth standards used on client websites and apps. But because these two standards are open-source and were developed by a group of volunteers, there's no company or dedicated team that could devote itself to fixing the issue.

Where does that leave things? 

"Given the trust users put in Facebook and other major OAuth providers, I think it will be easy for attackers to trick people into giving some access to their personal information stored on those service," Chris Wysopal, chief technology officer of Boston-area security firm Veracode and a member of the legendary 1990s hackerspace the L0pht, told CNET.

"It's not easy to fix, and any effective remedies would negatively impact the user experience," Jeremiah Grossman, founder of Santa Clara, Calif.-based WhiteHat Security, told CNET. "Just another example that Web security is fundamentally broken and the powers that be have little incentive to address the inherent flaws."

Users should be extra-wary of login popups on Web pages. If you wish to log into a given website, it might be better to use an account specific to that website instead of logging in with Facebook, Twitter, or another authentication company, which would require the use of OAuth and/or OpenID to do.

If you think someone has gained access to one of your online accounts, notify the service and change that account's password immediately.

Mark Zuckerberg announces Anonymous login, more granular controls and audience network

Mark Zuckerberg, like Facebook, is maturing. The soon-to-be 30-year-old chief executive of the decade-old social networking company grew reflective as he stood before hundreds of app developers to announce a host of mobile features designed to put “people first.”

“We used to have this famous mantra, ‘move fast and break things,’” Zuckerberg said at Facebook’s f8 developer conference in San Francisco.

But moving quickly was sometimes so important that Facebook’s engineers would tolerate a few bugs, or push out products that were not always fully baked. Fixing the bugs, Zuckerberg said, “was slowing us down.” Backpedaling on features that didn’t work — or that users didn’t like — slowed things, too, though Zuckerberg did not mention that.

Facebook’s new mantra may not be as sexy. Zuckerberg pointed to a new sign that read “Move fast with stable infra,” as in infrastructure, and the audience laughed. Stability, it turns out, is the new maxim, and the era of breaking things is over.

In a rare bit of onstage rumination reflecting on the past decade, Zuckerberg said he and other Facebook employees realized they had created a culture of quick-witted, fast-moving engineers who took pride in being “hackers” who consistently put the company’s best interests ahead of what users wanted.

Now, Zuckerberg says, the goal is “to build a culture of loving the people we serve that is as strong if not stronger than our culture of hacking at Facebook. I hope you can see the seeds of some of this today in what we are talking about.”

The last time Facebook held a conference for app developers was in 2011. That was before the company attracted 1.28 billion users, before it went public, before it began showing mobile advertisements and before it paid eye-popping amounts of money to acquire popular apps like Instagram and WhatsApp.

In the tech world, three years can be a lifetime. Facebook’s focus is now squarely on the mobile space, not just its own applications but those built by outside developers.

“As you get older you do gain perspective, and Facebook has,” said David Kirkpatrick, author of “The Facebook Effect,” a chronicle of the company’s early years.

“It’s astonishing that a 10-year-old company should be in a position to have as much influence in so many things in society as they do,” he said. “And I think they are starting to take a much more serious approach to the opportunity and responsibility that goes along with their scale.”

As part of its mobile, people-first focus, Facebook says it will let users log in to apps anonymously, without sharing their identities and personal information with mobile applications they don’t trust.

Facebook’s users can already use a “log in with Facebook” button to sign up for apps that let them listen to music, play games, read the news and monitor fitness activities. But using the button allows apps to access information related to the Facebook user’s identity.

With the anonymous login, Facebook will have information about users but the apps won’t. Zuckerberg said the feature will let more people to try out new apps that they may not trust yet with their personal information. App developers have the option of including the anonymous login as a feature, but they won’t have to.

The company is also launching more granular controls that let people determine the types of information they share with apps when they want to use their Facebook identity to log in. Previously, apps could decide what information they wanted to access on people’s Facebook pages — such as people’s birthday, friends list or email address. Now, people can uncheck each, or all of these things.

Analysts suspect Facebook’s evolution isn’t as much an epiphany about privacy as it is about Zuckerberg’ realization that the company has to take steps to ensure it holds on to its users and grapples with more competition.

“If Facebook has some sense that they are going to walk away because they don’t feel like they are being put first, then they have a real problem on their hands. So, they are giving users some new features that they have been looking for a long time,” said Gartner analyst Brian Blau.

Facebook also took the wraps off its long-awaited mobile advertising network, called “Audience Network,” a product that enables Facebook to sell ads in mobile applications besides its own. For example, Coca Cola can show ads on a mobile game that a Facebook user has downloaded on his or her phone.

The service will increase its competition with Google, which dominates the mobile advertising market and has its own ad network. Twitter is expected to announce its own, too.

“Everything is going mobile right now, so in order to compete with companies like Google, it needs to have a strong mobile app, which it already does, and a strong way of delivering mobile advertising — not just within Facebook but across a network of mobile apps,” said Debra Aho Williamson, an analyst with research firm eMarketer.

Williamson believes Facebook’s ad network will help improve the health of the overall advertising business. Many mobile apps will likely be eager to work with Facebook because its social network already has relationships with more than 1 million advertisers and has accumulated valuable insights into people’s interests.

“It’s going to make it so that advertisers don’t have to reinvent the wheel every time that they advertise,” she said. “They will be able to go to just one source, one network and distribute it widely.”

Facebook’s share of the $9.7 billion U.S. mobile advertising market was 16 percent last year, according to eMarketer, compared with 41 percent for Google. This year, Google’s share is expected to slide to under 38 percent, while Facebook’s should increase to nearly 18 percent, according to the research firm.