Meta Reopens Sharing After Fixing Muse Share Link Issue
Meta has reopened Muse's sharing feature after security researchers pointed out that public Muse conversation links were easy to find. Claroc researchers reported this week that the URLs of shared Muse conversations were named after the conversation titles and written into public DNS, which they used to find a marketing company's internal revenue assessments and a small business owner's loan application. Meta's David Singleton said on X that the underlying issue has been fixed, and that the problem lay in the URLs of shared artifacts rather than in chat sharing itself; artifacts shared before the fix have been given new links, and visiting old links now prompts users to ask the sharer for a new link.
Why read this
AI score 58
The incident revealed the specific path by which share links leaked user content, as well as how the platform handled old links becoming invalid after the fix.
Topics
Body
Meta has re-enabled Muse sharing after security researchers had reported that public conversation links could be easy to find. The researchers said they had been able to find Muse pages like a marketing company’s internal revenue review and a small business owner’s loan application.
Researchers at Claroc reported earlier this week that Muse the web addresses for shared conversations from Muse were named after a conversation’s title and written into public DNS. Ars Technica said Tuesday that Meta paused the sharing feature after it reached out about what was going on.
In a post today on X, Meta’s David Singleton says that “The underlying issue is now fixed, and sharing is back on.” According to Singleton, the issue was with URLs for shared Muse artifacts, which Meta says are things like documents and images inside Muse, and wasn’t a flaw with chat sharing.
“If you shared an artifact before the fix: it now has a new URL,” Singleton says. “Anyone visiting the old link will see a note asking them to get the new one from you. We know that’s a pain, and we’re sorry for the disruption — but protecting user data has to come first.”