4 ms·
Set your privacy settings on lockdown and then put your own Id in instead of "4". This is undesirable behavior.
by tewks 16y ago
Set your privacy settings on lockdown and then put your own Id in instead of "4". This is undesirable behavior.
- milkshakes 16y agoI agree. However, this isn't a new development. It's just more in your face now.
- tewks 16y agoWas this true for all users or just "4" prior to f8?
- milkshakes 16y agoWith a valid sessionkey, I could get a list of the public events that any user was invited to, as well as the ones they RSVP'd for.
- smokinn 16y agoAre you sure? I'm checking myself and nothing is available other than my profile photo. /[my id]/events data (empty) Maybe his privacy settings aren't as stringent as mine?
- milkshakes 16y agoIt only works with publicly listed events
- ori_b 16y agoBut you could already look at publicly listed events and find out who was attending. This - in principle - isn't exposing any more information than what was previously there. It just makes it easier to access. Sure, it still sucks. But it's not a major new security breach. All that it exposes is already there.