Facebook Applications Accidentally Leaking User Information: Symantec

Facebook users may have leaked personal information through the popular social network's applications, security firm Symantec SYMC is reporting Wednesday. According the company's blog, "Third parties, in particular advertisers, have accidentally had access to Facebook users' accounts including profiles, photographs, chat, and also had the ability to post messages and mine personal information. Fortunately, these third-parties may not have realized their ability to access this information. We have reported this issue to Facebook, who has taken corrective action to help eliminate this issue." Numerous companies have sprung up in recent years to stake a share of the application market on Facebook. Users can tend virtual crops, play games, and connect with friends. According to Facebook, 20 million Facebook applications are installed every day. The blog notes that "Symantec has discovered that in certain cases, Facebook IFRAME applications inadvertently leaked access tokens to third parties like advertisers or analytic platforms. We estimate that as of April 2011, close to 100,000 applications were enabling this leakage. We estimate that over the years, hundreds of thousands of applications may have inadvertently leaked millions of access tokens to third parties." Concluding that "Needless to say, the repercussions of this access token leakage are seen far and wide," Symantec comments that "There is no good way to estimate how many access tokens have already been leaked since the release Facebook applications back in 2007." Concerned Facebook users should change their Facebook passwords immediately. Symantec notes that "Changing the password invalidates these tokens and is equivalent to “changing the lock” on your Facebook profile." Facebook is global networking site with an estimated 500 million users.