As Facebook’s privacy settings continue to evolve, many have discussed the increased openness as users gain more options to share content publicly. All the while, though, ongoing problems with the Facebook Platform detract from the perceived level of control over privacy.
In essence, you should already think of your profile information as public. First, any application you authorize has carte blanche access to your data. You have no way to limit this access apart from avoiding authorization to start with. Second, if a friend authorizes an application, that application likely has the same amount of access to your profile via your friends’ sessions. You can limit the available data if you have not also authorized the application.
Finally, the current architecture of the Platform leaves users vulnerable to attacks that allow others to harvest profile information. I have demonstrated such attacks before, and the more I investigate them, the more ridiculous the situation becomes.
Not only did this new trick enable the attack on that particular application, it allowed me to launch the attack using another top 10 application that I already knew had an XSS hole. Both of these applications also allow for clickjacking installs, meaning I could once again relaunch the full attack if I so desired.
Keep in mind that you need not visit an attack page for this to affect you. If you’ve not limited unauthorized applications or the attack uses an application you’ve already installed, your data is vulnerable if a friend visits an attack page.
In short, an attacker could launch pages right now (this is zero-day stuff, people) that silently harvest profile information and photos from nearly any Facebook user. Between these hacks and the threat of rogue applications, you should regard anything you post on Facebook as public information.