Sign up FAST! Login

Obtaining The Primary Email Address Of Any Facebook User

Stashed in: Facebook!, Privacy does not exist., Awesome, Reaction GIFs!,

To save this post, select a stash from drop-down menu or type in a new one:

Given only their ID, it was possible to obtain the primary email address of any Facebook user regardless of their privacy settings.

Anyone who has subscribed to a public mailing list knows the problem of members inviting their entire contacts list, including the mailing list, to every new social site and app. This has turned mailing list archives into a Wayback Machine for email notifications. Searching through some old mailing lists I came across a Facebook invitation reminder circa 2010:


Clicking on the link in the email, a sign up page filled in with the list’s address and the name of a person who used the link to sign up for an account was displayed:


The link contained two parameters: “re” and “mid”:

Changing the re parameter did nothing; however, changing parts of the mid parameter resulted in other addresses being displayed. Taking a closer at the parameter, its value was actually a string of values with “G” acting as a delimiter:

59b63a G 5af3107aba69 G 0 G 46

Only the second value was important. The value was an ID associated with the address that the invitation was sent to in hex. A Facebook user’s numerical ID could be put as this value and their primary email address would be displayed. A user’s numerical ID is considered public information and can be obtained from the source of their profile or through the Graph API.


Holy smokes, this is very bad!

Wait, I think it's even easier than that.  You simply take their userid and add onto it as they've made all user's primary emails facebook addresses.  Voila!

Sure, but email addresses are not considered private.

We know this because the default policy is that anyone can email any Facebook address, unless the recipient has gone in and changed her or his settings.

What's upsetting about the hack Stephen Sclafani uncovered is that Facebook has made private information easily accessible.

Which goes back to the simple and easy to understand mantra: don't give Facebook ANYTHING you don't want eventually broadcast to the whole world.

Chelsea Lately are you fucking kidding me gif

love her

And she has so many awesome gifs to choose from...

chelsea lately the important thing is to be drunk gif

zooey deschanel i have a secret slutty person in my head chelsea lately gif

chelsea lately that is stupid gif

chelsea lately focus on the question gif

chelsea lately everybody I know is crazy gif

...what were we talking about again? I've kind of lost my train of thought...

Huh, were we talking about privacy and Facebook?! Well, I totally agree that we should not give Facebook anything we really want to keep private. "Facebook privacy" = oxymoron.

It always amazes me that people are shocked that Facebook has no real privacy.

You May Also Like: