Facebook Bug Reveals Private Photos, Wall Posts
Earlier this evening we came across a privacy flaw on Facebook that allowed users to gain access to portions of their friends' profiles that they should not have been able to see. We contacted Facebook about the issue over an hour ago …
Context & Ripple Effects
The flaw surfaced on the evening of March 21, 2009, when TechCrunch found that friend-level access controls on Facebook were failing, exposing photos and wall posts users had set to private; the outlet says it contacted Facebook more than an hour before publishing, so the company's response time is now part of the story.
Timing sharpens the damage. Facebook rolled out a redesigned layout emphasizing Twitter-like status updates on March 19 — no wait, that framing is wrong; the redesign itself was confirmed March 19-20 — and an application polling nearly 800,000 users found 94% disapproved of it. A privacy failure arriving mid-revolt gives critics of the new design a concrete argument beyond taste: that Facebook is changing how sharing works faster than it can secure it, just as Facebook Connect pushes identity out to third-party iPhone apps.
First-order effects
- Users whose profiles were exposed had private photos and wall posts viewable by anyone browsing their profile as a friend, until Facebook patches the flaw.
- Facebook faces a disclosure clock already running: TechCrunch published after an unanswered hour-old contact, so the company must both fix the bug and answer publicly on its own timeline.
Second-order effects
- The bug compounds the backlash against the March 19-20 redesign — where a poll of nearly 800,000 users showed 94% disapproval — turning a design complaint into a trust complaint about who controls visibility on the platform.
- With Facebook Connect going live in iPhone apps the same week, each permission failure raises the stakes on the access layer third-party developers are building against, making Facebook's permission model the shared liability of its growing ecosystem.
Third-order effects
- If boundary failures keep recurring as the platform's sharing surface expands, pressure will build to treat privacy defaults as a structural engineering and policy problem rather than a string of isolated glitches — with regulators and watchdog groups as the likely escalation path if Facebook's own fixes lag.
The trend: As social platforms push toward always-on, real-time sharing and third-party identity integration, the permission boundary — who can see what — becomes the recurring fault line between product velocity and user trust.