Comment Re:Facebook IS the attack (Score 1) 157
This is right on the money. FB's security model is poorly thought out, and the indifference of the CEO to privacy concerns probably has a lot to do with it. In generally, the ad-hoc revisions of their privacy settings (which have at times forced users to opt out of more permissive settings) are indicative of a poorly thought out security model.
The kind of "attack" that is effective (and has been used against FB users) is the "viral app" -- basically, the typical facebook "app" requires that the app is able to perform actions on behalf of the user and see the users data, so most users don't think twice about checking these boxes.