Security lapse exposes Facebook photos

SAN FRANCISCO - A security lapse made it possible for unwelcome strangers to peruse personal photos posted on Facebook Inc.'s popular online hangout, circumventing a recent upgrade to the Web site's privacy controls.

The Associated Press verified the loophole Monday after receiving a tip from a Byron Ng, a Vancouver, Canada, computer technician. Ng began looking for security weaknesses last week after Facebook unveiled more ways for 67 million members to restrict access to their personal profiles.

But the added protections weren't enough to prevent Ng from pulling up the most recent pictures posted by Facebook members and their friends, even if the privacy settings were set to restrict the audience to a select few.

After being alerted Monday afternoon, a Facebook spokeswoman said the Palo Alto-based company would look into the problem. By late Monday, Facebook appeared to have closed the security hole.

The lapse serves as another reminder of the perils of sharing sensitive photos and personal information online, even when Web sites pledge to shield the information from prying eyes.

Before the fix, Ng's computer-coding trick enabled him to find private pictures of Paris Hilton at the Emmy awards and of her brother Nicholas drinking a beer with friends and photos of many other people who hadn't granted access to Ng.

Using Ng's template, an AP reporter was able to look up random people on Facebook and see the most recent pictures posted on their personal profiles even if the photos were supposed to be invisible to strangers.

The revealed snapshots showed Italian vacations, office gatherings, holiday parties and college students on spring break. The AP also was able to click through a personal photo album that Facebook co-founder Mark Zuckerberg posted in November 2005.

Some members of social networks like Facebook post photos of themselves or others in potentially embarrassing or compromising situations that include illegal drug use or underage drinking that can cause trouble at school or work. None of the photos reviewed by the AP appeared to fall into this category.

Despite the risks, more people than ever — especially teenagers and young adults — are publishing personal photos and other intimate details about their lives on the Internet.

News Corp.'s MySpace.com, the only online social network larger than Facebook, suffered a security breach that exposed its members' private photos earlier this year.

Copyright 2008 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.