Facebook Bug Exposed Millions of Users’ Private Photos, Here’s How to See if You Were Affected

On Friday, the tech giant Facebook announced yet another security bug in which the platform allowed third parties access to a user’s private photos. Because of the bug, third parties were given access to a user’s private photos on their devices. Although the breach happened in September, Facebook waited until now to mention it.

According to Facebook, the bug allowed these third parties access to your photos for 12 days between September 13 and September 25 of this year. According to their release, the bug affected millions of users.

“Currently, we believe this may have affected up to 6.8 million users and up to 1,500 apps built by 876 developers. The only apps affected by this bug were ones that Facebook approved to access the photos API and that individuals had authorized to access their photos,” Facebook noted in a press release on Friday.

While this is not as bad as having your entire account hacked, this bug allowed third parties access to photos that you may have not wanted anyone else to see.

Luckily, you can easily see if you were affected by this bug. When you click the link below—while logged into your Facebook account—you will be notified whether or not your account was affected by this bug. If it was, Facebook provides instructions on what to do next.

To check your account, click here while you’re logged in to Facebook.

As has been the case for countless other events like this one, we are doubting that Facebook will do anything else to compensate those who were affected.

It is no secret that Facebook has long exploited its user base, kept a trove of data on them, and is essentially an intimate and personal database on 1.4 billion people ripe for the picking of the surveillance state. The insidious nature of Facebook has discouraged many people from using it and is causing millions of users to delete their accounts. However, what many people do not know is that you don’t even need an account for Facebook to spy on you and mine your most intimate data.

Even if you have never had a Facebook account, this social media leviathan uses online tracking devices that follow a user’s internet activity via third parties and you never have to visit Facebook for it to happen.

While Facebook has become an everyday part of life for hundreds of millions of people across the world, many of those active on the platform are blissfully unaware of the vast amounts of personal data the company aggregates about them. So, why would anyone who has never visited the domain need to worry about Facebook spying on them? Well, the answer to that question is data.

With data becoming one of the greatest resources for business in the modern era, individuals are increasingly becoming more concerned about exactly what type of information can be found about them in cyberspace – and on Facebook in particular.

While people are offered a range of privacy setting options to choose from when posting on Facebook, many are completely unaware that they have the ability to customize the privacy settings on the information they share.

This can create a dynamic where your personal information is easily preyed upon by strangers, advertisers, and criminals alike. And, you don’t need a Facebook page to be a target.

As a report from the Daily Mail notes:

Even if you have never entered the Facebook domain, the company is still able to follow your browsing behavior without you knowing it. More than 10,000 websites contain invisible trackers, called Pixels, which record information about visitors. This includes everything from the operating system you use to your IP address and activities on the website during a session. This gives the firm insights into everything from where you are in the world, who your internet service provider is, the types of sites you like to visit and how long you spend on them.

It has now been over a decade that Facebook has been mining data on billions of people and for the first time in our history, a private company has been meticulously gathering, storing, analyzing, and selling data on entire populations for more than ten years.

As The Free Thought Project previously reported, if you have a Facebook profile, you can download it to see the insane amount of data this company has on you.

Even if you are okay with Facebook creepily storing all of your data—forever—other people, outside of the social media platform have access to this data as well.

Fortunately, there’s a way to determine exactly how much of the information you share on Facebook is publicly accessible.

A simple tool made by Supremo now allows you to see exactly what personal data you have shared with strangers on Facebook.

The Supremo website presciently warns:

Hi there! Did you know that every single time you visit a website, you reveal information about yourself simply by visiting. Similarly, websites that allow you to log in via Facebook could be collecting all kinds of information if you haven’t properly checked the permissions you’re granting.

Ironically, the tool asks for permission to access your personal information on Facebook. However, the company notes that the “information we’ve gathered will be completely removed from our records but there are more malicious uses of your personal information potentially.”

While Facebook users can see what this data collection company has been storing on them, non-users are left out in the cold. The privacy of internet users tracked via third parties is mostly secret and there is currently no way of seeing what Facebook knows about you.

However, you can still block Facebook from following you around the Web.

If you use Google Chrome, you can do the following.

If you allow cookies by default, you can still block them for a certain site.

On your computer, open Chrome.
At the top right, click More Settings.
At the bottom, click Advanced.
Under “Privacy and security,” click Content settings.
Click Cookies.
Next to “Block,” “Clear on exit,” or “Allow,” click Add.
Enter the web address.
- To create an exception for an entire domain, insert [*.] before the domain name. For example, [*.]google.com will match drive.google.com and calendar.google.com.
- You can also put an IP address or a web address that doesn’t start with https://.
Click Add.

While this is a safer way to access the Internet, the use of proxies and browsers like Firefox that don’t spy on you, make it far safer.

“I think it’s absolutely crucial we find out what consumers do know and then let’s see whether they care. My suspicion is Facebook and Google have much more personal information about people than people realize,” the Australian Competition and Consumer Commission (ACCC) chairman Rodd Sims said earlier this year. And, as the world keeps finding out, Sims is slowly getting proven right.

Matt Agorist is an honorably discharged veteran of the USMC and former intelligence operator directly tasked by the NSA. This prior experience gives him unique insight into the world of government corruption and the American police state. Agorist has been an independent journalist for over a decade and has been featured on mainstream networks around the world. Agorist is also the Editor at Large at the Free Thought Project, where this article first appeared. Follow @MattAgorist on Twitter, Steemit, and now on Facebook.