6 ms·

View facebook friend list (hidden or not hidden)

73 points by saperduper 17y ago

gaius 17y ago
Oops. Rule #1 of client-server computing: never trust the client. Kids these days have forgotten what we knew in the 90s.
- yan 17y ago
  To be fair, friend lists aren't considered very private on facebook.
  - ericb 17y ago
    Which didn't used to be true, and pretty much sucks if you're say, an Iranian dissident.
snippyhollow 17y ago
I think that's normal, there are no longer "hidden friend lists" since last update.
riffer 17y ago
Thought experiment: If you had the full social graph, what would you build?
- sachinag 17y ago
  Restriction: you can't say a Facebook competitor/clone.
  - judofyr 17y ago
    I'll build an Orkut clone then.
- Groxx 17y ago
  An army, worthy of Mordor.
- access_denied 17y ago
  You know that saying "everyone knows everybody over 6 other people", maybe something about that. Or: who of your friend's friend's friend's has the same hobby / whatever.
- callmeed 17y ago
  Some sort of uber pyramid scheme ... just as an experiment to see how big it could get.
- jbrennan 17y ago
  Two chicks at the same time, that's what I'd build.
- Joeboy 17y ago
  Don't know about building, but having a list of someone's friends must provide some excellent ammunition for fraud. Eg. you could do the Spanish Prisoner scam using peoples' friends' names. Most attempts would fail of course, but you'd be doing it in bulk over the web, from a safe distance.
- patio11 17y ago
  I'd be really tempted to judge you by the company you keep, and put Fair Isaac out of business.
Groxx 17y ago
Found a way to break it: Uncheck the "Public Search Results" box in your Search settings. It's pulling from info you make public by checking the box. That said, that box DOES NOT imply it's making your entire friends list public. It seems to say that only what's on the preview page is visible, but that's entirely wrong.
- filosofo 17y ago
  But even people who have unchecked that box show up when I make the same request authenticated as a Facebook user.
  - Groxx 17y ago
    So, you're authenticating yourself, and searching other non-publicly-searchable people's ID? Or you're authenticating, searching your own, and seeing people who don't list themselves as public? Or, you're seeing people who aren't public, but in your friends list, and you're publicly searchable? If it's the first, then that's definitely a problem, as anyone can be a FB user. In that case, care to post the command somewhere? This should be made known, as it's definitely a privacy concern, and FB tends to do nothing unless threatened.
    - imurray 17y ago
      Ouch, it is the first option; if logged into facebook it seems you can see any old friends list (including ones you can't normally see). The "command" is just to go to the URL in the shell command in your authenticated browser (or to faff about with cookies if you want to use lynx/wget/curl). FB also removed the option to completely opt out of their application API at the same time they messed this up. Not impressed.
      - Groxx 17y ago
        Joy. That does it, I'm off FB for good. Not for any real feelings of invasions of my privacy, it's just because they're careless and/or practically malicious.
jkincaid 17y ago
I believe this has to do with the privacy changes last month, which made it so that Friends Lists can no longer be hidden. After an initial backlash, Facebook made it relatively easy to remove your friends list from public search results, but it sounds like it isn't actually blocking access to them — they're just harder to find. From Facebook's blog post ( http://blog.facebook.com/blog.php?post=197943902130 http://blog.facebook.com/blog.php?post=197943902130 ): "In response to your feedback, we've improved the Friend List visibility option described below. Now when you uncheck the "Show my friends on my profile" option in the Friends box on your profile, your Friend List won't appear on your profile regardless of whether people are viewing it while logged into Facebook or logged out. This information is still publicly available, however, and can be accessed by applications. "
- imurray 17y ago
  This is really dishonest of Facebook. Most people will have a reasonable (but incorrect) expectation that if a user can't see a friend list on their profile page then Facebook will stop that user from accessing that information. Why else would Facebook provide a tool that lets you see how your profile appears to other people? Facebook should properly authenticate access to the URL given in the post, and reenable blocking all applications. That is, actually respect people's privacy, not just patch things up to superficially look like it.

