Facebook caught exposing millions of user credentials

Source: The Register

Facebook has leaked access to millions of users' photographs, profiles and other personal information because of a years-old bug that overrides individual privacy settings, researchers from Symantec said.

The flaw, which the researchers estimate has affected hundreds of thousands of applications, exposed user access tokens to advertisers and others. The tokens serve as a spare set of keys that Facebook apps use to perform certain actions on behalf of the user, such as posting messages to a Facebook wall or sending RSVP replies to invitations. For years, many apps that rely on an older form of user authentication turned over these keys to third parties, giving them the ability to access information users specifically designated as off limits.

The Symantec researchers said Facebook has fixed the underlying bug, but they warned that tokens already exposed may still be widely accessible.

...

As indicated above, all previously issued access tokens can be cleared by changing your Facebook password. Readers who aren't sure if they're affected might want to err on the side of security and update their password now.


Read more: http://www.theregister.co.uk/2011/05/10/facebook_user_credentials_leaked/

:spray:

EVER...

I mean, can't you pick up the darn phone if your long lost 8th grade classmate is that important to you?
I don't get it.

Sub-thread removed by moderator. Click here to review the message board rules.

:shrug:

they are so long lost ... beat me for using facebook.

Or do they think they're too hip to inherit the fruits of their actions? Feh.

That's why people who do bad things never have nice and easy lives. They never get to live in the lap of luxury until they die.

The people you refer to are the ones who dig themselves in deeper. It all comes out in the wash even if we don't see it, my friend, though I know that may be small comfort.

Or is it already? I don't do social networking.....at all.

Political opponents.

That was part of the HBGary/Anonymous brouhaha.

Prospective new tenants.

I'm sure there are other categories.

why do any of you idiots use facebook?!?! No one has ever given me a decent answer other than something like, "I'm too damn lazy to actually coordinate my life in a way that doesn't involve being spied on".

Does anyone still have any illusions that anything that gets posted on Facebook is private?
I should hope not.

Facebook is so un-private that its actually pretty good for stuff you want to tell the whole world.

Some people in Egypt found it rather useful earlier this year.

Pretty sad when you think about it. Certainly more sad than someone using it.

Who's going to be feeling sad when their supposedly private information is used for nefarious purposes?

I think I'll survive if someone wants to use my like of black metal music videos and Demotivational posters against me. Is there anyone who really thinks what they put on FB is private anyways? No one I know on there thinks this.

These days, I'd be more worried about what I post on DU than what I put on Facebook.

Props for using the word nefarious though.

because there have been numerous breaches of privacy by facebook, and new ones are obviously still newsworthy to most. If none of them bother you, more power to you, but for those who it does bother, I don't mind calling them idiots, because they keep doing the same thing (using facebook) and expecting a different result (not having their private information exposed).

"Private" on the internet... that's funny.

I use it solely for political purposes. I post snippets of articles and links to the articles. Those then get shared with an ever expanding network of people.

I don't use my real name. I don't post anything personal -- not so much as a picture of my dogs gets posted.

What I am able to do is share progressive and action-oriented news with people who are busy and don't read as much as I do. It's a good way to keep people informed. I have even succeeded in getting two really poorly informed people -- potential teabaggers -- to see the light.

How about losing the smug insults -- no matter how people use FB, there is no reason to call them idiots.

As for being spied on, if you don't have the common sense not to enter in something that probably shouldn't be online, you'll have that problem on Facebook and elsewhere. There's jerks all over the internet right now, what needs to be done is to figure a way to track problems back to the source and end it there. If the government could ticket virus spreaders and hackers like they do speeders, the information highway would be a lot safer. I'm just tired of logging into a site, then picking up a cookie that redirects my browser away from Google or any other site.
That problem needs to be fixed NOW.

but I want to know how they're doing.

If you're careful, it's not possible for anyone to identify you by your Facebook page unless they already know you. Facebook has fuckall information about me. Even my birthday is a lie. The email address they have for me was set up just to make that account. I registered a $15 throwaway phone as a phone number. Then I threw it away. Let them share all of my fake data they like, for all the good it'll do them. Now taking bids on an unknown guy's nickname from when he was in middle school two decades ago! I suppose someone could track me by my ip addresses, but if they're going to go to that much trouble, there are other ways to go about it.

Yes, facebook is an evil company, damn near all of them are, but that isn't the big problem. One of the big problems is the large segment of the population that doesn't seem to have any concept of privacy. (Be it privacy with pictures they really shouldn't be posting anywhere that they could be found by anyone, or privacy about personal data that could be a problem if it gets out.) If they learned how to protect themselves, and more importantly why they should protect themselves, no amount of evil by facebook would be a problem at all.

