25

This user asked an off-topic Facebook question that I'm sure will be deleted soon about Facebook privacy if she were to work for the government in the future. The user believes (wrongly) that her photos and wall posts are private. This is admittedly an issue between her and Facebook. However, Stack Overflow is exposing her Facebook user id to the public. People can take this, call http://graph.facebook.com/556966628, and then get a link to her profile, wall and photos that are completely wide open. It seems like Stack Overflow could and should do more to protect the Facebook user id instead of broadcasting it.

In fact, the Facebook Platform Policies, mention that user id's should be kept confidential. Specifically:

II 6. You will not directly or indirectly transfer any data you receive from us, including user data or Facebook User IDs, to (or use such data in connection with) any ad network, ad exchange, data broker, or other advertising or monetization related toolset, even if a user consents to such transfer or use.

(Stack Exchange is an ad platform. This is what I would call a gray area.)

Also:

II 7. You will not use Facebook User IDs for any purpose outside your application (e.g., your infrastructure, code, or services necessary to build and run your application). Facebook User IDs may be used with external services that you use to build and run your application, such as a web infrastructure service or a distributed computing platform, but only if those services are necessary to running your application and the service has a contractual obligation with you to keep Facebook User IDs confidential.

Somewhat more private solutions would be:

  • Download the Facebook image and re-upload it to imgur.com and then run a process every so often to keep them in sync if they change (although this may be against Facebook TOS)
  • Follow the 302 redirect that the graph api url gives and store that more private image url to display the image (and then run a process every so often to keep it in sync). This is compliant with the Facebook TOS.
Improve this question
7
  • meta.stackexchange.com/questions/103734/…
    – random Mod
    Commented Sep 27, 2011 at 1:58
  • 7
    How widespread a problem is this on SO (I'm not an avid follower of the Facebook tag)? I think the responsibility lies with the person asking the question to reveal as little of their personal info as possible. If, on a hypothetical site, I ask you for help in locating the expiration date on my credit card and I post up a screen shot of it, I believe that I would be the one liable for any damages, but IANAL.
    – jonsca
    Commented Sep 27, 2011 at 2:24
  • 5
    @jonsca No, the ID appears in the avatar URL of users, which comes from when you link your Facebook account to your SE profile. It wasn't actually posted in the question.
    – waiwai933
    Commented Sep 27, 2011 at 3:45
  • Okay, thanks for clarifying that point. Surely the fact that this information is released is in a TOS on one side or the other, though? I mean, I understand more is definitely at stake with pictures, private info, but there's nothing stopping you from going to my profile, getting my userID, and using the SE API to access my info. Does the Graph API expose the information even if it has been marked for privacy by the user in question?
    – jonsca
    Commented Sep 27, 2011 at 3:49
  • @jonsca Well, using the SE API reveals only stuff about your SE account, which doesn't reveal your Facebook account. What SE is doing here is (presumably accidentally) providing that info even though they shouldn't be (see the link random left to see how they get the avatar url). Once you know the avatar URL, malicious users can use the FB Graph API to get more data on you.
    – waiwai933
    Commented Sep 27, 2011 at 3:58
  • @waiwai933 I wasn't clear, I was using the SE API as an analogy, sorry. I would presume this avatar URL info is passed to any application that requests it, though, right? So if I link my FB site to to another website outside of SE, they could still get more information on me via the API. Sounds more like a vulnerability that FB needs to address more than SO, to be honest.
    – jonsca
    Commented Sep 27, 2011 at 4:03
  • Think of it this way--when you reveal personal information on the internets and have to go through all your stuff, changing passwords etc, then you have learned an important life lesson: Don't be stupid.
    – user1228
    Commented Sep 27, 2011 at 14:16

1 Answer 1

Reset to default
16

This is not an issue since the UIDs are being used within the app. The policy was created to prevent an app from passing the UID to an ad network, ad exchange, data broker, etc. without user consent.

Improve this answer
3
  • 1
    Thanks Cat! I was wondering the same about privacy of Facebook ID's for my own site.
    – bkaid
    Commented Sep 28, 2011 at 4:52
  • 1
    TIL Cat Lee works at Facebook, +1.
    – Kermit
    Commented Jan 13, 2014 at 14:37
  • 2
    This only responds to part of the question, and doesn't address the rest of the question, e.g., the part "Stack Overflow could and should do more to protect the Facebook user id". Just because Facebook doesn't prohibit it doesn't mean it's not an issue. Stack Overflow could go above and beyond Facebook's requirements, in protecting users' privacy.
    – D.W.
    Commented Apr 30, 2015 at 6:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .