3 ms·
Among other interesting things, this was initially sold as an attack that enabled 'View As' for attackers who shouldn't have had access to it. It's been describ
by Bartweiss 8y ago
Among other interesting things, this was initially sold as an attack that enabled 'View As' for attackers who shouldn't have had access to it. It's been described like another issue in the same vein as Cambridge Analytica and Google+.
I don't doubt that setting was involved, but it's obvious by now that this wasn't equivalent to the others - there's no "View As" which will show you someone's search and location history. This isn't just a public/private breakdown but an actual breach of Facebook's internal-only data, and unlike the prior stories this ought to seriously challenge people's reliance on features like Facebook-based app sign-ins.
- fcarraldo 8y agoI’m not sure this is entirely true. The hack was reported to have exploited a flaw in the View As feature to retrieve user access tokens. With an access token, a user can view their own location history. This isn’t internal-only data, but it is supposed to be private to the user.
- iodiniemetra 8y ago> there's no "View As" which will show you someone's search and location history Not in the UI, no. But once you have the token, which is what this was, then you can request that from many of the UI API interfaces facebook provides. When this first leaked, anyone who worked with auth systems immediately assumed it was a game over scenario.
- Bartweiss 8y agoInteresting, thanks. I had only followed general-consumption reports here, and hadn't seen that the attack involved obtaining a token that allowed the attacker to authenticate as the user, and I didn't realize that the API included support for pulling search history data. Given that, I understand much better why this was a disaster from the beginning, and why people are so mistrustful of the rolling "and also this..." disclosures.