Facebook Might Have Leaked Your Private Photos

It’s been at least a few days since a new Facebook privacy scandal dropped, so we’re long overdue. According to a new posting tucked away on Facebook’s developer blog, the company introduced a bug into its photo API earlier this year that gave connected apps too much access to your pictures. Even if you never made a photo public, an app developer may have it.

We have seen a few social network API fails lately — most notable on Google’s now-doomed Google+ platform. However, those vulnerabilities just covered profile fields rather than your photos. The broken API is supposed to only grant access to photos shared to your timeline. Apps using the API from September 13 to September 25 could also see your photos from the Marketplace, Facebook Stories, and even photos you uploaded and chose not to share.

The API bug may have affected as many as 6.8 million users — anyone who connected around 1,500 different apps from 876 developers that accessed the photo API. Facebook offered a rather generic apology, saying, “We’re sorry this happened.”

Since this is the developer-oriented alert, Facebook discusses the next step in determining how much data leaked. Starting next week, it will roll out tools for developers to determine which of their users might have been affected and delete photos those apps may have incorrectly stored. That will give Facebook a better idea of how severe the leak was.

Facebook says it will notify users of the breach via an alert in their feed (see below). It will include information on the apps they’ve used that could have gotten private photos. At that point, they can check those apps to see if they contain photos that weren’t shared to the timeline.

The company claims to have notified Europe’s Office Of The Data Protection Commissioner (IDPC) of the breach as required by the wide-ranging GDPR rules implemented earlier this year. However, Facebook did not do so until Nov. 22nd. It discovered the breach on Sept. 25th, and the GDPR requires companies to notify the EU within 72 hours. Facebook says it didn’t know if the error would constitute a GDPR report until November, but that seems suspicious. The IDPC has started an inquiry that could result in a substantial fine for Facebook.

Facebook says the vulnerability is patched, so your private photos are again safe and sound. Further, the breach never impacted photos shared through Messenger or other Facebook services like Instagram and WhatsApp.

• Facebook Used Its VPN to Spy on Other Companies, Users
• No One Wants to Talk About How Completely We Were Lied to
• Shockingly, No One Trusts Facebook’s Portal Smart Displays

Continue reading