Storify Curator Shows Private Facebook Posts

By Justin Lafferty 

Many media moguls use a content curator called Storify, which gathers social media reactions to certain topics or events in order to put together story streams. It’s effectively used most through Twitter and Facebook, but it has been discovered that Storify can pull posts from private Facebook profiles, too.

Around the time of major events, people use Storify to pull together reactions from all over social media. For instance, if you wanted to create a Storify stream about “American Idol,” Storify would gather tweets and Facebook posts from people with whom you are connected, containing the term, “American Idol.”

However, Julie Pippert, founder and director of Artful Media Group, found what she believes to be a bug in Storify’s system. Regardless of Facebook users’ privacy settings, their posts can be quoted in Storify streams, she discovered. Pippert alerted Lani Rosales of AGBeat, and she tested this theory. Storify was able to take a post from one of Rosales’ private groups.

Rosales posted an example from this group (her own post, not another group member), and was shocked to see that it was easily Storified through the Google Chrome extension:

This is an example taken from a secret Facebook group comprised of a handful of very close friends, where we talk about sensitive health issues each of us have, which would obviously be detrimental for the public to see.

Now, if you are not a member of the secret group, you cannot see anything else inside of the group or who the members are, and you do not have additional access to other status updates, but my face and name are now associated with a sensitive topic that the public can see, should another group member have innocently pulled the update as they saw it in their timeline, not realizing it was from the group, or simply not thinking Storify would authorize such a move.

Pippert discovered that private posts are available in Storify by accident. When Twitter users have private profiles, it’s not possible to do the one-click retweet action. Through Facebook, it appears that if users are connected with someone, the privacy settings don’t matter.

Pippert told AGBeat that after she accidentally Storified a private post, she did a little more research to figure out what’s going on:

I felt so terrible about what happened that I started digging and checking, and I figured out that although anything can be copied, screen-captured, or otherwise shared, anyone who installs the Storify app can do it with one click, even if it is marked or otherwise set to be private.

When Storify users want to access Twitter posts, there are settings that prohibit private users from being quoted. Pippert noted that when users want to quote Twitter users with restricted accounts, the screen darkens, and there is no option for curation.

AGBeat discovered that even when a post is deleted from Facebook, it can still show up on Storify if it was quoted before the deletion.

Readers: Do you use Storify to quote Facebook posts?