Slashdot Mirror
Facebook Developers Can See Private Links Shared Through Messenger (theverge.com)
Earlier this week, security researchers at Checkpoint reported about vulnerabilities in Facebook Chat and Messenger that, if exploited, could allow anyone to essentially take control of any message sent by Chat or Messenger. Now a developer named Inti De Ceukelaire is pointing out another flaw in how Facebook deals with URLs. The Verge reports: Through the right API call, De Ceukelaire was able to summon links shared by specific users in private messages. The links were collected by the Facebook crawler, where De Ceukelaire discovered they were easily accessible to anyone running a Facebook app. Those links could be anything from a popular news story to directions to an abortion clinic. As long as they're shared in private messages, they're logged in Facebook's database, and accessible to API calls. It would be hard to exploit that bug at scale for a few different reasons. De Ceukelaire was only able to make the API call because he's registered as a Facebook developer, and if he started pulling those links en masse, Facebook would quickly catch on and pull his credentials. Still, the bug points to a number of lingering problems with the conflicting way web services treat URLs, and how those conflicts can put private information into public view.
I can only hope they can!
This just in... sending unencrypted messages through a third party service means random joes at that company have a pretty good chance of reading your "private" conversations.
You can either encrypt everything, use other providers that you haven't learned how evil they are yet, or just deal with it. Privacy died 150 years ago at least.
The place I work at, we mine private FB chats. I've since told some of my friends. Definitely do not share any URLs you want kept private via FB messages.
If you're over the age of 8 and you still like Star Wars you're probably a dick smoking faggot.
This should be patently obvious to anyone posting here.
The app appers at Facebook are using APPS to app apps that app appers are apping, so this is all perfectly appy! It's only when LUDDITES use LUDDITE email that it's bad and wrong.
Apps!
How many times do you need to be screwed before you get it?
It doesn't have to be like this. All we need to do is make sure we keep talking.
Unless there is a user encryption, pretty much anything you enter in an application anywhere is at the mercy of what the developer wants. Only the requirements force the developper into making system where even themselves cannot peak (because it is good practice , like salted encrypted password, or because of regulation or....). Any messenger which do not advertise end to end encryption with key not guessable/no backdoor, can read everything you do including links.
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org
Any developer. I.e. anyone (literally, last I cared to check) can register as a "Developer" via the website (for free), create an app and use it to abuse other people's privacy.
Makes sense!
If you do want to keep links private, there are services which let you share URLS by sticking them behind another url which only works once, and/or needs a password etc.
Why are people complaining that something which is sent over an unencrypted channel is visible to people other than the intended recipient? Even facebook provides a solution for that; whatsapp.
pristifurtuologopongoftyapp your evil odor by forces loyal to Saddam Hussein in K-Mart!!!!!!!
UNITE with the Campaign for a Free Internet because today, our future begins with tomorrow!
Even if you do NOT submit a message, FB knows what you typed, even if you HOVER over a link, they know what you hovered over.
Don't believe me?
Perform these actions and watch your COOKIE's go NUTS.
I also recommend you decompile your Android FB app and see what the generated code is. I already did.
They can probably see the links shared in private but they should have acces so they can change things.