28 September
What happened on this date in privacy, anonymity networks and censorship. Every year on the same date we add a new look back and keep the earlier ones as they were.
2026
Facebook accounts that stay logged in
Facebook on your phone does not ask for your password every time, because it keeps you logged in with a stored credential that Facebook's announcement compared to a digital key. On 28 September 2018, Facebook disclosed a bug in "View As", a feature for previewing how your profile looks to others, which let attackers steal these credentials and take over accounts without a password. Facebook estimated that day that about 50 million accounts were affected, and made about 90 million people log back in. In an October update Facebook revised the figure to about 30 million people whose credentials were actually stolen, and the Philippine newspaper BusinessWorld reported that 755,973 of the affected accounts were in the Philippines. To make sure no one else is logged into your account, check the list of logged-in devices in Facebook's settings, where Facebook's 2018 announcement also recommended logging out of every device at once.
Also on this day
- The Tokyo District Court ruled for the plaintiff in a privacy suit over a novel, understanding the right to privacy as legal protection against having one's private life made public without good reason. Source: Ministry of Internal Affairs and Communications (Japan)
- Taiwan's Council of Grand Justices held that requiring fingerprints before issuing national ID cards was unconstitutional, and that control over one's fingerprint data is protected by the right to information privacy. Source: Constitutional Court (Taiwan)
- The Tor Project reported that the Great Firewall of China had blocked relays on the public list by IP address on 25 September, leaving about 80% of public relays unreachable. Source: The Tor Project