What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 131 Stack Exchange communities.

This user asked an off-topic Facebook question that I'm sure will be deleted soon about Facebook privacy if she were to work for the government in the future. The user believes (wrongly) that her photos and wall posts are private. This is admittedly an issue between her and Facebook. However, Stack Overflow is exposing her Facebook user id to the public. People can take this, call http://graph.facebook.com/556966628, and then get a link to her profile, wall and photos that are completely wide open. It seems like Stack Overflow could and should do more to protect the Facebook user id instead of broadcasting it.

In fact, the Facebook Platform Policies, mention that user id's should be kept confidential. Specifically:

II 6. You will not directly or indirectly transfer any data you receive from us, including user data or Facebook User IDs, to (or use such data in connection with) any ad network, ad exchange, data broker, or other advertising or monetization related toolset, even if a user consents to such transfer or use.

(Stack Exchange is an ad platform. This is what I would call a gray area.)

Also:

II 7. You will not use Facebook User IDs for any purpose outside your application (e.g., your infrastructure, code, or services necessary to build and run your application). Facebook User IDs may be used with external services that you use to build and run your application, such as a web infrastructure service or a distributed computing platform, but only if those services are necessary to running your application and the service has a contractual obligation with you to keep Facebook User IDs confidential.

Somewhat more private solutions would be:

  • Download the Facebook image and re-upload it to imgur.com and then run a process every so often to keep them in sync if they change (although this may be against Facebook TOS)
  • Follow the 302 redirect that the graph api url gives and store that more private image url to display the image (and then run a process every so often to keep it in sync). This is compliant with the Facebook TOS.
share|improve this question
    
7  
How widespread a problem is this on SO (I'm not an avid follower of the Facebook tag)? I think the responsibility lies with the person asking the question to reveal as little of their personal info as possible. If, on a hypothetical site, I ask you for help in locating the expiration date on my credit card and I post up a screen shot of it, I believe that I would be the one liable for any damages, but IANAL. –  jonsca Sep 27 '11 at 2:24
5  
@jonsca No, the ID appears in the avatar URL of users, which comes from when you link your Facebook account to your SE profile. It wasn't actually posted in the question. –  waiwai933 Sep 27 '11 at 3:45
    
Okay, thanks for clarifying that point. Surely the fact that this information is released is in a TOS on one side or the other, though? I mean, I understand more is definitely at stake with pictures, private info, but there's nothing stopping you from going to my profile, getting my userID, and using the SE API to access my info. Does the Graph API expose the information even if it has been marked for privacy by the user in question? –  jonsca Sep 27 '11 at 3:49
    
@jonsca Well, using the SE API reveals only stuff about your SE account, which doesn't reveal your Facebook account. What SE is doing here is (presumably accidentally) providing that info even though they shouldn't be (see the link random left to see how they get the avatar url). Once you know the avatar URL, malicious users can use the FB Graph API to get more data on you. –  waiwai933 Sep 27 '11 at 3:58
    
@waiwai933 I wasn't clear, I was using the SE API as an analogy, sorry. I would presume this avatar URL info is passed to any application that requests it, though, right? So if I link my FB site to to another website outside of SE, they could still get more information on me via the API. Sounds more like a vulnerability that FB needs to address more than SO, to be honest. –  jonsca Sep 27 '11 at 4:03
    
Think of it this way--when you reveal personal information on the internets and have to go through all your stuff, changing passwords etc, then you have learned an important life lesson: Don't be stupid. –  Won't Sep 27 '11 at 14:16

1 Answer 1

up vote 10 down vote accepted

This is not an issue since the UIDs are being used within the app. The policy was created to prevent an app from passing the UID to an ad network, ad exchange, data broker, etc. without user consent.

share|improve this answer
    
thanks for the official response Cat! –  Jeff Atwood Sep 28 '11 at 3:46
    
Thanks Cat! I was wondering the same about privacy of Facebook ID's for my own site. –  bkaid Sep 28 '11 at 4:52
    
TIL Cat Lee works at Facebook, +1. –  Kermit Jan 13 at 14:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .