News for hackers. Stuff that matters.

A comment on Facebook privacy issue: Google search reveals email addresses in Facebook. Parent comment

Re:Facebook privacy issue: Google search reveals email addre... by volomike on Thursday June 03, 2010 @06:41PM (#1402854)
Oh that's just crazy. I just clicked that link but didn't click Confirm because ?u= is someone else's user ID.

What's sad is that because it's numeric, you can run down a whole list of IDs, opting people out or in.

So what's k stand for, crc32() or something like that on the u parameter?

[ Parent | on HN ]
Re:Facebook privacy issue: Google search reveals email addre... by bruceboughton on Friday June 04, 2010 @04:28AM (#1403814)
You should never expose internal incremental user ids in URLs like these. Have a combination of guids that links to the user id in your database.
[ Parent | on HN ]