Facebook has admitted that some apps had access to users’ private messages, thanks to a policy that allowed devs to request mailbox permissions.
The revelation came as current Facebook users found out whether they or their friends had used the “This Is Your Digital Life” app that allowed academic Aleksandr Kogan to collect data on users and their friends.
Users whose friends had been suckered in by the quiz were told that as a result, their public profile, Page likes, birthday and current city were “likely shared” with the app.
So far, so expected. But, the notification went on:
A small number of people who logged into “This Is Your Digital Life” also shared their own News Feed, timeline, posts and messages which may have included post and messages from you. They may also have shared your hometown.
That’s because, back in 2014 when the app was in use, developers using Facebook’s Graph API to get data off the platform could ask for
read_mailboxpermission, allowing them access to a person’s inbox.That was just one of a series of extended permissions granted to devs under v1.0 of the Graph API, which was first introduced in 2010.
Following pressure from privacy activists – but much to the disappointment of developers – Facebook shut that tap off for most permissions in April 2015, although the changelog shows that
read_mailboxwasn’t deprecated until 6 October 2015.Facebook confirmed to The Register that this access had been requested by the app and that a small number of people had granted it permission.
“In 2014, Facebook’s platform policy allowed developers to request mailbox permissions but only if the person explicitly gave consent for this to happen,” a spokesborg told us.
“According to our records only a very small number of people explicitly opted into sharing this information. The feature was turned off in 2015.”
Source: Facebook admits: Apps were given users’ permission to go into their inboxes • The Register
Robin Edgar
Organisational Structures | Technology and Science | Military, IT and Lifestyle consultancy | Social, Broadcast & Cross Media | Flying aircraft