deepu-sasidharan

Deepu is a polyglot developer, Java Champion, and OSS aficionado. He mainly works with Java, JS, Rust, and Golang. He co-leads JHipster and created the JDL Studio and KDash. He's a Staff Developer Advocate at Okta. He is also an international speaker and a published author.

Staff Developer Advocate

Deepu K Sasidharan

Learn how to use Mastodon effectively as a developer.

## What Is Mastodon?

Mastodon is an open-source, distributed micro-blogging platform that can host social networking sites. It was created by [Eugen Rochko](https://en.wikipedia.org/wiki/Eugen_Rochko) and was first released in 2016. It is similar to Twitter regarding features, target audience, and user experience. But unlike Twitter, it is run on a decentralized network of servers, each of which is called an **instance**. This does not mean that you have fragmented silos; instances are federated, which means you can talk to other instances, follow people, and see content from other instances, making Mastodon the ideal decentralized social network.

Any single company does not own the Mastodon network, and users can join any instance they wish. The federation allows people to connect and interact with each other across different instances, making Mastodon more open, secure, and free than something like Twitter. This means no single entity has absolute control over Mastodon, which is a big advantage over traditional social networks like Twitter, which is owned by a single company and is not open source.

After the recent [Twitter saga](https://twitterisgoinggreat.com), it's clear why this is a major benefit. However, this does not mean there is no moderation. Quite the contrary, actually. Each instance can have its own rules and can moderate content as they see fit. This means you can join an instance that is more aligned with your values and beliefs or even hosts your own if you have the necessary resources.

## Why Should You Care about Mastodon?

Platforms like Twitter, Facebook, Instagram, and TikTok make most of their revenue from advertisements. This means they are selling our attention to advertisers.

How do you keep someones attention? Our brains are naturally wired to seek dopamine reward pathways and [algorithms](https://www.iomcworld.org/open-access/neurotransmitter-dopamine-da-and-its-role-in-the-development-of-social-media-addiction-59222.html) used by these social media often target dopamine pathways to create a feeling of reward and reinforcement that encourages people to keep using their services. This is done by providing users with a steady stream of new content and positive feedback, such as likes and comments, which stimulates dopamine production in the brain. This can lead to people becoming addicted to social media, as they constantly seek out the reward of dopamine that comes with using the platform.

In addition, many platforms use algorithms to personalize content and increase the chance of a positive outcome, further encouraging people to use the service. But that's not all; these algorithms also use tactics like amplifying content that is reactionary, sensational, or [frightening](https://en.wikipedia.org/wiki/Mean_world_syndrome), which grabs our attention.

Platforms like Mastodon, which [does not operate for profit](https://arstechnica.com/tech-policy/2022/12/twitter-rival-mastodon-rejects-funding-to-preserve-nonprofit-status/), do not have any incentives to follow similar tactics. This does not mean that it is not possible as a Mastodon instance can choose to serve advertisements. But since you have control as a user, you can choose to join an instance that does not serve advertisements. This means that algorithms are not manipulating you to keep you hooked on the platform. This is a big advantage over platforms like Twitter which are designed to keep you hooked on the platform, making it easier to sow division and hatred by nefarious actors.

Mastodon is an important platform for anyone who values their freedom, security, mental health, and privacy online. It is a great alternative to Twitter for those who are looking for a more open and secure platform to connect with others without having to worry about being harassed or bullied. It is quite customizable and provides greater control over your data. With its growing user base, Mastodon is quickly becoming the go-to platform for many people looking for a better way to connect with others and get out of the grasp of BigTech.

## What Is Fediverse, and How Does It Work?

Fediverse is the term used to describe a network of interconnected servers that can communicate with each other using decentralized networking protocols. Fediverse is bigger than Mastodon and can include, among others:

- Mastodon servers (social networking and microblogging)
- [Friendica](https://friendi.ca/) servers (social networking and microblogging)
- [PeerTube](https://joinpeertube.org/) servers (video hosting)
- [Pleroma](https://pleroma.social/) servers (social networking and microblogging)

 Fediverse networks can be used for social networks, file hosting services, and so on.

