An extension for the Chrome web browser has been developed that allows people to pinpoint the precise location, to within a metre, of Facebook Messenger users.
The app – named Mauraders Map after the magical map in the Harry Potter books that showed the identity, locations and movements of all individuals – has been created by Harvard computer science and mathematics student, Aran Khanna.
Exploiting Facebook default location settings that are toggled on both the iOS and Android mobile app, and have to be turned be off manually, the app pulls in latitude and longitude coordinates using GPS (global positioning system) capabilities.
Khanna found that the coordinates were accurate to a staggering five decimal places, allowing him to identify not only a friend’s college dormitory but also the room.
The Javascript location data includes time stamps, which means that a person’s movements can be tracked minute by minute, hour by hour, going back months and, in some cases, years.
A user’s entire past location history can be tracked back to the first instance of a messaging conversation. What’s more, an individual doesn’t have to be “friends” with another user to be able to track their location, just part of the same messaging thread.
Writing on Medium, Khanna expressed surprise at how many contacts had not taken steps to turn off location settings, which are not immediately obvious in Facebook’s mobile user interface.
“Everyone I have shown this extension to has been anywhere from surprised to appalled that this much of their very personal data is online for their friends (and even complete strangers) to access. So it is seems that there is an issue.
“The main problem is that every time you open your phone and send a single message it’s so easy to forget about your location data being attached to it. Furthermore, it seems so harmless to attach a location with a single message, but the problem is, over time the information from these messages adds up.”
Originally developed using mapping platform Mapbox and discovered by the Next Web, the extension proved so popular that Mapbox has since revoked the API (application program interface) key, rendering that version defunct.
However, the Marauders Map code can still be found on open source website GitHub, allowing the extension to be rebuilt. Facebook is thought to be working on a fix to disable the tracking extension. The company acknowledged receipt of Guardian requests for comment but has so far yet to issue a statement.
Ever since whistleblower Edward Snowden exposed the mass communications interceptions of the NSA and GCHQ – the intelligence agencies of the United States and UK respectively – the issue of privacy has been thrust into global public consciousness.
While debate in the US has led to the bulk collection of phone data by the NSA being outlawed, with the future of other surveillance laws yet to be decided upon, the British prime minister, David Cameron, this week announced “turbo-charged” legislation to extend snooping powers that were blocked in a previous government coalition.
Comments (…)
Sign in or create your Guardian account to join the discussion