Facebook denies privacy breach allegations by Symantec
No personal data could have been passed to third parties, company says
Computerworld - Facebook today denied that it may have accidentally exposed personal user data to advertisers and other third parties for several years, as claimed this week by two security researchers at Symantec Corp.
The researchers in a blog post Tuesday noted that a Facebook programming error -- since fixed -- could have allowed advertisers to access member profiles, photographs and chat messages and to post messages and mine personal data from them.
According to Symantec, the leaks stemmed from a faulty API used by developers of Facebook applications. It caused "hundreds of thousands" of Facebook applications to accidentally expose the so-called access tokens that are granted by users to Facebook applications. "Each token or 'spare key' is associated with a select set of permissions, like reading your wall, accessing your friend's profile, posting to your wall, etc.," the researchers said.
Any third party or advertiser associated with an application developer that had used the faulty API would have had access to the tokens, allowing them to perform whatever actions the tokens allowed. While it's unclear how many advertisers even knew what was going on, the potential repercussions of the data leaks are "far and wide," Symantec claimed.
But Facebook downplayed the issue and argued that Symantec's report has a "few inaccuracies."
"We appreciate Symantec raising this issue and we worked with them to address it immediately," Facebook spokeswoman Malorie Lucich said in an emailed comment. But, "specifically, no private information could have been passed to third parties, and the vast majority of tokens expire within two hours," she said.
"The report also ignores the contractual obligations of advertisers and developers, which prohibit them from obtaining or sharing user information in a way that violates our policies," Lucich said.
She added that Facebook has no evidence of information being used in a way that violates company policies. "We take any potential issue seriously and quickly took steps to prevent this from happening again."
- 3 privacy violations you shouldn't worry about
- U.S. commercial drone industry struggles to take off
- Snowden leaks erode trust in Internet companies, government
- NSA phone metadata collection program renewed for 90 days
- NSA isn't evil, says noted civil libertarian
- Franken presses Ford on location data collection practices
- Justices let stand appeals court decision on border searches of laptops
- California lawmakers move to bar state help to NSA
- Appeals court again nixes Google's bid to overturn Street View case
- Older Mac webcams can spy without activating warning light
- Path Selection Infographic Path Selection Infographic
- Hyperconvergence Infographic A wide range of observers agree that data centers are now entering an era of "hyperconvergence" that will raise network traffic levels faster...
- Preparing Your Infrastructure for the Hyperconvergence Era From cloud computing and virtualization to mobility and unified communications, an array of innovative technologies is transforming today's data centers.
- How WAN Optimization Helps Enterprises Reduce Costs If you wanted to break down innovation into a tidy equation, it might go something like this: Technology + Connectivity = Productivity. Productivity...
- Data Protection and Disaster Recovery with iSCSI and VMware Get this on demand webcast now
- Cloud Knowledge Vault Learn how your organization can benefit from the scalability, flexibility, and performance that the cloud offers through the short videos and other resources... All Privacy White Papers | Webcasts
Our new weekly Consumerization of IT newsletter covers a wide range of trends including BYOD, smartphones, tablets, MDM, cloud, social and what it all means for IT. Subscribe now and stay up to date!