The other big problem is how prevalent information selling is: Do you use a bank? They sell your information. Have a phone? They sell it too. Credit card? They're selling it too. Bought a car? You have to sign six different forms authorizing them to sell your information. Use any rewards programs? Those are pretty much designed to gather information to sell. Some of those are also tracking your purchases and selling that too. Those are WAY more of a problem than facebook, because you can't lie to them. (Well, you can, but it's illegal.) At this point I'm waiting for some broke state to declare they're going to make some fast cash by selling the information on all their voters and taxpayers.

The attitude that would prevent someone using facebook at all because they suck on privacy issues ends with living in a shack in the woods with no electricity or running water and a deed in someone else's name. It's more important to learn how to protect information and what information to protect than it is to point out one group of wankers from a crowd and say "Them! They're the bad guys!".

Edited to add: Wow, that came out way longer than I meant it to.

Not sure why you did, when you seem so savvy about facebook usage otherwise.

And I'm sure you are aware, by no means do you ever give them your mailing address, not even a P.O. You don't even have to list your city. However, there are ways of finding out the IP address where you post from, if someone really wants to know. But I don't really care about that because...nobody else cares that much!

I never use facebook from a smart phone, which helps a lot in the privacy dept.

I gave them a fake year of birth, but I show my correct month and day, but to friends only.

I ignore family members' requests to list me as their relative. They'll still be family, even after I ignore their "family" requests. :-)

Most of the information gathering on facebook is for marketing purposes. How do we, as corporate capitalists, get this person to fork over their money to us? So think about that when being tempted to "like" The Olive Garden, or "like" Cheetos.

Thanks for reminding me about facebook settings. :hi: On my to-do list, tonight:

1. Change the privacy setting of a wedding album to friends only, instead of visible to friends-of-friends. I only did that so that relevant people I knew peripherally could see the wedding photos. But now, since the bride has "stolen" (LOL!) all the photos I took at her wedding and posted them on her own facebook, it's safe to tighten the settings.

2. Make my list of facebook friends visible to friends-of-friends, only. There is no reason to keep it open to everyone.

Especially folks who live thousands of miles away. I like being able to chat with my former roommate who lives in Asia, or other school friends who I never thought I'd catch up with after YEARS being out of touch. I have gained much more than I have lost by signing up. I resisted FB for a long time. When I signed up originally I used an alias (I do use my actual name now), with my junk email. They don't have my street addy or phone number. My birthday is hidden. I don't "like" commercial/business stuff unless operated by someone I know etc. I think my info page has my hometown and the school I graduated from only because I specifically wanted to find those people. There is no other info for anyone to take or sell. I suppose a dedicated stalker could work some details out, but it would be minimal. My photos are scenic shots mostly, and friends only. I don't friend random people. It is pretty simple to stay out of trouble. Privacy is hard to come by these days in any case, as you pointed out.

This probably includes a lot of the people you keep in contact with. I absolutely agree that the big problem is the huge segment of society that have no idea what privacy is, or why they should care. What is most surprising to me about that, is that with facebook, it's basically just made to harvest "private" information.

As for other exploiters of information, I rarely use credit cards (bills paid with direct debit, and most other things paid with cash), my phone is without a contract, and a sure don't have a car. I especially don't use any sort of "rewards" program, because I think overcharging people who refuse to be part of market research is fucked up - I try to not even go anywhere that does that sort of thing. Regardless, what's different between these things and facebook is that facebook doesn't just gather the information you allow them, but also lots of information you've supposedly not allowed them to gather, and in this case, exposed it to third parties as well.

I don't think I'm bound to wind up living in a shack in the woods, but if I do, I'll send you a smoke signal announcing defeat. I just think that's a defeatist attitude. We have the technology and resources to have these exact sorts of resources available tomorrow, sans exploitation and spying, but we'll never get them if no one demands it.

"but we'll never get them if no one demands it..."

Or if our best solution is merely to call people 'idiots' either, I would hazard. Both avenues seem lacking at best... :shrug:

sharing anyway....

sorry it bothers you so much that some of use enjoy watching the videos posted by others, sharing news stories (gosh, like DU!), starting groups of people who have the same interests, re-connecting with old friends...

so i ask again, why do any of you idiots who DON'T use facebook give a flying fuck about those who do?

about DU sharing your private information with third parties? As soon as I do, I'll stop using this website.

"so i ask again, why do any of you idiots who DON'T use facebook give a flying fuck about those who do?"

NO website is "safe" whether they intentionally give out your info or not :rofl:

I care because it's a very popular website, especially for people who grew up with the internet. I think complacency about these sorts of lapses in securing privacy in the online sphere will/does translate into complacency about breaches of privacy in general. Just giving up and saying, "no website is safe, so why care if they're unsafe?" is not a formula for inspiring anyone to work towards making online - especially personal - information secure.

continue to harass me?

All those bland photos of my family standing around with cake on paper plates in hand.

Shit! My goose is cooked.

http://www.youtube.com/watch?v=ZMWz3G_gPhU">Do You Have A Facebook?

And so why has Mark Zuckersweatshirt been rewarded with untold wealth and public acclaim when all he really did was sell a bunch of lame people out to Big Brother, while at the same time encouraging them to compete in a totally lame popularity contest? I don't mean to be cruel, but most of the people who embrace Facebook deserve exactly what has happened to them. BTW, has anyone noticed how Yahoo has now integrated their social networking games into the business relationships of their customers? It is all a part of Yahoo doing the same thing. Anything that has anything to do with any part of Yahoo is now tied in to, and is available to, every part of Yahoo that exists. There is no longer any personal information, and the word privacy is a total joke. Big Brother now knows everything about you, while at the same time, people have been transformed into 'droids who exist purely for the benefit of government agencies and profit minded corporations. But what I just cannot fathom is why are you people applauding and rewarding the nefarious predators who are doing this to you?

Lord knows my friends don't. :P

And how do you know what it is and what it does if you don't use it? I've found out things politically through there before I found out about them here. I've found out things that I've yet to see here, even though DU is on top of liberal issues. Is that a bad thing? Is that being a "waste of time life suck"?

Hey, if it's not for you it's not for you, and that's totally cool, but bashing it is just a trendy thing now, and the people doing so seem to know little to nothing about Facebook. I've gotten in touch with people I knew 20-30 years ago that I never would have been able to talk to ever again otherwise. How is reconnecting with old friends a life suck any more than commenting on a DU thread about Facebook is for you? ;)

Including that it is a powerful data mining tool for the CIA and other groups. Thanks for insinuating that I don't have a rationale for my dislike for it, or that I need your permission to think it's "totally 'cool'" that I hate its breathing guts, or that I believe people who spend their time there are naive, boundary challenged sheeple. I'm glad I have your approval. I'll sleep better at night.

I know all I need to know about it, thank you.

You're welcome.

Including that it is a powerful data mining tool for the CIA and other groups

You're right. You probably shouldn't talk about bombing things on Facebook. Probably shouldn't do it on DU either. And like the whole damn internet isn't a mining tool for the CIA. On the other hand, if the CIA is interested in my choice of music then more power to them. Maybe they have the pull to get my favorite band to play in Boston again.

Thanks for insinuating that I don't have a rationale for my dislike for it

Well, your comment didn't give a lot to go by now, did it?

or that I need your permission to think it's "totally 'cool'"

Like I told you what to think. Pretty fragile reading of my post lol.

that I hate its breathing guts

Because the phrase "So glad I don't use that waste of time life suck" just oozes love for it. Duh.

or that I believe people who spend their time there are naive, boundary challenged sheeple

How anyone could draw that conclusion from your eloquent post is amazing. I prostrate myself before you and beg for forgiveness. Anyone with a brain should know that the term "So glad I don't use that waste of time life suck" indicates that you think highly of the people using said waste of time life suck....

I'm glad I have your approval.

Don't jump the gun lol.

I'll sleep better at night.

More's the pity. You could be here on DU imparting wisdom to the rest of us.

You know, the obnoxious shit that clutters my "notifications" anytime I'm foolish enough to venture over there.

I don't hate Facebook, but I don't get the attraction. The way they collect and use people's personal information (whether willingly provided or not) does kind of give me the creeps.

is concerned, I don't hide much, but I have put many photos which I get worried about. I'm not sure they're the OMG type best, but I always worry about unscrupulous people copying them and passing them off as their own. I've had that happen to me once, almost twice, in which I caught someone taking off my copyright mark.

I've been online now about 22 years, and have otherwise rarely had any sort of incident. I have little to hide, and I'm not exactly a good candidate for identity theft!

But this is a bit disturbing--there are many people out there who are quite demented, and who knows what they're capable of?

Which is a good rule of thumb for any such website.

To judge from the targeted ads that show up when I go there, it's clear that Facebook thinks that I'm a right-wing Mormon dittohead living in or near Salt Lake City. I don't know where they got that idea, but it's fine with me.

then I consider it a bullet dodged by me.