Facebook is an online social networking service founded in February 2004 by Mark Zuckerberg.

learn more… | top users | synonyms

0
votes
1answer
43 views

any information about en.quiente.info who has visited your account website

I ran across this site http://en.quiente.info, my friends tried it and they say it worked for them. It asks for most of the privileges on facebook even sending messages on behalf of you. Any one has ...
11
votes
3answers
234 views

Is there any difference between visiting Facebook via their Tor address, and visiting them via their normal address over Tor?

From a security perspective, is visiting via the .onion address more/less secure? I'm using Facebook as an example, but this question is really about any website which has both a 'normal' and a Tor ...
-1
votes
2answers
86 views

How can I tell if a website is sharing what videos I'm watching without my consent?

It seems that publishers are getting sued or threatened for possibly sharing video watching information - information that an individual has watched a video, before this individual has explicitly ...
-1
votes
1answer
59 views

Hacked email or total accident [closed]

I have a Facebook account which I look at occasionaly and access via the Facebook app. However whilst reading my emails I tried to access it from n email had they had sent me. I clicked the link which ...
3
votes
0answers
63 views

REST API stateless authentication using social login

I am implementing a REST API for our mobile applications in which user will login using the SDKs of various social media. Currently, the login strategy is as follows: The token(s) (access_token in ...
1
vote
2answers
54 views

Is it normal if user gets logged in Facebook or Twitter after they use Like or Tweet button? [closed]

Personally I don't use social networks, so I'm not sure about their behaviour. Currently I must code website which heavily depends on "Likes" and "Tweets" about articles. Each article has Like and ...
1
vote
1answer
65 views

Are photos on Facebook servers stored with the geotagging metadata in their EXIF headers?

If i download photo from Facebook, will i be able to read its geotagging metadata, or Facebook just parse the uploaded photo, record all EXIF headers into the database (to show the camera model ...
1
vote
0answers
66 views

Facebook Login and OpenID Connect [closed]

Can someone confirm whether Facebook Login API (https://developers.facebook.com/docs/facebook-login/v2.2) is based on OpenID Connect (http://openid.net/connect/) specification? Thanks, Sameer
1
vote
1answer
131 views

How to suspend a silent oberserver from Facebook account?

A friend of mine told me about the following problem: She used to login on Facebook on a computer of her boyfriend. After they broke up she recognized that he was able to login to her account from his ...
1
vote
0answers
105 views

Password automatically typed into user box on facebook [closed]

Just want to ask some questions regarding on this strange experience while logging on my account on Facebook There are cases that I'm accidentally typing my password into the username box of the ...
2
votes
1answer
101 views

While logged in to Google etc., can a malicious site discover my ID?

If I visited a malicious site while being logged in to Google, Hotmail, Facebook, or Twitter in the same browser window, how hard is it for the site to discover my account IDs without my explicit ...
9
votes
3answers
1k views

Should we store accesstoken in our database for oauth2?

I have a requirement to implement Facebook and Google login in my web application. I also need to access a user's Facebook/Google+ friend list. I have gone through the complete OAuth2 documentation of ...
4
votes
1answer
168 views

Using Facebook via Tor

I think about using Tor for nearly everthing, including Facebook, because FB often tags the users even on other sites, for example per Like-Button, Cookies etc. Now I think about using the Tor ...
1
vote
1answer
86 views

Can Facebook login to my app?

This sounds maybe like a stupid question, but I'm wondering myself if this is theoretically possible. Let's say I'm using Facebook login in my app. If the login is successful I get I get back an ...
23
votes
1answer
2k views

Facebook password lowercase and uppercase

Recently I logged into my Facebook account and then noticed that my caps lock was on. So I tried to log in again with and without capslock on. I got in both times. Then I tried to log in with the ...
-2
votes
1answer
140 views

Stopping nosey people on Facebook [closed]

I thought I would ask this question here as it as to do with security. There are a few people on my Facebook that are close to me in real life. I don't mind it in real life (considering my real life ...
4
votes
2answers
240 views

Two-factor verification without a mobile phone?

