News for hackers. Stuff that matters.

A comment on Facebook security hole allows viewing of private photos. Parent comment

Re:Facebook security hole allows viewing of private photos by judofyr on Tuesday December 06, 2011 @08:02AM (#3319084)
I doubt that's way this happened. More likely, the person who implemented the "inappropriate photo"-feature wasn't fully aware of that the "Report"-functionally was enabled for everyone and not just your friends.

However, someone had to implement the backend for listing out those photos, and they clearly didn't think of access control, so there's at least something fishy here…

[ Parent | on HN ]
Re:Facebook security hole allows viewing of private photos by rplnt on Tuesday December 06, 2011 @08:41AM (#3319194)
It's not the first time either. Very similar breach of privacy happened when they implemented "view my profile as ..." functionality. You gained access to the private data of the user you were simulating.
[ Parent | on HN ]