Break Facebook Privacy of Private Album
Labels: Facebook Hack
Allows anyone to access Facebook albums
Exploit for your Web Browser to Access the Albums on Facebook
When you’re tagged in an album, Facebook adds the photo(s) to your collection of “Added by Others” photos. When you’re viewing one of these photos of your friend, you can see the album name and creator displayed under the photo. If the creator is your friend, the album name is a link, otherwise you are not supposed to have an access to the rest of the album
You can do that by going to a friend’s photos page. Open one of the “Added by Others” photos tagged by someone whom you aren’t friends with. Pay attention to the address of the page you are viewing and all of the php variables (evertything after the question mark). “pid=258755″ is the ID of the photo in question. The variable “subj=850305322″ tells Facebook the subject we are particularly looking for in the album. “&id=992303520″ is the member ID of the person who created the album. Ignore the other variables. Remove this variable altogether. If we simply tried to isolate the photo by defining only the “pid” variable, Facebook will return an error page that says you don’t have permission to view the page. For this to work, you have to leave the ID of the album owner on the end:
a
In order to prevent people who aren’t your friends from accessing your albums, others will lose the ability to view the photos you tagged your friend in.
