From 2011 to the start of this study in May 2015, Facebook Messenger collected and shared user geo-locations as the default setting for every message sent from the Android mobile app. These locations were visible to anyone in a group chat, regardless of his or her relationship to the sender on the Facebook social network. Results summary: My tool has been downloaded over 85,000 times since its release, and more than 170 global news publications linked to my post. Facebook Messenger, the company’s mobile messaging app, had been set up with automatic geolocation sharing since it launched in 2011. After that notice appears, the only other indicator of location data collection and sharing is a small blue icon next to the textbox in a conversation. What I realized was that almost every other message in my chats had a location attached to it, so I decided to have some fun with this data. Other Facebook users can view shared geo-locations on the Facebook Messenger application by tapping on individual messages in their chat log, which reveals a map of the location where the individual was when the message was sent (Figure 2). And if this isn't already starting to get a bit weird, the first thing I noticed when I started to write my code was that the latitude and longitude coordinates of the message locations have more than 5 decimal places of precision, making it possible to pinpoint the sender’s location to less than a meter. I also archived an open source copy of the code for the extension in an MIT-licensed Github repository with the title "marauders-map". You can get this extension here and play around with it on your message data. The post went on to describe how the Marauder's Map extension aggregates this data onto a map. Matt Steinfeld, a Facebook spokesman, said the company had been working on a Messenger update long before Khanna’s blog post was published. Results Media Coverage News of the blog went viral, starting within 24 hours of posting and continuing for about 72 hours afterwards. The day after Marauder’s Map was posted, Khanna said his future manager at Facebook called him and asked him not to talk to the press. By that evening, the global communications lead for privacy and public policy at Facebook called me to clarify Facebook's expectations that I not speak to the press, saying that his objective was to hamper the spread of what had become a damaging story. “Despite being asked repeatedly to remove the code, the creator of this tool left it up. On the afternoon of the 29th, three days after my initial posts, Facebook phoned me to inform me that it was rescinding the offer of a summer internship, citing as a reason that the extension violated the Facebook user agreement by "scraping" the site. The head of global human resources and recruiting followed up with an email message stating that my blog post did not reflect the "high ethical standards" around user privacy expected of interns. According to the email, the privacy issue was not with Facebook Messenger, but rather with my blog post and code describing how Facebook collected and shared users' geo-location data. Furthermore, because there are no readily visible consequences to sharing your location, users are never incentivized to devote attention to what this default of sharing is actually revealing about them. About a week later, Facebook released a Messenger app update trumpeted as follows in a news release: “With this update, you have full control over when and how you share your location information.” 
 
 The description didn’t mention the previous default settings. The app capitalized on a privacy flaw that Facebook had been aware of for about three years: the Facebook Messenger app automatically shared users’ locations with anyone who they messaged. However, Khanna told Boston.com that the data was from his own messages, which meant he used information accessible to all Facebook users, not just to employees. Let me reiterate that I still find Facebook Messenger extremely useful and use it religiously, albeit with location sharing now turned off. CNET drew attention to the issue in 2012 and showed users how to switch off location services. He accepted another internship with a tech start-up in Silicon Valley. This is wrong and it’s inconsistent with how we think about serving our community.” 
 
 In his first letter to investors back in 2012, Mark Zuckerberg said that Facebook follows an approach they coined the “Hacker Way.” 
 
 “The word ‘hacker’ has an unfairly negative connotation from being portrayed in the media as people who break into computers,” he wrote. His application, called Marauder’s Map — a clever name that Harry Potter fans will appreciate — was a Chrome extension that used data from Facebook Messenger to map where users were when they sent messages. Khanna complied, redirecting all press inquiries back to Facebook.  Stalking Your Friends with Facebook Messenger 
 
 Aran Khanna Blocked Unblock Follow Following May 26, 2015 
 
 Edit: At Facebook’s request I have again deactivated the *official* version of the extension. He did, but also updated his Medium post and the extension’s description to make it clear that Facebook asked him to disable the map. I wrote a Chrome extension for the Facebook Messenger page (https://www.facebook.com/messages/) that scrapes all this location data and plots it on a map. Advertisement - Continue Reading Below 
 
 Khanna tweeted about the app on May 26 and posted about it on Reddit and Medium. For those of you already wanting out here is a great guide on how to ensure you don’t send your locations from the Messenger app. I decided to write this extension, because we are constantly being told how we are losing privacy with the increasing digitization of our lives, however the consequences never seem tangible. “Even though we move very fast here, they’d been working on it for a few months.” 
 
 Khanna, who detailed the experience in a case study published Tuesday in Technology Science, a journal published by Harvard University, told Boston.com he created the app to show the consequences of unintentionally sharing data. And the company that Mark Zuckerberg famously launched from his Harvard dorm room withdrew its internship offer from this Harvard student, who apparently made the mistake of...launching an app from his dorm room. With this code you can see for yourself the potentially invasive usage of the information you share, and decide for yourself if this is something you should worry about. How likely are these people to be aware of these issues? “This mapping tool scraped Facebook data in a way that violated our terms, and those terms exist to protect people’s privacy and safety,” Steinfeld told Boston.com. Can only students who will never do research related to a company be hired by the company? This means that if a few people who I am chatting with separately collude and send each other the locations I share with them, they would be able to track me very accurately without me ever knowing. I quickly found that it was the easiest way to keep in touch with old high school friends, contact people I had just met, organize impromptu poker games with people I hardly knew, and everything in between. If you found this interesting you may also enjoy my post on Venmo’s privacy flaws and the extension I made to reveal them.
– Talk about being too good at your non-job. A Harvard University junior lost his Facebook internship two hours before he had planned to travel to it after he exploited a privacy issue in the social network's Messenger system. Aran Khanna discussed his experience and findings in a paper published in Harvard's Technology Science journal. "From 2011 to the start of this study in May 2015, Facebook Messenger collected and shared user geo-locations as the default setting for every message sent from the Android mobile app," he writes. The flaw was that those locations could be seen by anyone in a group chat, even if the person who sent the message wasn't friends with everyone else in the group. And so Khanna developed a browser app called Marauder's Map that exposed, on a map, the geo-location data that was being shared. He tweeted about his Chrome extension and posted about it on Medium on May 26. By the 28th, CNN, the Washington Post, and many others had covered his findings; the extension was downloaded 85,000 times. That same day, Facebook asked Khanna to disable the app; he did. The company also deactivated location sharing on desktops and released a June 4 update that required users to opt in to location sharing. It also withdrew Khanna's internship, which was to start on June 1. The official reason given was a violation of the "high ethical standards expected of interns," according to Boston.com. "This mapping tool scraped Facebook data in a way that violated our terms," a Facebook rep tells the site. Khanna says his app was created using his own Messenger history, not data scraping. "I didn't write the program to be malicious," he says. Khanna ended up securing an internship with another Silicon Valley firm. (This alleged intern tale of woe involves the Olsen twins.)