zlacker

>>colone+(OP)
Some more details here: https://newsroom.fb.com/news/2018/09/security-update/

>>dom96+D
> But it’s clear that attackers exploited a vulnerability in Facebook’s code that impacted “View As”, a feature that lets people see what their own profile looks like to someone else. This allowed them to steal Facebook access tokens which they could then use to take over people’s accounts

oh boy, what a mess.

>>sdwise+e1
User impersonation code always terrifies the bajeebus out of me.

>>erichu+F1
You only get to see your own profile. It's a very useful tool to make sure you're not leaking data you people you'd rather not give it to.

>>sp332+y3
Well, thanks to Facebooks "View As" functionality, I recently discovered that their privacy setting "Only Me" does not work for only me, if another person is tagged in the picture. Meaning that if I have a picture with my ex somewhere in profile, set to "Only Me", it actually means "Only me... and her".

>>seq+ec
Right, the interface isn't very clear but instead of "Only Me" it shows "Only Me (+)" and if you hover it says: "Only Me, Anyone tagged."