Facebook fixes New Year's Eve message privacy flaw, report says
Facebook's "Midnight Delivery" feature lets users automatically send messages at the stroke of midnight on New Year's Eve. / Facebook
Facebook's New Year's Eve "Midnight Delivery" service reportedly went offline briefly on the cusp of its big night because of an apparent privacy flaw.
The social network's New Year's Eve message delivery service the lets users automatically send private messages to their friends at the stroke of midnight on Dec. 31.
According to The Next Web, a blogger named Jack Jenkins noticed a security loophole that let anyone with the confirmation URL string see people's private messages. For example, by typing in random numbers in place of the "Xs" below, a corresponding note appeared -- if the number was assigned.
"By simple manipulation of the ID at the end of the URL of a sent message on the Facebook Stories site, you are able to view other peoples Happy New Year messages," Jenkins wrote on his blog and posted screenshots of what appears to be other people's private messages.
Jenkins could not see who sent the note, but could see the intended recipients. While viewing the private messages, he claimed that he could also delete the greetings.
According to The Next Web, a Facebook spokesperson confirmed the privacy flaw and released this statement:
"We are working on a fix for this issue now, and in the interim we have disabled this app on the Facebook Stories site to ensure that no messages can be accessed."
The site was reportedly taken down briefly Monday and the security loophole apparently fixed.
Facebook did not immediately respond to CBS News' request for comment.
Popular in SciTech
- Calif. teen wins Intel Science Research competition Play Video
- One woman's journey to save the white lions
- New Flickr comes with 1 terabyte free storage
- Computer visionary says he knows who invented Bitcoin
- Apple's next iPhone may be coming in June
- Canada trying to lure Silicon Valley tech workers
- Four things you need to know about tornado season
- Thousands online proclaim: Jahar Tsarnaev is innocent