Aran Khanna, a junior at Harvard University, says he lost his internship at Facebook after he launched an app that exploited privacy flaws on Facebook's Messenger system.
In a paper published in Harvard's Technology Science journal, Khanna discussed his findings. "From 2011 to the start of this study in May 2015, Facebook Messenger collected and shared user geo-locations as the default setting for every message sent from the Android mobile app," he writes.
He notes that the flaw was that those locations could be seen by anyone so long as they participated in a group chat, even if the person who sent the message wasn't friends with anyone in the group.
Using his findings, Khanna developed a Chrome app called Maurauder's Map, in tribute to the Harry Potter books, that exposed geo-location data that was being shared on a map, reported The Hollywood Reporter. He tweeted about his app and posted about it on Medium on May 26.
By May 28 major media outlets covered his findings and the extension was downloaded 85,000 times.
That same day, Facebook asked Khanna to disable the app, which he did. Faced with his findings, the company also deactivated location sharing on desktops and released a June 4 update that required users to opt in to location sharing.
Two hours before he was supposed to leave for his internship, Khanna received a call from a Facebook employee telling him that the internship was rescinded because he violated the "high ethical standards expected of interns" when he scraped the site for data.
Khanna says that his app was created using his own Messenger history, not data scraping, claiming "I didn't write the program to be malicious."