Currently, some services use a second layer of veficiation if logging in from a new device: Gmail and Facebook send a text or call with a code Facebook generates a code in the mobile application ...
0
votes
1answer
706 views

What is the risk of installing Facebook Video Calling jar file?

I'm trying to talk with somebody on Facebook, but after many Facebook privacy scandals, it's a big question. Secondly on OSX, it's giving me the error that “FacebookVideoCalling_v1.6.jar” can’t be ...
1
vote
0answers
79 views

suspicious oauth2 implementation detail in facebook API

in RFC 6749 The OAuth 2.0 Authorization Framework 2.3.1. Client Password definitely states that authentication at TokenEndpoint can be done in two alternate ways HTTP basic authentication - ...
2
votes
1answer
2k views

Is this Facebook email real or phishing?

I received this email from what is supposedly Facebook today. Here's a screenshot: I was not aware I had credits or credits existed on Facebook and apparently I have $2.30 worth. It looks legitimate ...
0
votes
2answers
169 views

Track my girlfriend's stolen computer

My girlfriend just told me that her computer was stolen, the computer was hibernated and the second the thief turn the computer on a lots a things will open automatically. I'm hoping I can get the ...
0
votes
0answers
144 views

Exploit circulating Facebook with a .pnh file embedded in a <img> tag

Not sure how long this link will be up, but this is the page where users get redirected after trying to read a fake news post in someone timeline. [WARNING: ACCESS IN A CONTROLLED ENVIRONMENT] ...
0
votes
0answers
114 views

OAuth - Facebook custom authorization grant

I've developed my own custom authorization grant. The steps I am undertaking are the following: I get the facebook authorization code from the mobile device (this is an an API for mobile devices) I ...
0
votes
1answer
181 views

Did somebody connect to my facebook account?

I have a problem. I'm not sure, but I think that somebody (in our home network) found out a password to my Facebook account and sometimes logs in. Is there a way to find out whether it is true? There ...
0
votes
2answers
111 views

Malicious capabilities of Social Botnets

A fairly new concept in Malware, especially in the case of botnets, is the emergence of social botnets. These botnets are comprised of accounts (either a newly created account or an existing hijacked ...
43
votes
5answers
59k views

Anonymity on Facebook - how do they suggest people I should know?

I want to know how Facebook discovers the people who you know in real life or who know you. I tried the following to see if Facebook can still discover my acquaintances in real life and suggest them ...
2
votes
1answer
744 views

Facebook oAuth2 for Javascript client application

When implementing Facebook login using oAuth2 (the Javascript version), I receive an access token back from the Facebook auth server. So far so good. The problem I have is that I want to implement a ...
1
vote
2answers
148 views

How can Facebook use history data in browser

Web is filled up with the recent decision by Facebook to track user browsing history like adage.com andNYTimes. How can a web application use browsing history which is local to that browser? Is it ...
1
vote
1answer
349 views

How could the Skype app log me out from my Facebook account on OSX? Isn't this a huge security flaw?

According to this post (and to my personal experience), installing the Skype app on Facebook and the Skype client on OSX Mavericks will result in you being logged out from Facebook every time you ...
0
votes
0answers
182 views

Starting database security for web app that logs in with Facebook/Google JS SDKs

I have been making a web app that uses Facebook and Google JavaScript APIs to login (no email login) on the client side and currently it accesses a localhost MySQL database directly using PHP and ...
0
votes
1answer
144 views

Is this social engineering on facebook?

Today, I received a mail from fb saying that two of my friends have mentioned me in a comment. When I opened fb to see that comment, it was filled with random names (which obviously were their ...
0
votes
2answers
148 views

Can running a script while logged in compromise my facebook password?

In websites related to facebook malware analysis and information, we often see messages to the effect of if you have run this facebook app then your account has been compromised, or if you went to ...
-1
votes
3answers
343 views

Is there a safe way to open a possibly spam facebook attachment?

