Facebook reveals friends list even when it’s set to private

Facebook reveals friends list even when it’s set to private
nakedsecurity.sophos.com

"A friend connection is two-way - you friend someone, then they approve the friend request. In essence, a friend connection means both "Philippe considers John a friend" and "John considers Philippe a friend". In other words, both people involved have some ownership over this claim - which means the privacy isn't always as simple as with other content."

"Let me use the third example in your screenshots to illustrate. Mark Zuckerberg's friend list is not public. But Greg Golkin's friend list is public - meaning if you pull up Greg's friends, you can see Mark in the list. You can also see Kevin Scott is in the list. Kevin's friend list isn't public... but Stuart Gillette's is, so you can see Kevin show up there. Consequently, using fb:degrees hasn't shown you any information you couldn't theoretically figure out by looking at public friend lists - it's just made it easier to find that info."

"Now I that at first glance this might appear to be inconsistent or a privacy violation. But remember what I said earlier about the two parties involved in a friendship connection. Essentially, you're free to hide the fact that you consider John a friend, but it's also John's choice to publicize that he counts you as a friend - and hiding connections he's publicized would essentially override his privacy wishes. In some cases, such as with fb:degrees, we show connections if they're visible to you on at least one side of the friendship."

"Now, if Mark's list is private and all of his friends set their lists to private too, you should never get a result using fb:degrees. In that case, any final link in the chain connecting you to Mark would involve a friendship that was hidden to you from both sides of the connection, so we wouldn't display it to you."

"A common case where we get similar reports is the "friendship page" between two people - we show mutual friends of the two people if each of the two friend connections is visible to you on at least one side, but we hide any mutual friends where one of the connections is hidden on both sides. To help clarify some of these situations, we added this description to the friend list privacy setting: "Remember: Your friends control who can see their friendships on their own timelines. If people can see your friendship on another timeline, they'll be able to see it in news feed, search and other places on Facebook. They'll also be able to see mutual friends on your timeline."

This is a case where privacy can get complicated, but we think the way we've chosen to operate is a good balance of the competing priorities involved. We've also chosen to focus more on privacy controls around your content and personal information, since trying to maintain privacy by limiting discoverability is often an illusion. Since Facebook is a network designed for social participation, it's nearly impossible for it to work properly and let people stay completely hidden - there are many ways to discover a profile or friendship beyond friend lists or searches. But even if someone discovers your profile, you have a great degree of control about what they can then access.

I hope that helps clarify what you were observing here. Emrakul was also correct that we have rate limiting to prevent brute-forcing at scale, and given the above controls, even building up a list through iterations would never allow you to know for sure if you'd acquired the entire hidden friend list. I think our current setup is working as intended here, but definitely let us know if you think the controls I described can be overridden somehow."