I’ve discovered this exact vulnerability (it is really a vulnerability, since you even see friendships when both people have set their friends list to "only me") about a year ago and sent Facebook the description to their white hat program. Their response was more or less "won’t fix, no security issue". But it’s kind of funny to see a public blog post about this issue now, maybe this creates some pressure.
Facebook reveals friends list even when it’s set to private
51–60 of 63 posts
Re: Facebook reveals friends list even when it’s set to private
#52Earlier quoted context omitted.
Have you heard of the NSA? I think it's pretty safe to say at this point that NOTHING online is private.
Accidentally upvoted. NSA getting everything is not the same as everyone getting everything. NSA doesn't share with my mom.
One of my good friends is married to an NSA employee, so I can tell you (almost) first-hand that they would if they knew her.
Re: Facebook reveals friends list even when it’s set to private
#53Earlier quoted context omitted.
Right, when preferences are in conflict do you protect the person who cares or the person who doesn't? Also privacy is like a thermodynamic arrow. You can't unspread a secret or make public information private. So you shouldn't treat the decision to go public lightly.
> Also privacy is like a thermodynamic arrow. Running off on a tangent, that's a really interesting analogy. I wonder how much could be done with the notion that privacy is the opposite of entropy: that is, privacy is about minimizing the arrangements of how your information is formed, and there's a universal, inevitable trend towards maximizing those arrangements. Differently, privacy as the predictability of how a…
This notion makes sense to me. The more public or quotidian your thoughts and behavior, the greater chance that people will be able to nail you down. And there are interesting feedback loops when you go public, then people expect you to continue to be public in similar situations.
There is an interesting tension between the benefits of collaboration and the benefits of individuality. John Lennon and Paul McCartney playing off each other, or Andrew Wiles working alone in obscurity.
Surprise and disruption are closely linked to privacy in my mind. Not necessarily by launch time. But the groundwork for originality to me is laid in the soil of a rich inner life.
Re: Facebook reveals friends list even when it’s set to private
#54Earlier quoted context omitted.
Have you heard of the NSA? I think it's pretty safe to say at this point that NOTHING online is private.
Accidentally upvoted. NSA getting everything is not the same as everyone getting everything. NSA doesn't share with my mom.
..unless they decide that you are a "radical", in which case they very well might leak it to your family, friends, and acquaintances in an attempt to distance them from you.
Re: Facebook reveals friends list even when it’s set to private
#55The friend list issue seems to be an always "won't fix". I'm pretty sure every few or so security researchers, testers reach this "vulnerability" in one method or another. I've gotten a similar response from the Security Team for trying to dig up friend lists. Maybe it helps maybe it doesn't. I've learned to accept the stance and move on with other security holes. "A friend connection is two-way - you friend someone,…
I think this is a "wontfix" because Facebook heavily relies on their "Suggest a Friend" feature as a core business asset. I think it's actually a rather sophisticated algorithm. For example, if you own multiple Facebook accounts, it uses what is likely a combination of IP history and persistent cookies to suggest friends no matter what account you are logged into, or what computer you're accessing it from. My guess i…
Are you sure about the IP history? That doesn't make much sense to me. I work in a building with a shared internet collection with other offices. It may appear to Facebook that all traffic for that building comes from the same IP. Would Facebook then suggest every person that uses the building to me as a friend?
There is a possibility that if you have multiple Facebook accounts and use the same browser for each, a cookie could be used to link the two. Just because two people use the same computer and the same browser to login to Facebook does not mean they are friends. You might be using a public terminal.
Facebook could match a specific browser session with user visits to other sites that have Facebook features. Your digital fingerprint could be determined through your browsing habits. You don't need to be logged in for that. That would be pretty insidious of Facebook. I'm not a fan of 3rd party JS scripts in that respect.
I've seen friend suggestions that are linked to my email account that I've signed up with. I think this is an email address book leak. Perhaps it's possible to discover someone's work contacts say by just signing up with that someones email address (say a work address). I'm not sure if the email needs to be verified before this information is leaked.
Re: Facebook reveals friends list even when it’s set to private
#56Earlier quoted context omitted.
Have you heard of the NSA? I think it's pretty safe to say at this point that NOTHING online is private.
Accidentally upvoted. NSA getting everything is not the same as everyone getting everything. NSA doesn't share with my mom.
Privacy doesn't mean "not everyone is getting everything". If FB shares my secrets with anyone without my consent, they're violoating my privacy. They don't need to make them available to everyone for that.
Re: Facebook reveals friends list even when it’s set to private
#57Earlier quoted context omitted.
Obviously there will be a contention when you have an asset that is shared and they flag it in a different way... and on a certain level it makes sense that "public" wins when you have 1 public and 1 private because if one person chooses to share anything else then it's public, so why should connections be different? But on another level, no. If a person has decided their connections are private information, then the…
This works the way secrets work in real life. You may want to keep something secret, but if your friend is indescreet, the secret is out. You can't force someone else to keep a secret on your behalf.
> This works the way secrets work in real life.
Hmm, no, it doesn't? Your analogy makes absolutely no sense.
If a party wants to make its connections private, then make it private from both sides of the connection. All Facebook has to do is fix this.
Re: Facebook reveals friends list even when it’s set to private
#58Earlier quoted context omitted.
There was the case when someone was denied entry at a US border and a printout of her private FB messages was shown. http://usahitman.com/ggtaubpfm/ (Best page I could find with the story - I have no idea if that's a credible site or not.)
Uh... the real story is that she gave them the printout. "Why are you coming to the US?" "I'm going to be an au pair. See..." [hands over printout] "You did not apply for a work visa. Goodbye."
> the real story is that she gave them the printout.
That's not what the story says. What's the source of your claims?
Re: Facebook reveals friends list even when it’s set to private
#59Earlier quoted context omitted.
Uh... the real story is that she gave them the printout. "Why are you coming to the US?" "I'm going to be an au pair. See..." [hands over printout] "You did not apply for a work visa. Goodbye."
> the real story is that she gave them the printout. That's not what the story says. What's the source of your claims?
Well, the story made its way into the English speaking world via google translate, which is pretty notorious for dicking up subtle things like word order and direct vs indirect objects. She gave them the printout. She the printout them gave. They gave the printout her.
The original article is now gone, but you can read the HN comments from the time. https://news.ycombinator.com/item?id=5864427
Re: Facebook reveals friends list even when it’s set to private
#60Earlier quoted context omitted.
> the real story is that she gave them the printout. That's not what the story says. What's the source of your claims?
Well, the story made its way into the English speaking world via google translate, which is pretty notorious for dicking up subtle things like word order and direct vs indirect objects. She gave them the printout. She the printout them gave. They gave the printout her. The original article is now gone, but you can read the HN comments from the time. https://news.ycombinator.com/item?id=5864427
The details of the story seem unlikely and it was probably sloppy journalism, but I haven't found anything besides speculation that claims it happened otherwise.
It doesn't appear anything was lost in translation:
https://news.ycombinator.com/item?id=5864882
https://news.ycombinator.com/item?id=5864653
https://news.ycombinator.com/item?id=5864577
I think the likeliest case was that they searched her laptop, found an open tab with her Facebook messages, then printed the conversation.