Facebook privacy hole 'lets you see where strangers plan to go'

Developer says new API lets you query social network's databases – and there doesn't seem to be a way to turn it off

Facebook: released new Graph API last Friday. Photograph: Linda Nylind

Facebook's new system for connecting together the web seems to have a serious privacy hole, a web developer has discovered.

Some people report that they are able to see the public "events" that Facebook users have said they will attend – even if they person is not a "friend" on the social network.

The discovery was made by Ka-Ping Yee, a software engineer for the charitable arm of Google, who was trying out the search query system known as the "Graph API" released by Facebook last Friday. In some cases – though not all – it will let you see the public events that people have said they will attend, or have attended.

Yee demonstrated the flaw by showing how the API – which plugs directly into Facebook's databases – can show you a list of Facebook founder Mark Zuckerberg's planned public events.

rest at http://www.guardian.co.uk/technology/2010/apr/26/facebook-privacy-hole