Facebook bug could give spammers names, photos
Found on PC World on Wednesday, 11 August 2010
It turns out that if someone enters the e-mail address of a Facebook user along with the wrong password, Facebook returns a special "Please re-enter your password" page, which includes the Facebook photo and full name of the person associated with the address.
The login page shows images of people, even when they've properly set their privacy settings to keep this information private, said Agarwal.
Facebook blamed the issue on a recently introduced bug.
Blaming a bug? Seriously? I know that bugs can be responsible for all sorts of strange behaviour, but this sounds more like a design failure. On the other hand, Facebook has never been much pro-privacy.