Also, sophos.com revealed to facebook.com, through an iframe, that I went and read an article on sophos.com about a facebook.com's vulnerability.
Facebook reveals friends list even when it’s set to private
11–20 of 63 posts
Re: Facebook reveals friends list even when it’s set to private
#12So is this why I get random spam for which the name on the from address matches various Facebook friends?
Re: Facebook reveals friends list even when it’s set to private
#13The friend list issue seems to be an always "won't fix". I'm pretty sure every few or so security researchers, testers reach this "vulnerability" in one method or another. I've gotten a similar response from the Security Team for trying to dig up friend lists. Maybe it helps maybe it doesn't. I've learned to accept the stance and move on with other security holes. "A friend connection is two-way - you friend someone,…
I think this is a good insight, and it pertains to any connection between two parties for any service, Facebook or no. You may use a private email service, you may encrypt all your emails...but the moment you email something to another party, and they transmit/copy it in an unencrypted way, your email is no longer "private" and it's not the fault of your own email service either (replace "email" with "SnapChat" for m…
Wow, awesome discussion. Thanks for the original comment phwd. And for the add-ons pxtl & danso. All of your thoughts made me refine and further back my own.
Though I agree there is a two sided ownership (both friends own a 'side') why the privacy policy stinks to me is that it does not seem to me that Facebook really cares about this 'ownership'. They really only want more data and to make their site more valuable. Is it unfair of me to attribute a rationale to Facebook's decision without cold-hard-facts, perhaps.
However, lets look at the took cases 1) They actually care about this 'ownership' 2) They do not care.
In case 1), they are afraid to violate a person's privacy choice of having a friendship be public. There is essentially a tension between their privacy choices and their 'friends'. It seems to me that when two choices are odds like this, caution is the best route. For instance, when two people know a secret that relates to both of them, and one feels uncomfortable about revealing it, the general rule of thumb is that you do not reveal (unless its like murder 0.o). Overall, I guess it seems like if you do make it 'public' it makes someone uncomfortable. While if you do not, it makes someone not get something 'they want'. In this situation, just err towards caution and make it private. What does everyone else think?
In case 2), they just want more data. Well I understand it, but I do not really respect it. I think this is easy. Make it private.
What do other people think? I am open to any logically flaws you find with the above statements.
Re: Facebook reveals friends list even when it’s set to private
#14The friend list issue seems to be an always "won't fix". I'm pretty sure every few or so security researchers, testers reach this "vulnerability" in one method or another. I've gotten a similar response from the Security Team for trying to dig up friend lists. Maybe it helps maybe it doesn't. I've learned to accept the stance and move on with other security holes. "A friend connection is two-way - you friend someone,…
Obviously there will be a contention when you have an asset that is shared and they flag it in a different way... and on a certain level it makes sense that "public" wins when you have 1 public and 1 private because if one person chooses to share anything else then it's public, so why should connections be different? But on another level, no. If a person has decided their connections are private information, then the…
Right, when preferences are in conflict do you protect the person who cares or the person who doesn't?
Also privacy is like a thermodynamic arrow. You can't unspread a secret or make public information private. So you shouldn't treat the decision to go public lightly.
Re: Facebook reveals friends list even when it’s set to private
#15I think Facebook should just stop playing games and state that nothing will be private with the exception of personal messages. At least then everyone will know what to expect.
Re: Facebook reveals friends list even when it’s set to private
#16The article concludes with:
> I agree with Abezgauz on this issue: Facebook has no right to siphon our friends off of a list putatively set to be private.
Now it strikes me that Facebook does have that right. You gave them that right when you chose to create an account with them and chose to make friend connections with that account. If you don't like the way they operate, don't use their service. You'd have to live in a vacuum not to know that Facebook has been consistently pushing the envelope of acceptable privacy for years. The reality is that if you truly need complete privacy, a Facebook account is not for you.
Re: Facebook reveals friends list even when it’s set to private
#17I once made a fake FB account for testing purposes. I used private browsing in order to avoid having to log out of my real FB account. The two accounts never became friends or shared anything. The fake account does not have friends at all. The email address can not be tracked to me as well.
Yet every week, this email account receives an email with friend suggestions. I know about 75% of those people. With some of them , I'm not even friends on FB with my real account.
Re: Facebook reveals friends list even when it’s set to private
#18I think you just have to accept that facebook, in general, has a 'share to a wide audience' as a default design stance. That stances enhances general viriality and usage of their program and thus increases their user base.
Same with never deleting anything, recording everything you do with like buttons around the internet and making it difficult to do such things as 'delete everything older than 3 months' with one click. Storage is cheap and the more information they have, the more valuable their product is to their customers, marketing firms.
Have a locked down by default stance just decreases the virality of their social product. The amount they piss off is smaller than the amount they gain unfortunately.
Re: Facebook reveals friends list even when it’s set to private
#19I once made a fake FB account for testing purposes. I used private browsing in order to avoid having to log out of my real FB account. The two accounts never became friends or shared anything. The fake account does not have friends at all. The email address can not be tracked to me as well. Yet every week, this email account receives an email with friend suggestions. I know about 75% of those people. With some of the…
Nothing strange about this. They see that both accounts are accessed from the same ip, so they assume you must know each other.
Re: Facebook reveals friends list even when it’s set to private
#20The friend list issue seems to be an always "won't fix". I'm pretty sure every few or so security researchers, testers reach this "vulnerability" in one method or another. I've gotten a similar response from the Security Team for trying to dig up friend lists. Maybe it helps maybe it doesn't. I've learned to accept the stance and move on with other security holes. "A friend connection is two-way - you friend someone,…
The confusion arises because there's a difference between:
1. Allow my friend list to be seen 2. Allow me to be seen on other peoples friends lists
Given Facebook wants users to be as discoverable as possible to form easy relationships, I can see how (1) is generally less damaging to that requirement.
Its a pity since many legacy services allow for (2), e.g. Unlisted phone numbers.