How a Harvard student allowed you to track your Facebook friends

Aran Khanna said the latitude and longitude coordinates of messages are accurate within three feet.
Aran Khanna said the latitude and longitude coordinates of messages are accurate within three feet. –Dado Ruvic /Reuters

Facebook Messenger knows where you’ve been. And now, a Harvard undergrad has proven that, unless you’re careful, anyone who you message using the app can know, too.

Aran Khanna, who will begin an internship at Facebook next week, recently created a Chrome extension that used the app’s data to plot the locations of everyone that messages you.

The extension had worked on and off for the past few days. Khanna has deactivated the extension at Facebook’s request, both he and a Facebook spokesperson said. Khanna has given developers instructions on how to recreate the extension, but wrote, “Facebook is working to fix the issue so don’t expect this code to be functional for long.’’

Advertisement

Even though it’s no longer live, the point behind the extension was clear — unless you turn location services off, everyone you message, whether it be your best friend or that guy you had high school physics with 10 years ago, can track you.

The Facebook spokesperson said Messenger defaults to putting a location on every message sent from an Android, which is what Khanna used. He said the app only tracks the user’s location if the app is open and actively being used, not if it’s running in the background.

For iPhones, the app asks to use your location when installed, so, if you blindly hit “yes,’’ your messages have been tracked.

Khanna, who declined to comment and redirected all questions to Facebook, named the extension after Marauder’s Map, the magical document in the Harry Potter series that showed every inch of Hogwarts, even the hidden passages. It turns out, Facebook Messenger isn’t too different from the fictitious map in recording every location you’ve sent a message from, whether it’s your office, your bedroom or, potentially, a magic castle.

In his Medium post describing the extension, Khanna said the latitude and longitude coordinates of messages are accurate within three feet.

A screengrab of Khanna’s location in one day based on the Facebook messenges he sent. —Photo via Medium
Advertisement

After describing how he was able to track his acquaintance’s daily routes, Khanna said he wrote the extension to show the consequences of blindly sharing information. This way, he wrote, users can decide for themselves whether having location services turned on is something they should worry about.

Khanna wrote that he still uses Facebook Messenger, but turned his location off.

Here’s how you can do the same:

Android:

Tap the Menu icon > Settings > Location Services

Uncheck the box that allows location services.

On iOS:

Tap the Settings icon > Privacy > Location Services

Scroll to Facebook Messenger on the list and switch the location option off.

New England schools on the Forbes ‘Top Colleges’ list

Loading Comments...