For its identity theft tests, the IT security vendor said it created two falsely named accounts - using anagrams of the words "false identity" and "stolen identity".
21-year-old "Daisy Feletin" was represented by a picture of a toy rubber duck bought at a $2 shop, whilst 56-year-old "Dinette Stonily" posted a profile picture of two cats lying on a rug.
According to Sophos, each Facebook newbie then sent out 100 friend requests to randomly-chosen Facebook users in their age-group.
Within two weeks, a total of 95 strangers chose to become friends with Daisy or Dinette - an even higher response rate, Sophos said, when it s first performed the Facebook experiment two years ago with a plastic frog.
Perhaps worse, Infosecurity notes, eight Facebook users befriended 21-year-old Dinette without even being asked.
Paul Ducklin, Sophos' head of technology for the Asia-Pacific region, said that the situation in 2009 is something of a wake-up call, as the veteran IT security company thought the responses would be lower in 2009.
"Our honeymoon period with social networking sites ought to be over by now - but many users still have a 'couldn't care less' attitude to their personal data", he said.
According to Ducklin, 89% of the 20-somethings and 57% of the 50-somethings who befriended Daisy and Dinette also gave away their full date-of-birth.
Nearly all the others suppressed their year of birth, but this, says Ducklin, is often easy to calculate or to guess from other information given out.
Even worse, just under half of the 20-ish crowd, and just under a third of the 50-ish crowd, gave away personal information about their friends and family.
"People aren't just handing over their own life story to criminals", warned Ducklin. "They're betraying people close to them, too, by helping those cybercrooks build up a detailed picture of their life and their milieu. This is an identity scammer's dream."
As a result of its findings, Sophos is calling on users of social networking sites to think much more strictly about what it means to accept someone as your friend.
"We're not trying to be killjoys", said Ducklin. "We just want you to be much more circumspect about whom you choose to trust online."