Published On: 19 Sep 2023
Anonymous post owner disclosure
Privacy/Authentication
Facebook | Android
---
LOW VALIDDescription
Facebook Groups offer an anonymous posting feature.Users can create anonymous posts and engage anonymously with commenters.However, if they reply to comments or like comments beneath their anonymous post using Facebook Lite, other group members can unveil their identity by accessing their group profile (www.facebook.com/groups/group_id/user/user_id). In the Recent Activity section, comments made anonymously will be shown with the post owner's profile picture and real name
Impact
Group members can reveal the identity of an anonymous post owner if they used Facebook Lite to respond to comments under the post
Reproduction Steps
Step
1
FBDL run: 2566222610194053
Script:
[setup]
User UserOne
User UserTwo
User UserThree
User UserFour
Group GroupOne with {privacy: public, owner: UserOne, members: [UserTwo, UserThree, UserFour]}
[action]
UserTwo make_anonymous_post AnonPostOne with {group: GroupOne, approved_by: UserOne}
Step
2
Set up
1. UserOne
2. UserTwo
3. UserThree
4. UserFour
5. GroupOne with {privacy: public, owner: UserOne, members: [UserTwo, UserThree, UserFour]}
Step
3
- Log in as UserTwo using the desktop version.
- Go to GroupOne and create an anonymous post. Approve the post as UserOne (AnonymousPostOne).
- Log in as UserThree.
- Navigate to GroupOne/AnonymousPostOne and add a comment (CommentOne).
- Using the latest version of Facebook Lite for Android, log in as UserTwo.
- Visit GroupOne/AnonymousPostOne.
- Reply with "Test123" to CommentOne.
- Log in as UserThree using the desktop version.
- Go to GroupOne/Members.
- Click on UserTwo's name.
- Scroll down to Recent Activity, where you will see that UserTwo created the comment "Test123" and is also the post owner.
Videos