Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook reveals friends list even when it’s set to private

nakedsecurity.sophos.com

Post reply on HN
Print view View original

21–30 of 63 posts

Re: Facebook reveals friends list even when it’s set to private

#21

Post by philh »

msg wrote: post #14
Pxtl wrote: post #8

Earlier quoted context omitted.

Obviously there will be a contention when you have an asset that is shared and they flag it in a different way... and on a certain level it makes sense that "public" wins when you have 1 public and 1 private because if one person chooses to share anything else then it's public, so why should connections be different? But on another level, no. If a person has decided their connections are private information, then the…

Right, when preferences are in conflict do you protect the person who cares or the person who doesn't? Also privacy is like a thermodynamic arrow. You can't unspread a secret or make public information private. So you shouldn't treat the decision to go public lightly.

> Right, when preferences are in conflict do you protect the person who cares or the person who doesn't?

There is a cost to always protecting the person who cares, which is that people may self-modify to care more, making cooperation harder. (Or just pretend to care more than they actually do.)

It's not necessarily a worry in this particular case, but it's worth considering in the general case.

Re: Facebook reveals friends list even when it’s set to private

#22

Post by skybrian »

phwd wrote: post #3

The friend list issue seems to be an always "won't fix". I'm pretty sure every few or so security researchers, testers reach this "vulnerability" in one method or another. I've gotten a similar response from the Security Team for trying to dig up friend lists. Maybe it helps maybe it doesn't. I've learned to accept the stance and move on with other security holes. "A friend connection is two-way - you friend someone,…

This problem doesn't happen when links are one-way like on Twitter or G+. If you instead have two one-way links, then hiding one side means it looks like it's one-way, and you can't see which links Mark has reciprocated.

Re: Facebook reveals friends list even when it’s set to private

#25

Post by ronaldx »

leoedin wrote: post #16

The article concludes with: > I agree with Abezgauz on this issue: Facebook has no right to siphon our friends off of a list putatively set to be private. Now it strikes me that Facebook does have that right. You gave them that right when you chose to create an account with them and chose to make friend connections with that account. If you don't like the way they operate, don't use their service. You'd have to live…

> You'd have to live in a vacuum not to know that Facebook has been consistently pushing the envelope of acceptable privacy for years

Facebook opened with and developed a following on the strength of unusually strong privacy settings.

Expectation-of-no-privacy, if that is an argument, can't apply to people who opened Facebook accounts under those circumstances.

Re: Facebook reveals friends list even when it’s set to private

#26

Post by meowface »

phwd wrote: post #3

The friend list issue seems to be an always "won't fix". I'm pretty sure every few or so security researchers, testers reach this "vulnerability" in one method or another. I've gotten a similar response from the Security Team for trying to dig up friend lists. Maybe it helps maybe it doesn't. I've learned to accept the stance and move on with other security holes. "A friend connection is two-way - you friend someone,…

I think this is a "wontfix" because Facebook heavily relies on their "Suggest a Friend" feature as a core business asset.

I think it's actually a rather sophisticated algorithm. For example, if you own multiple Facebook accounts, it uses what is likely a combination of IP history and persistent cookies to suggest friends no matter what account you are logged into, or what computer you're accessing it from.

My guess is that Security brought this up with management, management consulted business analysts, analysts said fixing this will cripple the accuracy of "Suggest a Friend", and Security has no other recourse. So it stays.

Re: Facebook reveals friends list even when it’s set to private

#27

Post by meowface »

rgj wrote: post #17

I once made a fake FB account for testing purposes. I used private browsing in order to avoid having to log out of my real FB account. The two accounts never became friends or shared anything. The fake account does not have friends at all. The email address can not be tracked to me as well. Yet every week, this email account receives an email with friend suggestions. I know about 75% of those people. With some of the…

Their "Suggest a Friend" algorithm uses lots of factors, including IP address history.

This is also probably why this is a "wontfix" issue for Facebook, since the "creepiness" of friend suggestion accuracy is considered critical to their business success, going by how much effort they put into it.

Re: Facebook reveals friends list even when it’s set to private

#28

Post by pera »

nick2 wrote: post #19
rgj wrote: post #17

I once made a fake FB account for testing purposes. I used private browsing in order to avoid having to log out of my real FB account. The two accounts never became friends or shared anything. The fake account does not have friends at all. The email address can not be tracked to me as well. Yet every week, this email account receives an email with friend suggestions. I know about 75% of those people. With some of the…

Nothing strange about this. They see that both accounts are accessed from the same ip, so they assume you must know each other.

Maybe it's not strange, but it sucks from a privacy PoV: if you can register an account with somebody else ip address you will know who are their circle of friends, even if the person opted for having the friend list hidden from everyone.

Re: Facebook reveals friends list even when it’s set to private

#29

Post by jokoon »

phwd wrote: post #3

The friend list issue seems to be an always "won't fix". I'm pretty sure every few or so security researchers, testers reach this "vulnerability" in one method or another. I've gotten a similar response from the Security Team for trying to dig up friend lists. Maybe it helps maybe it doesn't. I've learned to accept the stance and move on with other security holes. "A friend connection is two-way - you friend someone,…

tldr please
Post reply on HN