Sophos News

This is what happens if you let anyone use your Facebook password

Last week, a fascinating, fractured, hilarious, annoying, imprudent, and beautifully schizophrenic creature was birthed on Facebook.

The creature’s name started out as PublikFacebook, a communal account set up by the writer and web explorer/experimenter Joe Veix.

Its birth was announced on Twitter, along with its username and password.

introducing PublikFacebook: connecting the world, in a single open facebook account

The password was hardly a password at all, given its easy guess-ability – “password1234” – but that only makes sense, given that Veix didn’t want to keep anybody out.

Quite the contrary: the point was to invite the entire world into an open account to see what happens when they frolic.

Veix set out with this question:

If a social media profile is supposed to reflect our individuality, what would an account that everyone uses even look like?

And what he got was an account that seems quintessentially Facebook – a reflection of the collective personality of the social media network, with all its silliness, sweetness, marketing puffery, and lack of user prudence.

The first thing that happened was predictable: someone in Berkeley, California, changed the password, thereby locking the account. (That happened quite a few times over the course of the account’s lifetime.)

Veix quickly reset the password, after which “things started snowballing,” he explained in a story about the experiment on the website Death and Taxes.

First, the name on the account changed from John Smith to Maximilien Manning. Then the profile and cover photos started changing and continued changing over the weekend.

By Monday, four days after the experiment began, there had been 135 logins from 100 unique users, all from what Veix described as “exotic locations” including Paris, Sweden, Colombia, the United Arab Emirates and New Jersey.

Veix created a dizzying GIF that approximates all the updates, flipping through imagery that included, among many other things, the logo for Taco Bell fast-food restaurants.

Well, that made sense. Somebody on Sunday had changed the profile’s job to Taco Bell customer service representative and then pretended to be a Taco Bell social media manager and set about answering customers’ complaints.

Some other highlights, from Veix’s writeup:

If this list strikes you as just another day on Facebook, you’re onto something.

Ditto if you think that list is a perfect set of reasons why we should all lock down our Facebook accounts to prevent hijacking, having our friends spammed, and having our names attached to things we don’t want to endorse, including not only ISIS but also brands or causes.

As far as the Taco Bell employee impersonation goes, yes, it was hilarious. But it’s hard to imagine that Taco Bell thinks so.

Nor would any business whose account is hijacked, I’m sure. All the more reason to lock them down with strong passwords and appropriate privacy settings.

Veix didn’t stop at Facebook. He also replicated the experiment with Instagram and Twitter.

He dubbed the public Instagram account a bit of a flop, with only 74 posts until it was apparently disabled.

The Twitter account was another matter entirely. Veix said that it instantly turned into something resembling “4chan on methamphetamines.”

From his writeup:

Someone posted the lyrics to “One Headlight” while others added a bunch of bizarre photos. After someone started harassing a teenage girl, I decided to shut it down. Before I got a chance, Twitter locked the account for suspicious activity, right as I was screengrabbing the feed one last time for posterity. Oof.

Like the collective Facebook page, the face of a collective Twitter account seems to reflect the nature of the social media platform: in Twitter’s case, a personality that has issues with harassment.

That’s hardly surprising, given that Twitter has grappled with the problem of trolls and bullying for years.

To Twitter’s credit, and as a reflection of the strides it’s made recently in fixing its harassment problem, it didn’t waste time shutting down the account of a fictional user that had fast turned nasty.

So what’s Facebook’s excuse?

As Veix pointed out, the account should have been flagged for spam, given its wanton ways of liking, messaging, poking and friending everybody it could reach.

But therein lies the true reflection of the ultimate Facebook user, Veix concluded: one that performs “like an ‘ideal’ Facebook user”:

...friending people, liking brands, sharing posts with abandon, etc. In a way, the profile seemed to be more successful than most "real" accounts - Facebook favored the aggressive usage, and the account spread like a kind of virus, perfectly designed to take advantage of how Facebook operates.

Another noteworthy aspect of the experiment is that Facebook seemed to take its sweet time in shutting down this profile with a fake name that “spammed the sh*t” out of everyone, as Veix put it.

Yes, spamming, click-happy, made-up “Maximilien Manning” seems to have been a model Facebook citizen. Or, at least, he’s somebody whom Facebook’s algorithms didn’t mind keeping around for a while.

Facebook killed Max as of Tuesday morning.

RIP, you crazy, click-happy lunatic. You were a fine experiment.


Image of Maximilien Manning Facebook profile courtesy of Joe Veix/Death and Taxes.