Fediverse works using several different communication protocols. The most important ones are [ActivityPub](https://activitypub.rocks/), [OStatus](https://www.w3.org/community/ostatus/wiki/Main_Page), and [diaspora](https://diaspora.github.io/diaspora_federation/).

ActivityPub is a protocol that allows servers to communicate with each other. It is a decentralized protocol based on the [ActivityStreams](https://www.w3.org/TR/activitystreams-core/) standard. Mastodon, PeerTube, and Pleroma use ActivityPub.

OStatus is a decentralized protocol based on the [Atom Syndication Format](https://www.rfc-editor.org/rfc/rfc4287). OStatus is a predecessor to ActivityPub and is used by older instances of Mastodon and Pleroma.

Diaspora is a decentralized protocol. Mastodon, Friendica, and Pleroma use it.

Any server that supports one of these protocols can communicate with other servers that support the same protocol.

It is difficult to estimate the number of users in Fediverse due to the distributed nature, but [rough third-party estimates](https://fediverse.observer/stats) put it at around 8 million users. This is a small fraction of the number of users on Twitter, but it is growing rapidly, as well as the number of instances.

## Choosing Servers

One of the biggest strengths of Mastodon, decentralization, is also its biggest hurdle when it comes to adoption. This means that there is no single place to sign up for Mastodon. Instead, you have to choose an instance to join. Choosing a server could be a daunting task, especially if you are new to Mastodon. There are some factors to consider when choosing a server. These include:

- Quality and reliability of the server
- Community and moderation
- Rules and Policies
- Non-profit status

Choosing a server based on this is important, but it's not as critical as it seems. This is because you can follow people from other servers and see their content in your timeline. This means you can join a server that is more aligned with your values and beliefs and still follow people from other servers. This is one of the biggest advantages of Mastodon over Twitter, where you are forced to follow people from the same server. Not just that, Mastodon lets you move from one server to another in case you choose a server that turns out to be unreliable, or you realize that you disagree with the server's policies. You can also easily import your data, like your followers and people you follow, to the new server. So choose a server you feel comfortable with and stick around to see how it goes. You can always move to another server if you don't like it.

As of this writing, there are over 17,000 instances of Mastodon, which is growing daily. This means that there is a Mastodon instance for everyone. You can find a list of Mastodon instances on [instances.social](https://instances.social/).

### Recommended servers

For technical folks like developers, you could consider joining one of these servers:

- [fosstodon.org](https://fosstodon.org/): Ideal for developers, especially if you are an open-source enthusiast
- [mstdn.social](https://mstdn.social/): It's a general-purpose server with a good community and is quite reliable
- [mastodon.social](https://mastodon.social/): The official Mastodon server with a good community and is quite reliable
- [hachyderm.io](https://hachyderm.io/): A server for tech industry professionals
- [techhub.social](https://techhub.social/): A server for technology enthusiasts

## Building a Timeline Based on Hashtags and Follows

Unlike Twitter, when you join a Mastodon server, you will not be greeted by a timeline with interesting posts and recommendations for people to follow. Instead, you are going to be greeted by an empty timeline. This is by design, as Mastodon does not have any algorithm or recommendation system, and you will not be following people from the same server. This means that you have to build your timeline by following people and hashtags. This is a good thing as it gives you more control over your timeline, and you will not be bombarded with content you are not interested in. You can find and follow people from other instances by searching for their usernames. For example, if you want to follow me, you can search for my username `@deepu105` or `@deepu105@mastodon.social`

Similarly, you can also follow hashtags; look for the **+** button on the top right corner of the screen when you are on the hashtag page. This works on the web version and some mobile clients.

![Follow hashtags](https://images.ctfassets.net/23aumh6u8s0i/2j6yJWRTi4l5ietKeozjqR/374a2ad171c40d316bf9f0dfb5d7a92e/follow-hasgtags.png)

It is important to follow people and hashtags you are interested in to have interesting content on your timeline. You can mute people you are not interested in.

