Canuck cracks Facebook to access private profiles
by Stevie Smith - Mar 28 2008, 11:08
Facebook security hole not quite closed claims Canadian computer engineer. Credit: Facebook.
A security hole thought to have been closed on Facebook appears to be lingering as an ongoing problem for the hugely popular social networking Web site.
Brought to Facebook’s attention in February, following the initial discovery by Vancouver resident and computer technician Byron Ng, the exploit in question allowed non-approved Facebook users to see private photographs posted on other people’s personal profile pages.
Typically, given the unending obsession with Hollywood celebrities, private pictures of perpetually-partying millionaire heiress Paris Hilton and one of her younger brothers were subsequently unearthed through the security hole.
According to Facebook, any such privacy breaches allowing outside access to personal content have since been closed, but that’s a claim that Mr. Ng has recently taken issue with.
Specifically, while the error would appear to have been fixed in the main, Mr. Ng says he -- and anyone else familiar with the glitch -- is still able to access private Facebook photo albums via their unique URL addresses.
“If you saved what you saw before you can still look at it,” he commented in a report published by the Vancouver Sun. “It’s just lazy programming, I guess.”
According to Mr. Ng, the exploit granted access through the ‘tagging’ system employed by Facebook users to assign certain descriptive words (names, events, etc.,) to posted images for convenient recall on a collective basis.
While there is obviously concern as to the potential privacy holes that glitches such as this one can create, Facebook does not offer any form of guarantee that personal content won’t be viewed by outside members of the service not pre-approved as friends by individual users.
“…we cannot and do not guarantee that User Content you post on the Site will not be viewed by unauthorized persons,” Facebook states in its user agreement. “We are not responsible for circumvention of any privacy settings or security measures contained on the Site.”
Comment on this Story