Earlier quoted context omitted.
At least they seem to patch up things whenever bugs like this are discovered.
They want the privacy leaks to happen only through their APIs.
Is this a criminal violation?
Major Facebook security hole lets you view your friends’ live chats
21–30 of 67 posts
Re: Major Facebook security hole lets you view your friends’ live chats
#22It appears he gets access to not only their chat, but friend requests, notifications, and messages too. When he switches to Sian from Hayley, notice how all the indicators light up. Spying on PMs is even worse than live chat, in my opinion.
Certainly seems to be fixed for me now though. The interesting question is how long has this "bug" been present - how long has my account been compromised for?
I used the `viewas` parameter a couple of days ago after changing some privacy settings, and this didn't happen.
Re: Major Facebook security hole lets you view your friends’ live chats
#23Earlier quoted context omitted.
Can we still be angry at incompetence?
Possibly even more so than at malice. If an organization acts out of malice, you can change its behaviour by educating it about its best interests or moving to disincent its malicious behaviour. But incompetence, especially systemic incompetence, is extraordinarily difficult to change. Facebook appears to have ADD around user privacy and its interface. Designs come and go, defaults change capriciously, and security s…
Hopefully users will steer a different course.
Re: Major Facebook security hole lets you view your friends’ live chats
#24Even though chat is blocked, you can still see pending friends request on anyone's profile. In fact, one can probably use this to add anyone as a friend. Send a friend request, view your profile with their id and accept the request you just sent.
video shows you can't
Re: Major Facebook security hole lets you view your friends’ live chats
#25"Chat is down for maintenance at this time"
Wouldn't it be a lot less disruptive just to disable that privacy feature that people use very rarely rather than disabling chat, which people use all the time? Unless, of course, they're afraid that this isn't the only security hole allowing you to see your friends' chats.
Re: Major Facebook security hole lets you view your friends’ live chats
#26"Chat is down for maintenance at this time"
Wouldn't it be a lot less disruptive just to disable that privacy feature that people use very rarely rather than disabling chat, which people use all the time? Unless, of course, they're afraid that this isn't the only security hole allowing you to see your friends' chats.
They disabled the button on the privacy setting page, but as of a few moments ago, this url still worked:
http://www.facebook.com/[your short url]?viewas=[id]
Edit: The button from the privacy settings page is working again.
In general, though, cutting chat while trying to fix this is probably a Good Idea. Less room for bad things to happen assuming you can turn chat off more quickly than you can fix the behavior.
Re: Major Facebook security hole lets you view your friends’ live chats
#27Earlier quoted context omitted.
I shared the YT link directly, and it went to the wall.
Well, at least this confirms that facebook does have the ability to filter out blacklisted URLS to the public friend feed.
I had a URL about Prop 8 (http://en.wikipedia.org/wiki/California_Proposition_8_(2008)... out from facebook chat with a message that it was possibly 'offensive' about a year ago or so .. nothing new
Re: Major Facebook security hole lets you view your friends’ live chats
#28"Never ascribe to malice, that which can be adequately explained by incompetence."
Can we still be angry at incompetence?
Not really. Everyone on this site has worked in software development at one point, right? So everyone here has written a bug before. Its reasonable to expect every piece of software (short of the stuff on the space shuttle) to have bugs. It simply isn't feasible for most software companies to find and fix all of the problems with their products.
Facebook, like all other software, is bound to have bugs. If you don't want your personal information/conversations to be exposed by a potential bug I'd suggest not using the service.
Re: Major Facebook security hole lets you view your friends’ live chats
#29This is the kind of feature I would be very nervous of implementing as a developer (showing some data in the context of another user)... to the point of pushing back on it.
I imagine it cuts across whole swathes of code, requiring additional checks about the current user. It would be so easy to leave some of these checks out or mess them up. You would have to be very careful about validating your assumptions with this feature.