The social network allows you to set the visibility of your friends list, so if you want to keep that list private, you can do so by setting the list visibility to "Only Me." The problem is that other users can still see some of your friends even if they can't access the full list, and while Facebook explains some of this on the privacy setting screen, the "Only Me" setting doesn't actually limit your friends list to only you.
For starters, you can see if you have mutual friends with another user even if that user's friends list is set to private. That means that you are able to see a sampling of that user's connections even if they've changed the privacy setting to "Only Me."
Facebook alerts users of this on the friend list privacy settings screen, but you may not notice unless you pay special attention. The warning reads:
Remember: Your friends control who can see their friendships on their own timelines. If people can see your friendship on another timeline, they'll be able to see it in news feed, search and other places on Facebook. They'll also be able to see mutual friends on your timeline.
What this means is that your friends list is really only as safe as the privacy settings used by your friends your friends list is really only as safe as the privacy settings used by your friends.
CyberInt, a group focused on information security and cyber warfare, demonstrated how a hacker (or really anyone with time on their hands) could take advantage of this privacy issue to piece together a user's entire friends list.
You are able to view the mutual friends of any two users on Facebook, so long as one of the two users shares his friend
A Facebook spokesperson sent Mashable the following statement regarding the friends list privacy setting: "While you can control who sees the full list of your friends on your Timeline, there may be other ways for people to find out who your friends are on Facebook. For example, even if you’ve limited who can see your friend list, people can still see the friend lists of your friends if they are in the audience for those lists.”