 |
Facebook: released new Graph API last Friday. Photograph: Linda Nylind |
Some people report that they are able to see the public "events" that Facebook users have said they will attend – even if they person is not a "friend" on the social network.
The discovery was made by Ka-Ping Yee, a software engineer for the charitable arm of Google, who was trying out the search query system known as the "Graph API" released by Facebook last Friday. In some cases – though not all – it will let you see the public events that people have said they will attend, or have attended.
Yee demonstrated the flaw by showing how the API – which plugs directly into Facebook's databases – can show you a list of Facebook founder Mark Zuckerberg's planned public events.
Yee says that he was very disturbed by the discovery – because there seemed to be no way to prevent the events from appearing on the API, which is publicly accessible, except by saying you were "not attending" an event.
"It seemed that anyone could get this list. Today, I spent a while checking to make sure I wasn't crazy," he wrote on his blog. "I didn't opt in for this. I even tried setting all my privacy settings for maximum privacy. But Facebook is still exposing the list of events I've attended, and maybe your event."
The discovery will intensify the debate over Facebook's new system – which has drawn complaints that it makes it far too difficult to keep personal information private.
The implications of being able to find out the movements of any of the 400m people on Facebook are potentially wide-ranging – although the flaw does not seem to apply to every user, or every event. Yee says that the simplest way to prevent your name appearing in such lists is to put "not attending" against any event you are invited to.
"This kind of event list is not even accessible to your friends on Facebook," noted Yee. "As far as I can tell, there is no way to turn this off with your own privacy settings."
The problem mirrors that which Google ran into when it created its new Buzz systems, which aimed to create a Twitter-like social network – but annoyed people because it assumed that anyone with whom you had exchanged email would want to be part of your network. But the example of a wife who wanted to stay away from her abusive husband – but with whom she had once swapped an email – showed that Buzz had a flawed approach to privacy.
Similarly the Facebook API system may turn out to be crucially flawed. "What can your event list say about you? Quite a bit," wrote Yee. "It might reveal your home address, your friends' home addresses, the names and groups of people you associate with, your hobbies, or your political or religious activities, for example. "
However some people who have tried Yee's method of accessing the site were not able to repeat widespread invasion of privacy – though Zuckerberg's calendar was discoverable by everyone. The accessibility seemed to be semi-random: despite Yee's best efforts, a list of events still shows up for him.
Although the system only reveals data about "open" events – which by definition are public already – the new system changes the game radically. "There's a big difference between publishing an event page with a list of people attending, and publishing a list of events that you attended. Before last Wednesday, to find out which events you attended, I'd have to visit every single event page on Facebook and look for your name among the people attending. Now, I can just ask the API what you've been doing, and it will tell me. This kind of event list is not even accessible to your friends on the Facebook website; I haven't found any page at http://facebook.com/ that lets me list a friend's events. The API provides this list to anyone, so this is newly exposed information."
source : http://www.guardian.co.uk/technology/2010/apr/26/facebook-privacy-hole