Some Facebook applications have been leaking user information — specifically, Facebook UIDs — to third party companies.
The apps in question have a huge combined userbase. The Wall Street Journal reports that all of the 10 most popular Facebook apps are guilty of giving away user IDs to third parties, specifically Internet research and advertising companies. These include Zynga’s FarmVille, Texas HoldEm Poker andFrontierVille; according to AppData, FarmVille alone had more than 80 million users in February 2010. Facebook confirmed some of the issues in a blog post, claiming most of the apps in question shared the user IDs inadvertently, due to “technical details.” Details of the Data Leak:
Facebook's data leak is straightforward: Consider a user who clicks a Facebook advertisement while viewing her own Facebook profile, or while viewing a page linked from her profile (e.g. a friend's profile or a photo). Upon such a click, Facebook provides the advertiser with the user's Facebook username or user ID.
Facebook leaks usernames and user IDs to advertisers because Facebook embeds usernames and user IDs in URLs which are passed to advertisers through the HTTP Referer header. For example, my Facebook profile URL is http://www.facebook.com/bedelman. Notice my username (yellow). Of course, it would be incorrect to assume that a person looking at a given profile is in fact the owner of that profile. A request for a given profile might reflect that user looking at her own profile, but it might instead be some other user looking at the user's profile. However, when a user views her own profile page, Facebook automatically embeds a "profile" tag (green) in the URL:
http://www.facebook.com/bedelman?ref=profile
Furthermore, when a user clicks from her profile page to another page, the resulting URL still bears the user's own user ID or username, along with the details of the later-requested page. For example, when I view a friend's profile, the resulting URL is as shown below. Notice the continued reference to my username (yellow) and the fact that this is indeed my profile (green), along with an appendage naming the user whose page I am now viewing (blue).
http://www.facebook.com/bedelman?ref=profile#!/pacoles
Each of these URLs is passed to advertisers whenever a user clicks an ad on Facebook. For example, when I clicked a Livingsocial ad on my own profile page, Facebook redirected me to the advertiser, yielding the following traffic to the advertiser's server. Notice the transmission in the Referer header (red) of my username (yellow) and the fact that I was viewing my own profile page (green).
GET /deals/socialads_reflector?do_not_redirect=1&preferred_city=152&ref=AUTO_LOWE_Deals_ 1273608790_uniq_bt1_b100_oci123_gM_a21-99 HTTP/1.1
Accept: */*
Referer: http://www.facebook.com/bedelman?ref=profile
...
...
The same transmission occurs when a user clicks from her profile page to a friend's page. For example, I clicked through to a friend's profile, http://www.facebook.com/bedelman?ref=profile#!/pacoles, where I clicked another Livingsocial ad. Again, Facebook's redirect caused my browser to transmit in its Referer header (red) my username (yellow), the fact that that username reflects my personal profile (green). Interestingly, my friend's username was omitted from the transmission because it occurred after a pound sign, causing it to be automatically removed from Referer transmission.
GET /deals/socialads_reflector?do_not_redirect=1&preferred_city=152&ref=AUTO_LOWE_Deals_ 1273608790_uniq_bt1_b100_oci123_gM_a21-99 HTTP/1.1
Accept: */*
Referer: http://www.facebook.com/bedelman?ref=profile
...
...
In further testing, I confirmed that the same transmission occurs when a user clicks from her profile page to a photo page, or to any of various other pages linked form a user's profile.
With a Facebook member's username or user ID, current Facebook defaults allow an advertiser (and anyone else) to obtain a user's name, gender, other profile data, picture, friends, networks, wall posts, photos, and likes. Furthermore, the advertiser already knows the user's basic demographics, since the advertiser knows the user fits the profile the advertiser had requested from Facebook. For example, in grey highlighting above, the advertiser learned from Facebook my age, gender, and geographic location.
