Peter Geoghegan on Twitter

Received a phishing e-mail supposedly from FB. Said actual friend tagged me. Friend list is v compromising - why make it public by default?