![Mute accounts](https://images.ctfassets.net/23aumh6u8s0i/6TfN7bNDr2wW1gUZAj88tN/ca7e15a4aa52899a3c4b183f6fb9925a/mute-accounts.png)

You can also filter hashtags or words you don't want to see on your timeline.

![Filter hashtags](https://images.ctfassets.net/23aumh6u8s0i/2k95DqMi5dliPOdPLdmLxm/cbd8ca9268379c89bd4207b581e3df2f/mute-hashtag.png)

This is a great way to keep your timeline clean and free of unwanted content.

If you are migrating from Twitter, [Movetodon.org](https://www.movetodon.org/) is a great tool to help you find and follow people from Twitter on Mastodon.

## Cross-Posting

If you prefer to keep your Twitter account and cross-post to Mastodon and vice versa, you can use some tools to do so, including writing your own scripts using Twitter and Mastodon APIs. My personal favorite is [moa.party](https://moa.party/). It supports cross-posting to and from Twitter and Mastodon and is simple to setup and use. It can also post from Instagram to Mastodon. It is [open-source](https://gitlab.com/fedstoa/moa), and you can host it yourself if you don't want to give the service access to your Twitter/Mastodon accounts [using OAuth](https://moaparty.com/oauth/).

## Securing the Account

As usual, it is important to keep your Mastodon account secure. This includes using a strong password, using a password manager, and enabling two-factor authentication (2FA). Mastodon supports 2FA using TOTP (Time-based One-time Password Algorithm) authenticator apps like Google Authenticator and FIDO security keys like Yubikey.

![Adding 2FA](https://images.ctfassets.net/23aumh6u8s0i/3u8URYtpAdDxDHXiNb5Tvb/2df7bd5aa4975e281054d3853cab566a/2fa.png)

You can also verify your Mastodon account by linking your official website, GitHub profile, and so on. This is a great way to prove that you are the owner of the account and prevent impersonation.

![Verify your Mastodon account](https://images.ctfassets.net/23aumh6u8s0i/CP3tOMcsMX7V90jGrYXJO/2641210af2340acd254c4d1fdd08e9b0/verify.png)

To do this, go to **Preferences** -> **Appearance** -> **Profile metadata** and copy the verification URL and add it to your website as instructed. For the GitHub profile, add your Mastodon profile URL in the GitHub profile's website field. For example, my Mastodon profile URL is `https://mastodon.social/@deepu105`. Now add your website or GitHub profile URL to your Mastodon profile metadata and save.

![Verified links on Mastodon account](https://images.ctfassets.net/23aumh6u8s0i/45ZMJHHZsTkADIWI4yOlbf/0a50498ca9ca17e43c358bba1ecdd1fa/verify-result.png)

## Moving between Servers

If you decide to move from one Mastodon server to another, here are a few tips to make the process smooth.

1. First, create a profile on the new server you want to use. Note that this will be a new username, as Mastodon usernames include the server name, and you need to choose a username that is available on the new server.
2. Export your data from the old server by going to **Preferences** -> **Import and export** -> **Data export**. You will get CSV files for each item you export, like Follows, mutes, and so on.
3. Create an account alias in your new account by going to **Preferences** -> **Account** -> **Account settings** -> **Moving from a different account**. This will allow you to redirect your old account and move followers from your old account to the new account.
4. Now, from your old account, redirect to the new account by going to **Preferences** -> **Account** -> **Account settings** -> **Moving to a different account**. This will redirect your old account to the new account, and all your followers will be moved to the new account.
5. Now, from your new account, go to **Preferences** -> **Import and export** -> **Import** and import the CSV files that you exported from your old account. This will import all your follows, mutes, lists, and so on to the new account.

