5 ms·

FB generates a different user id for each FB application id. "Facebook issues app-scoped user IDs for people who first log into an instance of an app, and page

FB generates a different user id for each FB application id. "Facebook issues app-scoped user IDs for people who first log into an instance of an app, and page-scoped user IDs for people who first use a Messenger bot. By definition, this means the ID for the same person may be different between these apps and bots." https://developers.facebook.com/docs/apps/for-business https://developers.facebook.com/docs/apps/for-business So the 10 billion number the researchers quoted does not necessarily represent individual users.

filleokus 7y ago
But since they only query facebook.com/$ID and facebook.com/profile.php?id=$ID, aren't they only looking at one and the same "ID space", and hence only counting once?
pkreissel 7y ago
Hi, this is actually incorrect. Facebook uses internal IDs (these are the ones used here, they are valid globally) AND external IDs for Apps and their connected pages. The external IDs have a completely different format and cannot be used to access a profile in the web browser (which is what we were able to do for all of them). We cannot completely rule out, that Facebook assigns two IDs to the same profile. However we think this is highly unlikely. We tried to check for that as far as possible. For example: If I search for a profiles name, that I found via a random ID lookup, and then check that profiles ID, its the same ID that was used in the lookup. We couldn't try this at scale though.
- rnd_dude428673 7y ago
  It's pretty simple to validate. Create two different FB developer accounts. Then create a Login with FB type app for each account. Then use a third FB account to login to each different app and use the FB Graph api to view the user id in the tokens. It will be different.
smashah 7y ago
What you're mentioning is actually a very recent change to Facebook API. So it doesn't relate to the work done in the presentation.
- rnd_dude428673 7y ago
  This FB ID strategy has been in place for at least 2-3 years.

filleokus 7y ago

But since they only query facebook.com/$ID and facebook.com/profile.php?id=$ID, aren't they only looking at one and the same "ID space", and hence only counting once?

pkreissel 7y ago

Hi, this is actually incorrect. Facebook uses internal IDs (these are the ones used here, they are valid globally) AND external IDs for Apps and their connected pages. The external IDs have a completely different format and cannot be used to access a profile in the web browser (which is what we were able to do for all of them). We cannot completely rule out, that Facebook assigns two IDs to the same profile. However we think this is highly unlikely. We tried to check for that as far as possible. For example: If I search for a profiles name, that I found via a random ID lookup, and then check that profiles ID, its the same ID that was used in the lookup. We couldn't try this at scale though.

rnd_dude428673 7y ago
It's pretty simple to validate. Create two different FB developer accounts. Then create a Login with FB type app for each account. Then use a third FB account to login to each different app and use the FB Graph api to view the user id in the tokens. It will be different.

smashah 7y ago

What you're mentioning is actually a very recent change to Facebook API. So it doesn't relate to the work done in the presentation.

rnd_dude428673 7y ago
This FB ID strategy has been in place for at least 2-3 years.