I recall reading this
exam question with interest awhile ago (sad, I know), and the recent release of the
facebook API's makes it much, much more relevant:
John Arrow operates UnFaced.com, which enables “compatibility tests” between Facebook users. Assume Joe and Karen are registered Facebook users. Karen can register with UnFaced.com and display a link on her Facebook profile to UnFaced.com’s website. Joe can follow that link to UnFaced and request a compatibility test with Karen by submitting the URL2 of his Facebook profile.
UnFaced then automatically accesses Joe and Karen’s Facebook profile URLs using robots, downloads each profile, and uses the profile data to assess compatibility using a proprietary algorithm. UnFaced then shows Joe a web page describing its compatibility assessment, which presumably can facilitate further flirting between Joe and Karen. Only registered Facebook members can access Facebook profile pages (unregistered web visitors who try to access those URLs simply get a login screen).
Thus, John must be a registered Facebook member to access Facebook profile URLs. To register, John entered into a mandatory non-leaky clickthrough agreement containing the following terms:
Provided that you are eligible for use of the Site, you are granted a limited license to access and use the Site and to download…the Site Content solely for your personal, non-commercial use
…[Y]ou may not republish Site Content on any Internet, Intranet or Extranet site or incorporate the information in any other database or compilation
.... [Y]ou agree not to use automated scripts to collect information from the Service or the Site
.…In addition, you agree not to use the Service or the Site to…register for more than one User account...or register for a User account on behalf of any group or entity; [or…] create a false identity on the Service or the Site.
According to a news report, John “admitted that he's ‘scraping’3 data from the Facebook profiles, but said it shouldn't matter because UnFaced only did so at the behest of users who gave Facebook that content in the first place.”
So, how much easier would the new API's make it to set up UnFaced - and what else might an identity scavenger use the API's for?
Hmmmm...
not just us who are concerned...