4 ms·
Are we sure the security hole was limited to merely viewing your friends' live chats? Sure, the "review how your profile appears to another person" search box w
by quant18 16y ago
Are we sure the security hole was limited to merely viewing your friends' live chats? Sure, the "review how your profile appears to another person" search box will only give you your friends --- but you can change the "viewas" id manually.
Edit: I see someone in the Techcrunch comments section posted what he claims to be Mark Zuckerberg's pending friends requests - Ctrl+F for "Random Jo - May 5th, 2010 at 3:04 pm UTC" ...
- spulec 16y agoI can confirm that the security hole was not limited to only friends. I was able to insert non-friend's IDs for the "viewas" parameter.