Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook security hole allows viewing of private photos

forum.bodybuilding.com

Post reply on HN
Print view View original

61–70 of 143 posts

Re: Facebook security hole allows viewing of private photos

#61

Post by hoolash »

kristopolous wrote: post #25

General form appears to be as follows: http://www.facebook.com/ajax/report/social.php? __a=1& __d=1& attach_additional_photos=1& cid=((FBID))& content_type=0& h=((HASH BASED ON YOUR ACCOUNT))& phase=6& report_id=1& rid=((FBID)) After you get that initial hash then you can swap out the CID and the RID and get everyone else (I tried it for 3)... it's pretty easy. This issue is probably going to make mainstream news by…

How would this be sent? entering into the address bar returns a blank page, and no change on profile pages.

Re: Facebook security hole allows viewing of private photos

#62

Post by nyellin »

skeptical wrote: post #59
nyellin wrote: post #34

Earlier quoted context omitted.

I'm downvoting you for saying I think it's a stretch to call this a mistake If it wasn't on purpose, it was a mistake. Period. It might be inexcusable, as you later pointed out, but it was still unintentional. Everyone likes to hate on Facebook. If this was a YC startup, I suspect people would be more forgiving.

aammm... you omited the word 'just' which archio stressed. Sure, if you take away THE important word of a sentence, then you might as well downvote it. 'a mistake' puts this at the same level of seriousness as other problems. This is at least a big mistake.

I copied and pasted from the original comment. The word "just" was added later.

Re: Facebook security hole allows viewing of private photos

#63

Post by dangrossman »

Archio wrote: post #50
tantalor wrote: post #45

Earlier quoted context omitted.

> there aren't even any hacks involved I doubt law enforcement would see it that way. Downloading photos with this method is not much different than guessing somebody's email or voicemail password; you're accessing something you're not supposed to. See 18 U.S.C. § 1030(a)(2)(C) and § 2701.

Well, the question is, how far does that go? If I put up photos on a public web server intending them to be private, is that still legal?

It goes as far as is reasonable. The law gets interpreted in a court of law by human beings that make decisions about whether a reasonable person would expect that to be private and the intent of the person that found the images anyway.

Re: Facebook security hole allows viewing of private photos

#64

Post by gcr »

topbanana wrote: post #53
code_duck wrote: post #40

Earlier quoted context omitted.

That's true, if it was a group of three young people starting a new business, I would be more forgiving than about a multi billion dollar corporation with hundreds of engineers and millions in resources. It was a mistake, but another word for a mistake is 'negligence'. The fact that something like this can happen illustrates systemic shortcomings at the company. Millions of people are depending on them to enforce the…

"Another word for a mistake is 'negligence'" No it isn't.

What's the difference?

Re: Facebook security hole allows viewing of private photos

#65

Post by jdp23 »

brlewis wrote: post #54
tzury wrote: post #51

someone [1] pulled this trick on Zuck's account [2] 1. http://twitter.com/#!/flyosity/status/144065873743839233 2. http://imgur.com/a/PrLrB

One of the images is of the last paragraph of the FTC page about Facebook where readers are invited to Like the FTC on Facebook. Background: http://news.ycombinator.com/item?id=3291909

I wonder if the FTC will follow through on the settlement and fine Facebook $10,000 for each violation? There's a dozen or so photos of Zuck, so that's $120K already ...

Re: Facebook security hole allows viewing of private photos

#66

Post by cbabraham »

brlewis wrote: post #35
ianhawes wrote: post #23

This is a security hole and nothing more. Developers make mistakes. This is not some vast conspiracy by Facebook to undermine your privacy. Why, of all places, is HackerNews unable to comprehend this?

If you see a comment that makes it sound like there's a vast conspiracy, please post in reply to that comment. I don't see any such comment. HN appears to be comprehending just fine.

http://news.ycombinator.com/item?id=3319018

This comment seems to argue that this was intentional.

Re: Facebook security hole allows viewing of private photos

#67

Post by pasbesoin »

Seriously, FB, do you have no QA whatsoever?

I wonder whether this is limited to photos in the profile album, or whatever it is called, these days.

EDIT: I'll add this suggestion that I've made before, since you're going to have a LOT of people wanting to delete photos, if this problem proves to be significant. Delegate someone to spend a few hours writing a routine that will replace a cached photo with an identically sized, all white (or black, blue, whatever), no metadata generated image. So, you don't have to rebuild your image caches in order to ensure that a photo is really gone (well, except for the fact that it once existed, as demonstrated by the working URL and white image).

I've read the excuse made in the past that aggressive, large, integrated image caches made actual photo deletion "not an option". As long as you can overwrite existing bits in place, this should solve that. (Although I don't know about all the tagging you've now since overlaid onto the images.)

Re: Facebook security hole allows viewing of private photos

#70

Post by balsam »

tzury wrote: post #51

someone [1] pulled this trick on Zuck's account [2] 1. http://twitter.com/#!/flyosity/status/144065873743839233 2. http://imgur.com/a/PrLrB

i'd like to see these tagged. (seriously) anybody knows what they are drinking in that last pic? The bottle looks interesting.
Post reply on HN