The mass collection of private friend lists is a feature, not a bug, according to Facebook, which has dismissed a detailed report of an alleged privacy breach on the site.
The giant social network has dismissed a report by security researcher Shay Priel that showed how attackers could use the "shared friends" feature to view parts of a user's private friends list.
Priel reported Facebook's response:
Remember: Your friends control who can see their friendships on their own timelines. If people can see your friends on another timeline, they'll be able to see them in News Feed and search other places on Facebook. They'll also be able to see mutual friends on your timeline.
Mutual friends will be able to be revealed from private lists by comparing two Facebook user profiles. It could only be locked down if all friends on a particular list improve their profile privacy settings.
Priel, after being rejected by Facebook, published a tool to automatically collect lists of mutual friends that could help attackers create smart and targeted phishing campaigns with malware.
The tool searched through a list of mutual friends, identified them, and then saved them to a file.
