9 ms·
Major Facebook security hole lets you view your friends’ live chats
- raganwald 16y ago"Never ascribe to malice, that which can be adequately explained by incompetence."
- ohashi 16y agoCan we still be angry at incompetence?
- raganwald 16y agoPossibly even more so than at malice. If an organization acts out of malice, you can change its behaviour by educating it about its best interests or moving to disincent its malicious behaviour. But incompetence, especially systemic incompetence, is extraordinarily difficult to change. Facebook appears to have ADD around user privacy and its interface. Designs come and go, defaults change capriciously, and security seems to be an afterthought. We've seen this movie before, with MSFT in the role of the bumbling centi-billionaire. Hopefully Facebook will steer a different course.
- theycallmemorty 16y agoNot really. Everyone on this site has worked in software development at one point, right? So everyone here has written a bug before. Its reasonable to expect every piece of software (short of the stuff on the space shuttle) to have bugs. It simply isn't feasible for most software companies to find and fix all of the problems with their products. Facebook, like all other software, is bound to have bugs. If you don't want your personal information/conversations to be exposed by a potential bug I'd suggest not using the service.
- nostrademons 16y agoWell, a lot of this is the flip side of FaceBook's "changes are pushed to the live site as soon as they're checked in" policy. That lets them innovate quickly, but also means that whenever anyone screws up, it's immediately visible in a very public way. Other companies have release processes and QA procedures to stop this.
- MartinCron 16y agoOn the whole, I think the rapid innovation model tends to make things safer overall. Tiny changes can be rolled back more easily, or patched more easily. Release processes and rigorous QA procedures seem more appropriate for client-deployed software like operating systems than for centralized web applications.
- u238 16y agoEvery single line of code is peer reviewed by at least 2 people before it can be pushed.
- studer 16y agoBut tested by nobody? What happens to the reviewers that let this thing slip through, btw?
- derwiki 16y agoFrom chatting with a few Facebook engineers, I'm pretty sure it's not quick to get checked in code -> production (unless it's super urgent)
- noodle 16y agoso you're proposing that if someone doesn't like software bugs that they should stop using software? that would be mighty difficult, as software and their potential bugs are present in most every facet of modern life.
- joubert 16y agoThank insert-your-favorite-deity-here i don't pick my financial providers that way.
- drewcrawford 16y ago"Chat is down for maintenance at this time"
- JeanPierre 16y agoAt least they seem to patch up things whenever bugs like this are discovered.
- pierrefar 16y agoThey want the privacy leaks to happen only through their APIs.
- phreanix 16y agoYeah, they'll deal with that fast but we've had a complaint/bug submitted for 3 weeks now and they haven't done a thing. I understand they must get a ton of these but as paying customers who rely on Facebook for key promotion you'd think they'd pay attention. Sorry, just ranting a bit. It's been frustrating dealing with a company that doesn't have a telephone helpline, even for paying customers. (We've spent thousands of dollars on Facebook ads, etc.)
- jackowayed 16y agoWouldn't it be a lot less disruptive just to disable that privacy feature that people use very rarely rather than disabling chat, which people use all the time? Unless, of course, they're afraid that this isn't the only security hole allowing you to see your friends' chats.
- india 16y agoEven though chat is blocked, you can still see pending friends request on anyone's profile. In fact, one can probably use this to add anyone as a friend. Send a friend request, view your profile with their id and accept the request you just sent.
- ErrantX 16y agoIt doesn't let you accept/reject those requests - just shows them (afaik)
- bcl 16y agoLooks like they are in the middle of patching that -- I see a lage number but when clicking on it I only see my own messages.
- dustingetz 16y agovideo shows you can't
- quant18 16y agoAre we sure the security hole was limited to merely viewing your friends' live chats? Sure, the "review how your profile appears to another person" search box will only give you your friends --- but you can change the "viewas" id manually. Edit: I see someone in the Techcrunch comments section posted what he claims to be Mark Zuckerberg's pending friends requests - Ctrl+F for "Random Jo - May 5th, 2010 at 3:04 pm UTC" ...
- spulec 16y agoI can confirm that the security hole was not limited to only friends. I was able to insert non-friend's IDs for the "viewas" parameter.
