Facebook’s not-so-private friends lists

When Mark Zuckerberg launched Facebook in his Harvard dorm a decade ago, he created a system that gave its users new windows into the souls of their closest friends, the friends of their closest friends ... and complete and utter strangers.

Perhaps more than we’re willing to admit, the friends list is one of Facebook’s most compelling features. It helps perpetuate the rich complexity of the entire social network as users find more connections through their friends. It also opens up new ways of understanding your friends. As your grandmother used to say, you can tell a lot about by person by the company he keeps.


That’s probably why more and more people have opted to toggle their friends lists in recent years to hidden. A survey of 1.4 million Facebook users in New York conducted between March 2010 and June 2011 found a dramatic increase in users’ privacy settings over that period. The percentage of users who hid their friends list soared to 52.6% from 17.2%. As it turns out, Facebook’s multibillionaire founders also feel a little uncomfortable giving too much away: Zuckerberg keeps his friends list hidden from public view as does co-founder Eduardo Saverin.

But hiding a friends list doesn’t make it invisible. A recent blog post by online-security consultancy CyberInt Group showed a way to find at least some of the connections of users who hide their friends list. It involves a simple URL query that shows the mutual friends between a user with a hidden friends list and user that has a publicly displayed friends lists. The often-cited example is Mark Zuckerberg and another Facebook co-founder Chris Hughes, who makes his friends list public.

It’s fiddly and laborious but after a bit of (completely legal) hacking, you could come up with a fairly substantial part of a user’s hidden friends list. This little trick is not particularly new. However, CyberInt’s Shay Priel has helped speed up this method and as a (less than thrilling) 10-minute video of his Python script shows, has been able to identify 486 of the connections on Zuckerberg’s hidden friends list. This search wouldn’t be able to reveal those friends of Zuckerberg who also choose to hide their friends lists. So his wife, Priscilla, for instance, wouldn't show up and neither would Saverin…assuming they’re Facebook friends.

Facebook doesn't see this as a vulnerability. It states that the visibility of a friendship is determined by the user. So even if your relationships are hidden in your own profile, your connection on someone else’s profile won’t be hidden if they choose to make their friends list public. Maybe the only way to be private is to have no friends at all. That wouldn't be very fun though, would it?

How does this lack of privacy make you feel? Share your thoughts using the POST button below!