Developer loses out on Facebook internship for revealing security flaw

A couple of months ago, there were reports about a Chrome extension called Marauders Map that allowed Facebook users to see exactly where their contacts are messaging them from.

However, in a couple of days since announcing the extension, Khanna was asked to pull down the extension, which he complied with. The project is available as a repo on GitHub. He was also asked not to speak to the media. Since the extension revealed a privacy flaw in the Facebook system, it was widely appreciated that Khanna was going to begin a summer internship at Facebook.

According to a report in the Boston, “The day after Marauder’s Map was posted, Khanna said his future manager at Facebook called him and asked him not to talk to the press. That evening, Khanna received a call from Facebook’s global communications lead for privacy and public policy, who reiterated that Khanna shouldn’t talk to the press because the story had become damaging.”

According to the report, “Khanna complied, redirecting all press inquiries back to Facebook. The next day, Facebook asked him to deactivate the extension. He did, but also updated his Medium post and the extension’s description to make it clear that Facebook asked him to disable the map.”

What is shocking, however, is that “Three days after the extension was posted, and two hours before he was supposed to leave to start his internship, Khanna received a call from a Facebook employee telling him that the company was rescinding his summer internship offer. Khanna said he was told that he violated the Facebook user agreement when he scraped the site for data.”

Created by a student developer in Cambridge, Massachusetts, Aran Khanna, the extension grabbed a user’s location data from Facebook Messenger and will quickly plot it out on a map. The location is said to be extremely precise and makes it super easy to stalk a person’s vicinity. To make things more easy, it can fetch location data from the past as well as long as location sharing was enabled, which is mostly on by default on iOS and Android apps.