I got a spam attachment from two of my facebook friends I know it is spam because of the nature of the content I also know that these aren't the type of people to send such a message to me ...
2
votes
0answers
317 views

Content-Security-Policy & Facebook login

This question seems to be related to http://stackoverflow.com/questions/15913200/facebook-js-sdk-not-executed-in-my-chrome-extension , but I am not developing a chrome extension. I am developing a ...
0
votes
1answer
152 views

Protect from Facebook like clickjack

In the past month I've seen a better grade growth in sites that have clickjacking scripts that make you like the webpage or the Facebook site's Page when you click anywhere on the page. I have even ...
1
vote
1answer
611 views

Heartbleed and Facebook logins on (once) vulnerable sites [duplicate]

Users have been advised to consult a list of sites affected by heartbleed and to change their passwords on those sites once they are no longer vulnerable. Facebook appears to have been unaffected; but ...
1
vote
0answers
57 views

Purpose of Secure Key in Facebook(and other provider) in OAUTH?

I see lot of OAUTH provider give us a secure key. What is the purpose of secure key in Facebook(and other provider) in OAUTH?
131
votes
5answers
15k views

Does Facebook store plain-text passwords?

I was about to reset my Facebook password and got this error: Your new password is too similar to your current password. Please try another password. I assumed that Facebook stores only password ...
1
vote
1answer
92 views

What makes it difficult for Facebook to implement restriction/ACL for accessing uploaded photo? [closed]

Facebook claims to allow restrict sharing to friends, certain network, or even custom when I upload photos. But it appears that this security is only in effect for the page where the photo is ...
0
votes
1answer
191 views

WireShark and Facebook [closed]

Some time ago i try Wireshark at my home local network just for see how it works. I scan the connection of my mac to the router and also to other external ips. The flow of connections were high when i ...
4
votes
2answers
1k views

Why doesn't Facebook use HSTS

To force a browser to always use HTTPS for a website (and not rely on 302 redirects to visit the HTTPS version), HTTP Strict Transport Security can be used. Please refer to ...
0
votes
1answer
243 views

Should I encrypt Long-lived Facebook Access Token when storing them in my DB?

I own an application that grabs some Long-Lived Facebook Access token, in order to be use later according to the corresponding logged user. Should I need to encrypt them before storing them, to avoid ...
1
vote
2answers
411 views

Extracting Facebook ID or E-Mail from Browser History

While i was looking at my browser history i noticed there has been a facebook login from my computer, there are some facebook related messaging and profile links in my browser history (chrome). The ...
5
votes
1answer
492 views

Is it safe to use the official Facebook apps in a public Wifi?

I know, that my login credentials are sent in clear text for every body to read, when I log into facebook without using https from my mobile phone's browser in an public / non encrypted wifi. And I ...
0
votes
2answers
279 views

Is HTTPS + FacebookID + Secret Header token sufficient for a user login?

Disclosure - I'm not a security professional - but I have a security issue (I think) I need to articulate to a client. We have a partner organisation that has built an API for a mobile app we're ...
-4
votes
2answers
254 views

Inform someone about a hacked account [closed]

I'm not a hacker but recently I was able to get someone's email password. I want to teach him a lesson to be careful when using internet and to pay attention to his passwords but I have some problems: ...
1
vote
3answers
23k views

Trace facebook user ip. Is it even possible?

As I know facebook chat is working like user <> server <> user and it's not P2P. I was talking with some guys today and they were pretty sure it's possible to netstat a facebook user IP ...
2
votes
1answer
1k views

How could someone create a Facebook account with my email address without stealing it?

Someone with the same name as my sister seems to have inadvertently created a Facebook account with her email address. The funny thing is that this person doesn't seem to have ever accessed my ...
1
vote
0answers
293 views

Implementing OAuth flow in JavaScript

I am making a custom auth flow for the application. It is inspired by OAuth 2.0. Dev sends user to an auth page on my domain, passing callback_url and api_id. I redirect user to callback_url, passing ...
7
votes
2answers
332 views

How does an attacker abuse Facebook Connect with a leaked secret key?

I am reading about Facebook Connect and it looks a lot like OpenID Connect. Are these two similar enough that the Facebook Connect secret key is an OAuth Client Secret and therefore the same attacks ...