Facebook fixes security bug in chat program

UPDATE 2:06 p.m. ET: A Facebook spokesperson says the security bug has been fixed; chat will be up shortly.

The blog TechCrunch posted a scary video today.

Writer Steve O'Hear shows that it's possible to eavesdrop on the private live chats of your Facebook friends by previewing your profile through the site's privacy settings.

Facebook shut down its chat function on Wednesday in response the security bug, a Facebook spokeswoman said in an e-mail to CNN.

"When we received reports of the problem, our engineers promptly diagnosed it and temporarily disabled the chat function," the e-mailed statement from Facebook says.

"We also pushed out a fix to take care of the visible friend requests which is now complete. Chat will be turned back on across the site shortly. We worked quickly to resolve this matter, ensuring that once the bug was reported to us, a solution was quickly found and implemented."

The social network's chat feature - which lets people have live conversations through instant text messages - appeared to be "down for maintenance" as of noon ET, when CNN tried to replicated the hack.

Watch the full video to understand how the flaw works.

"I know Facebook wants us to share more information and open up, but I’m not sure that this is quite what they had in mind," O'Hear writes on the blog.

He accesses a friend's supposedly private chat conversation by using a feature that lets people preview their profile through the eyes of their friends. This feature is intended to let people see if they've managed their privacy settings correctly. A person, for instance, might make some Facebook information viewable to everyone, while keeping co-workers or professional contacts in the dark about new photos or status updates.

When O'Hear previews his profile through the eyes of a friend, he pulls up that friend's private chat.

We'll keep an eye on this and let you know if we hear back from Facebook.

Posted by: John D. Sutter -- CNN.com writer/producer
Filed under: Facebook • privacy