## Conclusion

Mastodon is a great alternative to Twitter and is a great way to connect with people from around the world without worrying about a single entity dictating what you can and cannot do with your social media. It is a great way to build a community around your projects and share your thoughts and ideas. It is also a great way to connect with people from the open-source community. I hope this guide will help you get started with Mastodon.

Mastodon for Developers: Everything You Need to Know

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Almost 90 millions Facebook users were affected by a breach that compromised access tokens to the platform.



On September 25th, 2018, Facebook learned from its engineering team that [a security vulnerability compromised around 50 million accounts](https://newsroom.fb.com/news/2018/09/security-update/). While the investigation is still in progress, Facebook already has defined the attack surface and vulnerabilities that led to the attack along with identity data that was compromised.

A feature that allows Facebook users to determine what their profile looks like to other people, known as ["View As"](https://www.facebook.com/help/288066747875915?helpref=faq_content), had a vulnerability that was exploited by attackers. 

![Facebook View As feature.](https://images.ctfassets.net/23aumh6u8s0i/2fEamNAYfwNcwaU1rOpoBy/ee3e16c5e6b6b4c7573882479ea46e6a/facebook-view-as-feature)

Through this vulnerability, attackers were able to steal Facebook access tokens. An [access token](https://auth0.com/docs/tokens/access-token) is a credential that can be used by an application to access an API. Its main purpose is to inform the API that the bearer of this token has been authorized to access the API and perform specific actions. In this case, an attacker could have used the Facebook access tokens to take over accounts.

One of the ways that Facebook uses access tokens is to persist login. As Facebook mentions on their [Security Update](https://newsroom.fb.com/news/2018/09/security-update/), these tokens are the "equivalent of digital keys that keep people logged in to Facebook so they don’t need to re-enter their password every time they use the app." Thus, for this type of data breach, changing the user's password doesn't provide risk mitigation. Instead, the digital keys need to be changed. Once Facebook understood the origin and nature of the attack, the engineering team carried out the following actions to mitigate any damage to the platform and to users:

- Facebook fixed the vulnerability in the "View As" feature.
- Facebook has informed law enforcement about the attack.
- Facebook has reset the access tokens of the almost 50 million accounts that were determined to be at risk in order to diminish any risk to the user data and to ensure their personal and digital security.
- As a precautionary step, Facebook has also reset the access tokens for another 40 million accounts. These accounts used the "View As" feature in the past year.

As a result of these security measures, about 90 million users will have to log back into the Facebook platform. Other applications that use Facebook login are also impacted and will require users to re-authenticate. Facebook wants to remain transparent and direct in the acknowledgment and communication of this security breach. Once affected users log back into their accounts, they will receive a notification at the top of their News Feed with an explanation of what has happened and what actions were taken.

![Facebook security breach user notification](https://images.ctfassets.net/23aumh6u8s0i/6dPmOhI9JO2lMpeVzhexwe/a74063a6782f8882ed81ef1ba0a972a9/facebook-data-breach-notification-access-tokens)

[Source](https://fbnewsroomus.files.wordpress.com/2018/09/42647794_340201783392972_4207828087510925312_n.png?w=960&h=551)

As a final precaution, Facebook has turned off the "View As" feature to run a security review as part of their investigation. As the security investigation is on its early stage, Facebook has yet to determine if any of the compromised accounts had their data accessed or misused. The identity or location of the attackers is also unknown at this time. Facebook vows to keep users updated on the evolution of the investigation. 

On a statement on his personal page, Mark Zuckerberg, Facebook CEO, issued a statement [summarizing the nature of the data breach](https://www.facebook.com/zuck/posts/10105274505136221). Part of his statement includes the assessment that new tools need to be developed to prevent attacks like this from being successful:

> "We face constant attacks from people who want to take over accounts or steal information around the world. While I'm glad we found this, fixed the vulnerability, and secured the accounts that may be at risk, the reality is we need to continue developing new tools to prevent this from happening in the first place. If you've forgotten your password or are having trouble logging in, you can access your account through the Help Center."

