Windows 10: Facebook API bug exposed user photos to third-party apps

Brink · Dec 14, 2018

Our internal team discovered a photo API bug that may have affected people who used Facebook Login and granted permission to third-party apps to access their photos. We have fixed the issue but, because of this bug, some third-party apps may have had access to a broader set of photos than usual for 12 days between September 13 to September 25, 2018.

When someone gives permission for an app to access their photos on Facebook, we usually only grant the app access to photos people share on their timeline. In this case, the bug potentially gave developers access to other photos, such as those shared on Marketplace or Facebook Stories. The bug also impacted photos that people uploaded to Facebook but chose not to post. For example, if someone uploads a photo to Facebook but doesn't finish posting it - maybe because they've lost reception or walked into a meeting - we store a copy of that photo for three days so the person has it when they come back to the app to complete their post.

Currently, we believe this may have affected up to 6.8 million users and up to 1,500 apps built by 876 developers. The only apps affected by this bug were ones that Facebook approved to access the photos API and that individuals had authorized to access their photos.

We're sorry this happened. Early next week we will be rolling out tools for app developers that will allow them to determine which people using their app might be impacted by this bug. We will be working with those developers to delete the photos from impacted users.

We will also notify the people potentially impacted by this bug via an alert on Facebook. The notification will direct them to a Help Center link where they'll be able to see if they've used any apps that were affected by the bug. (See example of user notification below)

We are also recommending people log into any apps with which they have shared their Facebook photos to check which photos they have access to.

Click to expand...

Source: https://developers.facebook.com/blog...photo-api-bug/

:)

Brink · Dec 14, 2018

Twitter discovered a bug in Account Activity API exposing data

We recently discovered a bug in our Account Activity API (AAAPI). This API allows registered developers to build tools to better support businesses and their communications with customers on Twitter. If you interacted with an account or business on Twitter that relied on a developer using the AAAPI to provide their services, the bug may have caused some of these interactions to be unintentionally sent to another registered developer. In some cases this may have included certain Direct Messages or protected Tweets, for example a Direct Message with an airline that had authorized an AAAPI developer. Similarly, if your business authorized a developer using the AAAPI to access your account, the bug may have impacted your activity data in error.

It is important to note that based on our initial analysis, a complex series of technical circumstances had to occur at the same time for this bug to have resulted in account information definitively being shared with the wrong source. More here.

Key updates:

The bug ran from May 2017 and within hours of discovering it on September 10, 2018, we shipped a fix to prevent data from being unintentionally sent to the incorrect developer.

The bug affected less than 1% of people on Twitter.

Any party that may have received unintended information was a developer registered through our developer program, which we have significantly expanded in recent months to prevent abuse and misuse of data.

What’s next?

If your account was affected by this bug, we will contact you directly through an in-app notice and on twitter.com.

We have contacted our developer partners and are working with them to ensure that they are complying with their obligations to delete information they should not have.

Our investigation is ongoing. We will continue to provide updates with any relevant information.

We’re very sorry this happened. We recognize and appreciate the trust you place in us, and are committed to earning that trust every day. For more on our updated API policies and how to monitor the apps you are using on Twitter, see here and here.
Click to expand...

Source: Fixing a bug in our Account Activity API

Tweet

— Twitter API (@User) View on Twiiter[/quote]

Tweet

— Twitter API (@user) View on Twiiter
Click to expand...

smartali89 · Dec 14, 2018

Facebook App Developer any one?

Hi,

I've created one facebook that APP that generates an Image and list downs the friends on it. It is working fine except "tagging" the friends.

I tried using both the Legacy Rest API and Graph API, it doesn't works

If anyone of you have recently used tagging feature then please help me out.

I can't seem to findout any solution. (Doing the code part right I think)

Thanks!

Brink · Dec 14, 2018

OneNote REST API now supports application-level permissions

The OneNote API team is pleased to announce that we have enabled application-level permissions support for the OneNote API. Until now, OneNote API calls could only be made with user-delegated permissions. This meant that your application would be restricted to scenarios that required a user to be signed in. With application-level permissions support, your application now supports scenarios that do not require a user to be signed in! Read the MSDN article for details of the OneNote API application-level permissions support.

With the availability of OneNote API application-level permissions support, many new scenarios that weren’t possible earlier are now enabled. Some example scenarios include:

Analytics (based on OneNote metadata and content exposed by the OneNote API).

Dashboards (based on OneNote metadata and content exposed by the OneNote API).

Background provisioning of OneNote content.

Background update of OneNote content.

During the development process of building the new application-level permissions support for OneNote API, our Product Management and Engineering teams worked closely with third-party partners to ensure that relevant and key education scenarios were implemented. We also ensured that our API would work well with new and upcoming third-party solutions. One of these education companies we worked closely with during the API development was Hapara.

“The Hapara Dashboard provides educators with a bird’s-eye view into student work across the Office 365 platform. With Dashboard, educators view and access student work from OneDrive and OneNote Class Notebooks from a central hub, making it easier to engage with students and their work across the Office 365 platform. Hapara relies on the new OneNote API to help co-teachers, counselors, coaches and school administrators gain appropriate access to student work in any classroom, something that previously required manual sharing and significant administrative effort by the individual teachers. Now, cross-school teams gain the same level of access and visibility into Class Notebooks via the Hapara Dashboard as teachers get via the OneNote Class Notebook app. This allows all to participate in serving students, while reducing the administrative burden on the teachers.”

—Nara Chilluvuri, product manager at Hapara

With the availability of application-level permissions support for OneNote API, solution providers, ISVs and IT admins can access important usage data about OneNote across a tenant, including:

Teacher usage of Class Notebooks.

Student usage of Class Notebooks.

Information about specific pages, sections or notebooks.

How many pages were touched and last time each page was touched.

Information about the Collaboration Space usage in the Class Notebook.

Information about OneNote Page content, including paragraphs, tables, images and attachments.

Creating a new application or updating your existing application to use the new application-level permissions support for OneNote API requires just a couple of additional (relative to using user-delegated permissions) steps. For step-by-step instructions, see the detailed OneNote app-only API documentation on MSDN.

—The OneNote team
Click to expand...

Source: The OneNote REST API now supports application-level permissions - Office Blogs

Windows 10: Facebook API bug exposed user photos to third-party apps

Facebook API bug exposed user photos to third-party apps

Facebook API bug exposed user photos to third-party apps

Facebook API bug exposed user photos to third-party apps

Facebook API bug exposed user photos to third-party apps - Similar Threads - Facebook API bug

S-Mode and third-party apps

Cancel third party in app purchase

install third party apps

install third party apps

Cannot download third party apps

Bugged Installation Screen for Third Party Operating Systems

Two More Cases of Third-Party Facebook App Data Exposure

download of third party apps

Twitter discovered a bug in Account Activity API exposing data