- seiha 16y agoI just shared this URL on my wall and it didn't go to the feed. ha.
- enterneo 16y agoI shared the YT link directly, and it went to the wall.
- seiha 16y agoWell, at least this confirms that facebook does have the ability to filter out blacklisted URLS to the public friend feed.
- pohl 16y ago...and a willingness to censor within their walled garden. Maybe they had already shown that, but now I know.
- axod 16y agoLets have some proof rather than sheepish upvotes hrm?
- webspiderus 16y agoI had a URL about Prop 8 (http://en.wikipedia.org/wiki/California_Proposition_8_(2008))filtered http://en.wikipedia.org/wiki/California_Proposition_8_(2008)... out from facebook chat with a message that it was possibly 'offensive' about a year ago or so .. nothing new
- CWIZO 16y agoSome time ago I was unable to send a link via private messages to a friend, because the link was flagged as abusive/offensive. I didn't see anything wrong with the link, neither did my friend (once I got the link to him via email).
- nostrademons 16y ago
- qeorge 16y agoIt appears he gets access to not only their chat, but friend requests, notifications, and messages too. When he switches to Sian from Hayley, notice how all the indicators light up. Spying on PMs is even worse than live chat, in my opinion.
- robgough 16y agoCertainly seems to be fixed for me now though. The interesting question is how long has this "bug" been present - how long has my account been compromised for?
- henriklied 16y agoI used the `viewas` parameter a couple of days ago after changing some privacy settings, and this didn't happen.
- deleted 16y ago[deleted]
- bruceboughton 16y agoThis is the kind of feature I would be very nervous of implementing as a developer (showing some data in the context of another user)... to the point of pushing back on it. I imagine it cuts across whole swathes of code, requiring additional checks about the current user. It would be so easy to leave some of these checks out or mess them up. You would have to be very careful about validating your assumptions with this feature.
- MartinCron 16y agoThis is the kind of cross-cutting feature I've had to implement for clients, and yes, it's painful. I built an internal web application for a large and somewhat paranoid company that required three distinct layers of security. While I'm pretty sure I implemented them correctly, and could explain pretty well how they worked when pressed, I think it was just too much for most users to wrap their heads around the mental model. In retrospect, I should have pushed back. If I couldn't convince them to with a simpler model, I should have at least advocated for adding the layers of security incrementally, both to let the users understand what the model is and to help the development team understand what the model should be.
- julio_the_squid 16y agoWell, that's no problem! Several executives from large companies in the business of selling my private information have recently informed us all that privacy is over-rated, doesn't exist anymore and if you even want it to exist, you're wrong.
- jacquesm 16y agoWhat a waste to blow this right open. Think of the fun you could have had by friending all the people that trample our privacy with both feet and to publish their stuff a year from now or so. I'm pretty sure we'd see them wise up quickly when presented with a taste of their own dogfood. Missed opportunity!
- derwiki 16y agoWhile we're at it, let's hack all the computers of the kernel maintainers every time there's an exploit. Sorry for the sarcasm, but I really don't think exploiting software insecurities is the way to get anything productive done.
- invisible 16y agoI think you are missing the point on that one. Kernel maintainers are striving to produce a good product. Those that "trample privacy" are not out to produce anything except profits. Think about the hypocrisy that would be involved if they were offended by their chats being published if they push for similar data (others' data) to be public.
- jacquesm 16y agoEspecially if those chats documented their attitude towards their users.
- Locke1689 16y agoSo vigilante justice is morally defensible now? I'd like to hear about your complete ethical system.
- invisible 16y agoWhat piece of what I said made it defensible? I was merely explaining away the concept that it applies to engineers like it does for "privacy tramplers."
- 16y ago
- Todd 16y agoWhere's the "Like" button when I actually want it?!
- pageman 16y agofb chat is slow - I usually log in and then ask my friends to move over to YM or Skype - not a lot of chat logs for me ...
- janejordan 16y agoomg, how it is possible? but now it has been fixed by facebook developers. but really good finding http://welcome-to-croatia.com/accommodation-in-croatia/map-search http://welcome-to-croatia.com/accommodation-in-croatia/map-s...