Privacy restrictions on Facebook posts are visible to users

https://plus.google.com/110402443423554417660/posts/YgQGEZPWvPk

by compsciphd • 14 years ago

56 32 14 years ago

plus.google.com

AustinGibbons• 14 years ago

also added to the g+ but...

https://www.facebook.com/whitehat/bounty/

compsciphd2• 14 years ago

oh well, didn't know about that. This isn't really too complicated, I just can't believe no one has looked at the json for the newsfeed before!

throwaway64• 14 years ago

you see a lot of people that find bugs, and even serious exploits that never bother going to the trouble to report them, or crow about them publicly.

Just because nobody said anything, doesn't mean that nobody knew.

nikcub• 14 years ago

I went through this as well, but it turns out that an outside perspective is all that is required to noticing that something is unusual or not right.

Don't underestimate what you may consider to be normal or obvious, as it may not be to others.

svachalek• 14 years ago

I saw discussion of this a while back but unfortunately can't find the original link. The essence of the argument boils down to the purpose of privacy settings on postings; the concept of an "everybody can see this except Bob" setting is completely stupid from a traditional security perspective, but it makes sense if you're planning a surprise party. You don't expect Bob is going to try to circumvent the security AT ALL because it's like punching through a wet paper bag. It's like subtly tapping your watch at a party. It's not an unbreakable code, it doesn't need to be, it isn't meant to be.

compsciphd2• 14 years ago

Let's say you're upset with someone, want to vent so say it anonymously and restrict said person from seeing it, so you can vent publicly, and not embarrass anyone (presuming people wont be able to figure out via the post itself who you are talking about).

Because of this, your efforts might be wasted.

mkopinsky• 14 years ago

OTOH, if you vented publicly about someone, it might be useful for me to know who NOT to repeat the rant to.

unreal373• 14 years ago

As soon as that person sees your Facebook account using the mobile phone of another friend of yours, the jig is up. Don't "vent publicly". Vent privately.

If you do this a lot, you will have publicly offended a lot of friends of yours and it will backfire one day. One day someone will know who you are venting about, and copy it and send it to them just for fun.

badclient5• 14 years ago

I am one of the biggest fan of facebook's privacy settings and bat for them for providing such granular control. However, this has creeped the fuck out of me! I make extensive use of this feature and am going back through a bunch of posts reevaluating the settings knowing the person can see it.

Almost 100% of my posts in past 6 months have custom settings but there is no way I can go through each one of them.

This is HUGE from my perspective. I am typically the guy to tell others constantly bitching about fb's privacy settings to move on. But alas, the day has come when I am officially scared to use facebook.

res0nat0r4• 14 years ago

> This is HUGE from my perspective. I am typically the guy to tell others constantly bitching about fb's privacy settings to move on. But alas, the day has come when I am officially scared to use facebook.

Um, what kinds of friends do you have on Facebook? Maybe you shouldn't be friending these people in the first place.

smokeyj5• 14 years ago

Maybe privacy controls should offer privacy, instead of tricky-dick shenanigans.

unreal373• 14 years ago

Maybe you were under the illusion that there is privacy on the Internet. This should be a wakeup call.

If you are blocking posts for Person A, but not Person B, the moment Person A and Person B talk your "privacy settings" are over.

Even without this leaking in the JSON, people can TALK to each other, or show each other their Facebook accounts, and you can't control that. This applies to Facebook, Twitter DMs, Google+ circles, email, and whenever you think you are posting privately over the Internet.

badclient5• 14 years ago

There is privacy on the Internet. I think it is an illusion that you cannot have privacy on the Internet.

Sure, Person A can always DECIDE to talk to Person B. But that does not mean I voluntarily tell Person B everything that I only want Person A to know. This specific argument of yours doesn't even have much to do with the Internet.

You are basically saying it is useless to ever share anything with only a specific group of people because the specific group of people can always just talk to everyone else you don't wish to share the information with.

badclient5• 14 years ago

While them showing the Except list may be a bug, them listing out individual users you have made something visible to is a feature. I only started seeing it yesterday and just went back to delete any individual user-only post that I could easily remember having made. Here is what I see when I click on some of the custom icons:

"These are other people who can see ----'s post. When you share with a specific set of friends, they can see the audience. However, your friends can't see when you put them on a list like Close Friends or Acquaintances."

This feature makes NO SENSE. Please remove this, facebook.

zzleeper• 14 years ago

I think this may be already 'fixed', I'm seeing "privacy": {} in all of my json results..

rhizome• 14 years ago

Good thing Facebook has a rigorous and innovative hiring process that gets them the best of the best.

human_error• 14 years ago

You don't need best of the best to modify, most likely, one line of code. I'm pretty sure anyone who can code would modify it correctly. You need the best of the best who won't do this sort of issue in the first place.

newhouseb• 14 years ago

Looking through the DOM of feed items it looks like this has been scrubbed from the web interface as well.

mkjones• 14 years ago

Hey folks - thanks for the post. I'm an engineering manager at Facebook and worked a bit on this issue earlier today. As some people have pointed out, we've since pushed an update to the Graph API.

A bug in a recent update to our code caused this unintended availability of some metadata about the audience of posts. Keep in mind, the intended audience of the actual posts wasn't affected. So far, this is the only report we've received about the availability of the metadata, and we addressed the situation within a few hours.

As always, developers must abide by our Platform Policies, including obligations that protect the information they access through our APIs. For example, developers may not use someone's information outside of the application without the person's permission. Additionally, people can control whether applications have access to their information and posts through their settings.

smokeyj5• 14 years ago

What kinds of systems are in place to make sure private information stays private? Facebook invites so many people to spill their personal lives on the internet, and many of them are under the impression they have privacy and control over their data. When this trust is gone, everything about facebook will go through a mental-filter consisting of "What happens when Facebook's permissions bug-out, and my boss has full access to my profile?", and conversations will go the way of small-talk. I guess that's what people should be asking, but it seems only the tech-savvy realize there is no privacy.

autophil• 14 years ago

Be assured that Facebook's permissions will bug out time and time again. Just like when Facebook changes or adds a new feature - permissions get clawed back to being public.

Why are people so forgetful about this? Maybe the answer is similar to why some people stay in abusive relationships.

Privacy restrictions on Facebook posts are visible to users

Related Stories