To stay tuned on this developing investigation, visit [Facebook Newsroom](https://newsroom.fb.com/) or follow [@facebook](https://twitter.com/facebook) on Twitter.


<include src="asides/AboutAuth0" />


Early Look at Facebook Access Token Security Breach

annybell-villarroel

Anny believes in a people-centric trust-based approach for security culture and awareness &mdash; one where we help people learn about cybersecurity in a fun way, and make them feel empowered, rather than afraid. She also leads the Madrid chapter for WoSEC &mdash; Women of Security.

Security Culture Manager

Annybell Villarroel

Let’s cover the top 10 cybersecurity takeaways of my social engineering training at Black Hat.



I took the ["Achieving Security Awareness Through Social Engineering Attacks"](https://www.blackhat.com/us-18/training/achieving-security-awareness-through-social-engineering-attacks.html) course at [Black Hat this year](https://www.blackhat.com/us-18/)!

<br />
<div style="display: flex; justify-content: center;">
  <blockquote class="twitter-tweet" data-lang="en"><p lang="en" dir="ltr">“Achieving Security Awareness Through Social Engineering Attacks” <a href="https://twitter.com/hashtag/BHUSA?src=hash&amp;ref_src=twsrc%5Etfw">#BHUSA</a> Training taught by <a href="https://twitter.com/jaysonstreet?ref_src=twsrc%5Etfw">@jaysonstreet</a> &amp; <a href="https://twitter.com/aprilwright?ref_src=twsrc%5Etfw">@aprilwright</a> will use current Red Team strategies to develop a better understanding of how attackers use SE <a href="https://t.co/yuojeClInS">https://t.co/yuojeClInS</a></p>&mdash; Black Hat (@BlackHatEvents) <a href="https://twitter.com/BlackHatEvents/status/1002976909268045827?ref_src=twsrc%5Etfw">June 2, 2018</a></blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div>
<br />

It was eye-opening, tremendously interesting, and fun! It was facilitated by [Jayson Street](https://twitter.com/jaysonstreet) and [April Wright](https://twitter.com/aprilwright). Jayson gets paid by companies to break into their own facilities through [Social Engineering](<https://en.wikipedia.org/wiki/Social_engineering_(security)>). He shared many amazing stories, like the time he [gained full access to a bank in Beirut in two and a half minutes](https://www.youtube.com/watch?v=UpX70KxGiVo&feature=youtu.be&t=434).

![Corgi dog meme, coding on computer](https://images.ctfassets.net/23aumh6u8s0i/60r47IT9a84TsaSpyvHB4h/1f15d9303d87cc13b35de378f41ae7fc/corgi-social-engineering-meme)

[Source](https://imgflip.com/meme/38390688/corgi-hacker?sort=latest)

Here’s a summary of what we discussed in the training, along with key takeaways:

## OSINT and Social Media

> “Information doesn’t have to be secret to the valuable” ~ CIA

One of the key elements of Social Engineering is [Open-source Intelligence (OSINT)](https://en.wikipedia.org/wiki/Open-source_intelligence), which is insight produced from data collected from publicly available sources. **If you don’t have proper privacy settings in your social media accounts, the information you put there is public**.

In class, we discussed the case of a guy named Travis who put pictures of his badge, passport, plane tickets, job title, workplace and even emails on Instagram.

We analyzed how someone that overposts on social media could be targeted, and it’s not a surprise that it’s relatively simple. We also talked about tools and techniques to get and find relevant information.

There was an exercise about drafting (not sending) a spear phishing email in 1 hour targeted at someone in our organization using OSINT. Nobody used their own workplace and nobody said where they worked, but we completed the task with good results.

**Takeaway #1:** Review your privacy settings and don’t post private information on social media.

<include src="TweetQuote" quoteText="Review your privacy settings and don’t post private information on social media. Open-source Intelligence tools could be used to mine your data and create phishing opportunities."/>

## WiFi Pineapple and Bash Bunny

As part of the training, they gave us [some interesting gadgets from Hak5](https://www.hak5.org/) including a [WiFi Pineapple](https://www.wifipineapple.com/) and a [Bash Bunny](https://wiki.bashbunny.com/#!index.md). They are tools meant to be used for penetration tests, and they have many pranks that can help with Security Awareness programs by showcasing their associated dangers in safe and controlled setups.

