Facebook caught exposing millions of user credentials

[DorsetBoy]

 App bug overrides user privacy settings

Facebook has leaked access to millions of users' photographs, profiles and other personal information because of a years-old bug that overrides individual privacy settings, researchers from Symantec said.

The flaw, which the researchers estimate has affected hundreds of thousands of applications, exposed user access tokens to advertisers and others. The tokens serve as a spare set of keys that Facebook apps use to perform certain actions on behalf of the user, such as posting messages to a Facebook wall or sending RSVP replies to invitations. For years, many apps that rely on an older form of user authentication turned over these keys to third parties, giving them the ability to access information users specifically designated as off limits.

The Symantec researchers said Facebook has fixed the underlying bug, but they warned that tokens already exposed may still be widely accessible..... (more)

[Rik]

Another reason not to like the thing.

[Simon]

Oops!

[Rik]

That's being kind. 

[Glenn]

Don't run Facebook on an Apple, or you could have a Flasher Mac 

[Rik]

[Gary]

Facebook deny it of course, but just changing the password sorts the issue, and its apps that caused it, if you dont use them, you were fine. Not a reason to not like it, but another reason to use your brain a bit, changing passwords often helps anyway, I use 1Password for the Mac, great thing to have.

[Simon]