71–80 of 124 posts
I'm confused as to how this is possible. Are people syncing their phone books from cellphones to Facebook?
Yep. A lot of android builds have it baked in, and I assume the facebook apps for android/ios have this functionality.
Earlier quoted context omitted.
That simple search by name would not show his account with the gay persona - so they thought they were safe. His phone # was probably not listed publicly either. You work at Facebook, don't you?
I am supposed to _start_ work at FB assuming I get a visa. I'm a bit curious about why a search for name won't show the alternate persona? I've had friends who made 2 profiles and both used to show up whenever I typed their name in; and his # being listed publicly doesn't affect the argument either way. Edit: Reply to child comment by jarofgreen: apparently the comments are too deeply nested to reply directly: "using…
Also, are you trying to make the argument that his gay friend is using FB wrong therefore deserves to have his privacy violated? That sounds like a pretty shit argument to me.
These little privacy leaks are not important on their own. A little data leaks here, a little there. What is concerning is that we can guarantee private investigators and professional identity fraudsters are well on top of all these little loopholes. And combined, I'd say Facebook is probably pissing data out. Some sweet law enforcement potential here - slap in a request to Facebook on a drug-dealing suspect, find a…
If you are truly concerned about harm to users, did you try reporting this to facebook.com/security or facebook.com/whitehat? FWIW, I've alerted some people. Your post is unclear on one point. Did you see this screen BEFORE confirming via SMS that you were in possession of the mobile number you entered? If it was after confirmation, that's a very different thing.
Good point, but it's not a very different thing, it's a slightly different thing. SMS confirmation would not have stopped FB outing his gay friend to the author. The only different thing is that it would have stopped others abusing this. This is still something that can be abused and should be fixed.
Earlier quoted context omitted.
Because, as the article says, it can reveal Facebook accounts that you didn't knew your friends had, such has this friend of the OP who has a "straight" and a "gay" FB account.
I'm not sure that's such a huge sin -- technically I think FB says that you cannot have more than 1 account/actual person; I'd imagine when this `feature` was baked in the engineers didn't imagine that anyone would maintain an account that 1) they would keep hidden from friends _and_ 2) add their phone numbers to. At the very least, the friend could have blocked the set of people he didn't want to know about his pref…
1. People may very well have an account with a fake name, so that it doesn't show up in search. In France, for example, a large number of FB users are stripping out the vowels from their last name to make their FB account less findable.
2. According to the article, it's not the "gay friend" that put his phone number on his hidden account. He merely has OP's number in his phone address book (wich is normal since they are friends in real life), and the FB app is pulling this information.
These little privacy leaks are not important on their own. A little data leaks here, a little there. What is concerning is that we can guarantee private investigators and professional identity fraudsters are well on top of all these little loopholes. And combined, I'd say Facebook is probably pissing data out. Some sweet law enforcement potential here - slap in a request to Facebook on a drug-dealing suspect, find a…
If you are truly concerned about harm to users, did you try reporting this to facebook.com/security or facebook.com/whitehat? FWIW, I've alerted some people. Your post is unclear on one point. Did you see this screen BEFORE confirming via SMS that you were in possession of the mobile number you entered? If it was after confirmation, that's a very different thing.
Earlier quoted context omitted.
If you are truly concerned about harm to users, did you try reporting this to facebook.com/security or facebook.com/whitehat? FWIW, I've alerted some people. Your post is unclear on one point. Did you see this screen BEFORE confirming via SMS that you were in possession of the mobile number you entered? If it was after confirmation, that's a very different thing.
For context of readers, I note you are a FB engineer. Thanks for looking at this. 1. I'm not concerned about harm to users from this issue, I don't pretend to be. That should be Facebook's role. 2. This isn't a bug or a vulnerability, it's something you've actually coded - a feature. It doesn't 'accidentally' match up the number I've just entered with other people's phonebooks, you've programmed it to do that. Fine,…
You assume malicious intent. It might be. But it also might be a engineer who thinks "this would be a cool feature" without stopping to think about the ramifications of this.
Happens all the time; think of the Google engineer who decided that Buzz should auto-follow your most emailed contacts publicly or the NetFlix competition that outed a lesbian in small town America.
Not that I'm saying it's ok if that's the case; it's still a fuck up that needs to be fixed and in general companies need to be better about this - it happens to often.
Just saying I would have reported it to FB first and seen what they did. Responsible Disclosure, and all that.
Earlier quoted context omitted.
I'm not sure that's such a huge sin -- technically I think FB says that you cannot have more than 1 account/actual person; I'd imagine when this `feature` was baked in the engineers didn't imagine that anyone would maintain an account that 1) they would keep hidden from friends _and_ 2) add their phone numbers to. At the very least, the friend could have blocked the set of people he didn't want to know about his pref…
You got two assumptions wrong here: 1. People may very well have an account with a fake name, so that it doesn't show up in search. In France, for example, a large number of FB users are stripping out the vowels from their last name to make their FB account less findable. 2. According to the article, it's not the "gay friend" that put his phone number on his hidden account. He merely has OP's number in his phone addr…
2) That was what I meant -- syncing actual details with your anonymous persona.