> We also got a [Packet Squirrel](https://www.hak5.org/gear/packet-squirrel) as an extra gift!

### WiFi Pineapple

The WiFi Pineapple is a [Wireless Auditing tool](https://www.tutorialspoint.com/wireless_security/wireless_security_tools.htm) that can work as a [Man-in-the-middle platform](https://en.wikipedia.org/wiki/Man-in-the-middle_attack). Among others, it allows the owner to intercept an open WiFi connection and inspect and modify HTTP traffic, redirect the user to a malicious site, or associate with past public WiFi connections and “pretend” to be one of them.

For example, if you’re near a Pineapple while your phone has WiFi turned on and is actively looking for connections, all of the sudden you may connect to the airport network you used 6 months ago and a site may ask you to pay for the service. They mention it on the [Silicon Valley TV Show](https://www.youtube.com/watch?v=9FckHMPBs_Q).

This is the picture of a WiFi Pineapple Tower because… Black Hat.

![WiFi Pineapple Tower at Black Hat Conference](https://images.ctfassets.net/23aumh6u8s0i/JCZHfzvkgBGa4Hp35EuBW/787cc9176b637d4189bab7e9d312a068/wifi-pineapple-tower)

**Takeaway #2:** Avoid open or public networks as much as possible, especially in crowded spaces. If you’re not in a trusted space, turn on WiFi only when you really need it.

<include src="TweetQuote" quoteText="Avoid open or public networks as much as possible, especially in crowded spaces. If you’re not in a trusted space, turn on WiFi only when you really need it."/>

### Bash Bunny

The Bash Bunny is a USB attack platform that can emulate trusted USB devices like Gigabit Ethernet, serial, flash storage and keyboards.

![Bash Bunny USB platform.](https://images.ctfassets.net/23aumh6u8s0i/2NNQP0gnYiYvYEEFuaHUsc/a78cb5ae090bb73827007b4051f99f01/bash-bunny)

We did a couple of experiments in the class: First, we used a “prank” payload that [rickrolls](https://en.wikipedia.org/wiki/Rickrolling) the target at a specific date and time. It took less than 20 seconds to deliver this payload.

Then we tested a “recon” payload and we could get the full terminal history, clipboard content, system users, [`ifconfig`](https://en.wikipedia.org/wiki/Ifconfig), WAN IP, and all installed applications. This took a little bit longer, but it was still fast and the computer was in sleep mode.

**Takeaway #3:** Don’t plug in random USB drives and be cautious when working on public spaces.

<include src="TweetQuote" quoteText="Don’t plug in random USB drives and be cautious when working on public spaces."/>

## Conclusion and Other Takeaways

We talked about other topics such as policies, security awareness programs, memes and the importance of repetition during training. These are the top 10 Takeaways of the experience:

1.  Review your privacy settings and don’t post private information on social media.

2.  Avoid open or public networks as much as possible, especially in crowded spaces. If you’re not in a trusted space, turn on WiFi only when you really need it.

3.  Don’t plug in random USB drives and be cautious when working on public spaces.

4.  Clickbait is widely used in social engineering, don’t trust it.

5.  Before running phishing campaigns, there should be policies and formal training in place.

6.  Although potentially controversial, hard to spot spear phishing emails create a more impactful “teachable moment” (as Jayson says).

7.  Certain topics of Security Awareness training should be tailored by role. An organization should have a site that groups all this information and internal security-focused newsletters could be useful as well.