73 points by saperduper 17y ago

gaius 17y ago

Oops. Rule #1 of client-server computing: never trust the client. Kids these days have forgotten what we knew in the 90s.

yan 17y ago
To be fair, friend lists aren't considered very private on facebook.
- ericb 17y ago
  Which didn't used to be true, and pretty much sucks if you're say, an Iranian dissident.

snippyhollow 17y ago

I think that's normal, there are no longer "hidden friend lists" since last update.

riffer 17y ago

Thought experiment: If you had the full social graph, what would you build?

sachinag 17y ago
Restriction: you can't say a Facebook competitor/clone.
- judofyr 17y ago
  I'll build an Orkut clone then.
Groxx 17y ago
An army, worthy of Mordor.
access_denied 17y ago
You know that saying "everyone knows everybody over 6 other people", maybe something about that. Or: who of your friend's friend's friend's has the same hobby / whatever.
callmeed 17y ago
Some sort of uber pyramid scheme ... just as an experiment to see how big it could get.
jbrennan 17y ago
Two chicks at the same time, that's what I'd build.
Joeboy 17y ago
Don't know about building, but having a list of someone's friends must provide some excellent ammunition for fraud. Eg. you could do the Spanish Prisoner scam using peoples' friends' names. Most attempts would fail of course, but you'd be doing it in bulk over the web, from a safe distance.
patio11 17y ago
I'd be really tempted to judge you by the company you keep, and put Fair Isaac out of business.

Groxx 17y ago

Found a way to break it: Uncheck the "Public Search Results" box in your Search settings. It's pulling from info you make public by checking the box. That said, that box DOES NOT imply it's making your entire friends list public. It seems to say that only what's on the preview page is visible, but that's entirely wrong.

filosofo 17y ago
But even people who have unchecked that box show up when I make the same request authenticated as a Facebook user.
- Groxx 17y ago
  So, you're authenticating yourself, and searching other non-publicly-searchable people's ID? Or you're authenticating, searching your own, and seeing people who don't list themselves as public? Or, you're seeing people who aren't public, but in your friends list, and you're publicly searchable? If it's the first, then that's definitely a problem, as anyone can be a FB user. In that case, care to post the command somewhere? This should be made known, as it's definitely a privacy concern, and FB tends to do nothing unless threatened.
  - imurray 17y ago
    Ouch, it is the first option; if logged into facebook it seems you can see any old friends list (including ones you can't normally see). The "command" is just to go to the URL in the shell command in your authenticated browser (or to faff about with cookies if you want to use lynx/wget/curl). FB also removed the option to completely opt out of their application API at the same time they messed this up. Not impressed.
    - Groxx 17y ago
      Joy. That does it, I'm off FB for good. Not for any real feelings of invasions of my privacy, it's just because they're careless and/or practically malicious.

jkincaid 17y ago

I believe this has to do with the privacy changes last month, which made it so that Friends Lists can no longer be hidden. After an initial backlash, Facebook made it relatively easy to remove your friends list from public search results, but it sounds like it isn't actually blocking access to them — they're just harder to find. From Facebook's blog post ( http://blog.facebook.com/blog.php?post=197943902130 http://blog.facebook.com/blog.php?post=197943902130 ): "In response to your feedback, we've improved the Friend List visibility option described below. Now when you uncheck the "Show my friends on my profile" option in the Friends box on your profile, your Friend List won't appear on your profile regardless of whether people are viewing it while logged into Facebook or logged out. This information is still publicly available, however, and can be accessed by applications. "

imurray 17y ago
This is really dishonest of Facebook. Most people will have a reasonable (but incorrect) expectation that if a user can't see a friend list on their profile page then Facebook will stop that user from accessing that information. Why else would Facebook provide a tool that lets you see how your profile appears to other people? Facebook should properly authenticate access to the URL given in the post, and reenable blocking all applications. That is, actually respect people's privacy, not just patch things up to superficially look like it.