Feeds

Facebook bug dishes out notes designated private

Company reps keep the flaw secret

Protecting users from Firesheep and other Sidejacking attacks with SSL

Facebook users who type sensitive information into a site feature known as Notes may be interested in knowing that it is currently experiencing a bug that allows documents designated as private to be read anyway.

A Facebook customer service representative privately confirmed the bug to a user who complained that notes he configured to be private were anything but. That was on Friday. Four days later, the site has yet to issue any public notification of the flaw.

"We hope to resolve this note privacy settings bug that you described as soon as possible," a rep by the name of Pam wrote. "I would suggest that you contact us in several days if this problem has not been fixed."

This isn't the first time Facebook has failed to make good on promises to keep user information private. In June, a researcher disclosed a Facebook hole that publicly revealed a user's political views, religious back ground and other sensitive details even when a profile was configured so it was viewable only to designated friends.

Facebook added a blog-like feature called Notes in August 2006. Notes can be tagged with the names of other Facebook users so they automatically receive a copy. Facebook also provides a means that's supposed to keep them private.

"Does this mean you already knew about this problem but have continued to let people use notes without any warning?" the Facebook user wrote in response to Pam's email. "Is this solely related to notes or does this affect other parts of facebook/apps?"

Excellent questions. But unfortunately, Pam didn't answer. Several hours after this story was published, a Facebook spokeswoman emailed to say the problem was the result of the user setting up conflicting privacy settings.

"To clarify, this is not a bug," she wrote. "This user most likely set their Notes privacy settings to 'Only Me,' however, they include Notes on their Limited Profile. Therefore, the people on their Limited Profile list can see their notes." ®

The next step in data security

More from The Register

next story
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.