How Easy It Was For Mashable To Hack Into Mark Zuckerberg's Private Friend List
There are some things on Facebook you just can't hide — and it appears Zuckerberg's list of friends is among them.
By Sadho Ram — 10 Jun 2014, 05:10 PM — Updated over 10 years ago
Facebook users think that when they set their Friend List privacy to "Only Me," it means that they are the only ones who can see it. However, there's a loophole and anyone can take advantage of it.
You can set your Facebook friends list visibility to Only Me although others can still see your mutual connections.
Image via mshcdn.comThe loophole comes in the shape of Facebook's mutual friends feature. Any user can see the mutual friends between any two other users, so long as one of them has a publicly available friends list. So if you keep your friends list private, but your best friend doesn't, a third party could compare your two lists, and voilà — they'd be able to see all the friends the two of you have in common.
mashable.com
This feature has been in place at Facebook for some time but Facebook doesn't see it as a problem, and warns users that the privacy of their Friend List is actually dependent on the privacy settings of their connections
Facebook alerts users of this on the friend list privacy settings screen, but you may not notice unless you pay special attention. The warning reads: Remember: Your friends control who can see their friendships on their own timelines. If people can see your friendship on another timeline, they'll be able to see it in news feed, search and other places on Facebook. They'll also be able to see mutual friends on your timeline.
So, to show how much of a problem this loophole can be, CyberInt, an online security group, built a program intended to exploit the feature and reconstruct private Friend List of - Mark Zuckerberg
CyberInt, a group focused on information security and cyber warfare, demonstrated how a hacker (or really anyone with time on their hands) could take advantage of this privacy issue to piece together a user's entire friends list. You are able to view the mutual friends of any two users on Facebook, so long as one of the two users shares his friends list publicly.
mashable.com
The mutual friends tool is a byproduct of the company's mission to connect the whole world on the platform; the company believes it helps to see which friends you share with other users. But it doesn't afford users as much privacy as they might think they have. To prove that, we put the mutual friends feature to the test with the most famous Facebook user of all: founder and CEO Mark Zuckerberg.
Zuckerberg keeps his friends list private, but he is also friends with longtime Facebook employee and head of product Chris Cox, whose friends list is public.
valuewalk.com
How exactly did CyberInt and Mashable do it?
By using the URL template below and inserting the respective user names into the brackets, you can see the mutual friends between the two users, even if you are not friends with either person. https://www.facebook.com/profile.name[Hidden Friends Profile]/friends?and=second.profile[Public Friends Profile]
mashable.com
We tested this URL with Zuckerberg and Cox, and found 248 mutual friends. In other words, we identified 248 of Zuckerberg's Facebook friends, even though he is keeping his friends list private. And thanks to that fact (and further friends list comparisons) we were able to see more than 400 of Zuckerberg's Facebook friends.
By using the 248 mutual friends as a foundation, a user could compare Zuckerberg's friends list to any of these 248 that share their list publicly. It may not return every Facebook friend Zuckerberg has, but it's highly likely your knowledge of his friends list would grow dramatically using this system.
mashable.com
Not surprisingly, Zuckerberg is friends with many of Silicon Valley's most prominent tech icons, including dozens of CEOs and VCs and fellow billionaires
It definitely doesn't come as a shock to see Facebook board members like Marc Andreessen and Don Graham, and early employees such as Napster co-founder and former Facebook president Sean Parker, on the list.
mashable.com
But there were also surprises. Included amongst Zuckerberg's list of friends: Robin Li, cofounder of Chinese search engine Baidu, and China's third richest man ($11.1 billion net worth, according to Forbes).
valuewalk.com
Here's a brief list of some of the intriguing names from Mark Zuckerberg's private Friend List:
You can't see a connection if both users hide their Friend List, as is the case with Mark Zuckerberg and Facebook COO Sheryl Sandberg
We assume the two are friends, but you can't tell by using the mutual friends search. Mark Zuckerberg's full friends list likely features even more intriguing tech connections. Still, the list is a relatively in-depth look at the personal and professional connections of one of Silicon Valley's most powerful CEOs — and if Facebook doesn't believe the friends list loophole is a problem, then Facebook has to be okay with everyone in the world knowing who Zuckerberg is connected to.
mashable.com
While a Facebook spokesperson declined to comment on Zuckerberg's Friend List, he did share a statement about the mutual friends tool in general
Facebook's privacy settings aren't very helpful when it comes to keeping your friends list under wraps.
Image via mshcdn.com"A friendship includes two people, and we give each of those people control over who they share their friends lists with. Of course, friends sometimes disagree on things, maybe even when it comes to who they share things with on Facebook... That's why we not only give people control over who can see their friends list on their Timeline, but we explain prominently that their friends also get to choose who they share with and that they might select a different set of people."
valuewalk.com
Facebook has not shared any plans to change this mutual friends tool. Unless it does, users should understand that their friends list is just as visible as Zuckerberg's with a bit of digging — even if they set it to be seen by "only me."
mashable.com