8.  Controlled live demos with tools like the WiFi Pineapple and the Bash Bunny help raise security awareness.

9.  Prizes and gamification support these efforts.

10. It is important to always explain the purpose of the training, demo or campaign. We don’t ever want you to fail, we want to empower you and help make you one of our strongest lines of defense:

![Security training at Black Hat Conference](https://images.ctfassets.net/23aumh6u8s0i/386zANR8fvarMMfbzH9Mfg/5e492f230e1d8b29414d4eb3798ba793/teammate-empowerment)

<include src="TweetQuote" quoteText="Security training and awareness campaigns make people the best line of cybersecurity defense"/>

<include src="asides/AboutAuth0" />


Black Hat Training: Achieving Security Awareness Through Social Engineering Attacks

An honest look at the Cambridge Analytica data breach numbers. What's next for social login authentication? Time to switch social providers?



In 2015 Facebook learned that Dr. Aleksandr Kogan, a psychology professor at the University of Cambridge, illegally passed Facebook data that he collected with his app, “thisisyourdigitallife,” to the political and military strategy firm SCL/Cambridge Analytica.

Kogan billed “thisisyourdigitallife” as a research app used by psychologists and achieved [270,000 downloads](https://newsroom.fb.com/news/2018/03/suspending-cambridge-analytica/). Each user consented for Kogan to access their personal information, including location, Facebook content they had liked, and friends and connections. 

Cambridge Analytica also obtained data without users' consent from an [additional ~87 million](https://www.wired.com/story/facebook-exposed-87-million-users-to-cambridge-analytica/) accounts and sold their findings to political campaigns, including those of [Ted Cruz](https://www.theguardian.com/us-news/2015/dec/11/senator-ted-cruz-president-campaign-facebook-user-data), Ben Carson, and [Donald Trump](https://www.nytimes.com/2018/03/17/us/politics/cambridge-analytica-trump-campaign.html).

![Cambridge Analytica data breach internal email discussion](https://images.ctfassets.net/23aumh6u8s0i/1a5Zw2zcAYDYMVCjt3ZTSy/4f08f19dfef754ebe3269046a1770238/Cambridge-Analytica-internal-email)

[Source](https://www.nytimes.com/2018/03/17/us/politics/cambridge-analytica-trump-campaign.html)

This data leak is one of the largest and most upsetting for users to date, given the strong evidence of how Cambridge Analytica used their information to influence divisive elections.

For the millions of companies that use [Facebook Login](https://auth0.com/learn/social-login/) to authenticate their users, this investigation poses new business and ethical challenges. This article will help teams grapple with how the scandal could affect their operations and offer solutions for moving forward.

## Should You Stop Using Facebook Login with Your Apps?

Shortly following news of the breach, [Facebook launched an apology ad campaign](https://www.fastcompany.com/40563382/facebook-says-sorry-sort-of-in-its-biggest-ever-ad-campaign) aimed at helping users steer clear of dishonest accounts on its platform that could be attempting to steal their information.

![Facebook post-data-breach apology ad campaign](https://images.ctfassets.net/23aumh6u8s0i/6XPV549H4eXuYj4K8w7mUK/72619ae21946bb22a584b0426037442f/apology-ad-campaign)

 [Source](https://www.wired.com/story/facebook-launches-a-new-ad-campaign-with-an-old-message/)

While the campaign provided some good insights, it also highlighted staggering issues within Facebook — particularly how the company has scaled without paying close enough attention to certain user behaviors. 

From fake accounts to clickbait, spam, and more, it appears like [Facebook could be a messy platform to continue to authenticate](https://auth0.com/learn/social-login/) with — at least in the near-term. 

Moreover, it could be a challenge to explain to your users why you are continuing to collect their Facebook data.

### Solution 1: Use Other Forms of Social Login

You have a series of other options for authenticating your users.

![Auth0 Social Connections dashboard](https://images.ctfassets.net/23aumh6u8s0i/4YehQWoR0H6GnHZjbj5H5D/e834bc799a7c04035ff4dc3e54ac6ce7/auth0-social-connectors)

[Auth0 supports 30+ social providers, including Twitter, Google, Yahoo, and LinkedIn](https://auth0.com/learn/social-login/). You can also just add any OAuth2 Authorization Server you need. Despite differences among each provider, Auth0 simplifies the process by unifying the way to call providers and the information you retrieve from them.

