Facebook Graph Search Bypassing Privacy Settings?

Tricky complex privacy settings that are harder for people to understand.

Rukshan
Info Sec

--

I don’t know whether this is a privacy violation but there is something seriously odd with privacy settings and graph search. I first experienced this when I was searching for photos of a friend of mine on Facebook using Facebook graph search. I searched for photos of “my friend” and it showed a whole list of photos of my friend that were posted on Facebook by different people and have tagged my friend.

The privacy setting is set to “only me”

However the odd thing was that me an my friend are actually not friends on Facebook. And my friend has set his privacy settings to who can see his tagged photos to “only me” which means no one can see the tagged photos of him on Facebook other than himself.

Even I’ve set this privacy settings to “only me”, which means for me or I expect is that photos that I’ve been tagged must only be shown to me and the friends of the person who original uploaded the photo. Even though the original uploader has posted the photo publicly and has tagged me, by setting who can see my tagged photos to “only me” I expect that other people might not be able to find the photo unless they specifically check the original uploaders profile which people would not know unless I tell them.

Graph search bypasses this privacy setting, making it useless.

However graph-search gives a bypass to this privacy setting and now anyone even people who have not friended me can search for photos of me and can see so many photos of me that people have posted publicly on Facebook and has tagged me.

So this means setting the who can see my tagged photos to “only me” basically becomes useless when graph search is around.

The Facebook’s response to these kind of privacy loops holes is because the original uploader is posting the photo publicly then it’s ok to graph search to discover it. Technically it’s correct but in a humanly way how correct is it?

The graph search results are almost identical to what the user will see in his profile of photos of him that are posted publicly on Facebook. This is the very thing that user want to hide by setting who can see his tagged photos to “only me”

If graph search can work around it then why there is a privacy setting called “who can see my tagged photos”? By using it and privacy option and setting it to “only me” then what does the user expect Facebook to do? When it comes to me it’s no once else find my tagged photos unless they find the original uploader by themselves.

The fix for this is untagging yourself from publicly posted photos or tell people to not to post photos publicly on Facebook, both things are pretty much not practical.

So what do you think?

  • Is this a violation of privacy?
  • Is it technically correct for Facebook to able to show your publicly tagged photos to everyone on Facebook via graph search?
  • Do you set your privacy setting to who can see your tagged photos to “only me”?
  • If you set who can see your tagged photos to “only me” what do you expect the privacy setting to do?

--

--

Rukshan
Info Sec

I'm a blogger and I'm interested in technology, startups and making new things. ✌