Video Proof of Concept: I created a random website, not connected to the facebook user visiting my page. Abusing a vulnerability in the popular quiz app nametests.com, I was able to identify who the visitor is, get their personal information, private photo's, status updates and friends.