It's simple to switch providers in the Auth0 dashboard. If you haven't already, you can <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account here</a>. Then, simply click [Connections, then Social](https://auth0.com/learn/social-login/). To enable a new provider, just flip the switch next to their icon. You can then select the desired attributes and permissions you want to get from the provider in the configuration popup.

### Solution 2: Incorporate Simpler and More Visible Means of Obtaining User Information

[Progressive profiling](https://auth0.com/blog/progressive-profiling/) is another technique for gradually building up a profile of your customers. Each time they interact with your product, you display a short questionnaire. It can begin with something as simple as requesting a first and last name:

![Auth0 registration signup with expanded first and last name fields](https://images.ctfassets.net/23aumh6u8s0i/6c1CdEctffMU2WUx3oFDsQ/7cd3336e0c18ae25a94fa341b032c62f/auth0-registration-form)

From there,  you can continue to get more specific — but in small increments:

![Auth0 progressive profiling form](https://images.ctfassets.net/23aumh6u8s0i/3FMpAM4y5mzmPPhgtu1hgf/da847942e43f5d4586f8b351f7484330/auth0-progressive-profiling-form)

Progressive profiling allows you to keep these forms short and to the point and collect data in a clear and transparent way. You will slowly build up a robust customer profile that affords you the same power as a Facebook profile does to send better, more targeted offerings to your customers.

### Employ Good Privacy Policy UX

Whichever authentication method you go with, make sure you clearly explain your process to your users. While this is critical for [complying with GDPR and related measures](https://auth0.com/docs/compliance/gdpr), it is also an opportunity to highlight the benefits of why you are doing so. Are you helping deliver to customers the content they actually want to receive? Avoiding showing them products or hyping services that are irrelevant? There is a lot of information you can incorporate alongside legal jargon that shines a light on how thoughtful your team is with its operations.

Starting gradually will help assure your users of your expertise at the outset without overwhelming them with technical information.
 
![Microsoft form explaining usage of birthdate](https://images.ctfassets.net/23aumh6u8s0i/5IHR68eJ55yVT7yvrtKEE1/855e00d6187589bdd8ae7297e0865da5/microsoft-form-explaining-usage-of-birthdate)

[Source](https://www.econsultancy.com/blog/69256-gdpr-how-to-create-best-practice-privacy-notices-with-examples)

Adding an automatic text window, like Microsoft does, that appears when requesting data points enhances the user experience in a clear and simple way. From there, you can prompt viewers to click through to a larger policy statement. If they continue to be curious, place links for them to dig even deeper:

![Microsoft privacy policy sample](https://images.ctfassets.net/23aumh6u8s0i/7cfutBnxv1JwnS9IFPvCE4/26deebc81cef26a3c02ce50e1f611060/microsoft-privacy-statement)

[Source](https://www.econsultancy.com/blog/69256-gdpr-how-to-create-best-practice-privacy-notices-with-examples)

If you're daunted by crafting all of this text yourself — ensuring it is both accurate and digestible —  there are many privacy policy templates online. If you're an e-commerce company, for example, [Shopify](https://www.shopify.com/tools/policy-generator) offers a series of tips and tricks. 

Remember: investing in current customers can actually produce better results than attracting new ones. Taking the time to open up to those currently engaged will spur them to create more value for you in the long run.

## Just Because You Rely on Facebook Login, Doesn't Mean There Isn't a Way Forward

Although Facebook has frustrated many companies with its lack of oversight in the wake of the Cambridge Analytica data breach, it still has enormous resources at its fingertips to (hopefully) help it improve. While we wait for the tech titan to rebuild user trust (and perhaps become a beloved tool for business partners once more), the above solutions will help you continue to research, protect, and delight your users. 

<include src="asides/AboutAuth0" />


"social-media"