Digging through developers.facebook.com, it appears that their link scraper creates Objects in their Social Graph. Because these resources are accessible by URL

Digging through developers.facebook.com, it appears that their link scraper creates Objects in their Social Graph. Because these resources are accessible by URL, they are considered self-hosted objects, and they're always public [1]. Their Link Sharing FAQ mentions that Messenger is one of the ways link previews are created, further confirming this behavior [2]. Really the problem is that several situations coincide which make the result surprising: - It's not so bad that posting URLs to Facebook generates a link preview and saves that as a public resource in their Object Graph. - It's not so bad that you can find the Object's object-instance-id by the URL. - It's not so bad that Facebook correlates a bunch of information about that Object's relationship with other nodes in their graph. - For data they believe is all-public, it's not so bad that object-instance-ids are not cryptographically secure and are trivially crawlable. But when taken together, it -is- surprising that URLs shared through Messenger (a setting that most users would assume to be "private") can be trivially crawlable. [1] https://developers.facebook.com/docs/sharing/opengraph/object-api https://developers.facebook.com/docs/sharing/opengraph/objec... [2] https://developers.facebook.com/docs/sharing/webmasters/faq https://developers.facebook.com/docs/sharing/webmasters/faq