Facebook is an online social networking service founded in February 2004 by Mark Zuckerberg.

learn more… | top users | synonyms

5
votes
2answers
617 views

Facebook POST request capture

I have been trying to test a sniff on facebook POST request forms using wireshark (filtered HTTP). At login form, I would try login, and then check wireshark and see that no packet was captured. ...
1
vote
3answers
48 views

External JS Security

I'm kinda new to security development. I've work mostly with backend processing stuff. I've been assign on how to secure external javascript that we import from facebook, twitter and google. One ...
2
votes
1answer
59 views

Why do Facebook and Microsoft make you enter a code when reseting a password?

Typically when you reset a website password you receive an email. A lot of sites send you a link with a code on the end of it to click on which will take you to an 'enter new password' form. ...
1
vote
0answers
60 views

How is Facebook Spam/Hacks Achieved? [closed]

Recently a handful of my Facebook friends flew off the handle screaming about how horribly they had been "hacked" and how scary it was and etc. It was my view that most of these "hacks" were simply ...
2
votes
1answer
96 views

Can all of Facebook's data be wiped out? [closed]

Is there a possibility that Facebook's entire data could ever be wiped out by a team of malicious individuals or even a government? Remotely or physically. If so, how do you think they would go about ...
0
votes
1answer
91 views

I just found many facebook entries on my registry? [closed]

I don't have a Facebook account but I was messing with my registry deleting old stuff and I found a bunch of Facebook keys and folders. Facebook is notorious for being a tool for spy agencies and has ...
1
vote
1answer
57 views

Which things can facebook access like contacts etc

I had two incidents . I added john to my skype account and i exchaged few messages. Then i went home and was checking facebook . Then at right side i saw Do you know john and it was his acoount ...
2
votes
3answers
232 views

How can Facebook possibly stop a bruteforce attack on an account?

I've been doing some research on hacking recently and I found some very interesting tutorials on brute force cracking. I have some questions to ask and I'll be using Facebook as an example. Let's say ...
1
vote
1answer
138 views

This facebook page looks different - phishing attempt?

After logging on to a public wifi, I was redirected to this page appearing to be from facebook, and being done via https: which looks markedly different from my normal facebook page I understand ...
1
vote
1answer
3k views

any information about en.quiente.info who has visited your account website

I ran across this site http://en.quiente.info, my friends tried it and they say it worked for them. It asks for most of the privileges on facebook even sending messages on behalf of you. Any one has ...
12
votes
3answers
282 views

Is there any difference between visiting Facebook via their Tor address, and visiting them via their normal address over Tor?

From a security perspective, is visiting via the .onion address more/less secure? I'm using Facebook as an example, but this question is really about any website which has both a 'normal' and a Tor ...
-1
votes
2answers
104 views

How can I tell if a website is sharing what videos I'm watching without my consent?

It seems that publishers are getting sued or threatened for possibly sharing video watching information - information that an individual has watched a video, before this individual has explicitly ...
-1
votes
1answer
69 views

Hacked email or total accident [closed]

I have a Facebook account which I look at occasionaly and access via the Facebook app. However whilst reading my emails I tried to access it from n email had they had sent me. I clicked the link which ...
3
votes
1answer
136 views

REST API stateless authentication using social login

I am implementing a REST API for our mobile applications in which user will login using the SDKs of various social media. Currently, the login strategy is as follows: The token(s) (access_token in ...
1
vote
2answers
59 views

Is it normal if user gets logged in Facebook or Twitter after they use Like or Tweet button? [closed]

Personally I don't use social networks, so I'm not sure about their behaviour. Currently I must code website which heavily depends on "Likes" and "Tweets" about articles. Each article has Like and ...
1
vote
1answer
149 views

Are photos on Facebook servers stored with the geotagging metadata in their EXIF headers?

If i download photo from Facebook, will i be able to read its geotagging metadata, or Facebook just parse the uploaded photo, record all EXIF headers into the database (to show the camera model ...
1
vote
0answers
85 views

Facebook Login and OpenID Connect [closed]

Can someone confirm whether Facebook Login API (https://developers.facebook.com/docs/facebook-login/v2.2) is based on OpenID Connect (http://openid.net/connect/) specification? Thanks, Sameer
1
vote
1answer
148 views

How to suspend a silent oberserver from Facebook account?

A friend of mine told me about the following problem: She used to login on Facebook on a computer of her boyfriend. After they broke up she recognized that he was able to login to her account from his ...
1
vote
0answers
127 views

Password automatically typed into user box on facebook [closed]

Just want to ask some questions regarding on this strange experience while logging on my account on Facebook There are cases that I'm accidentally typing my password into the username box of the ...
2
votes
1answer
110 views

While logged in to Google etc., can a malicious site discover my ID?

If I visited a malicious site while being logged in to Google, Hotmail, Facebook, or Twitter in the same browser window, how hard is it for the site to discover my account IDs without my explicit ...
13
votes
3answers
3k views

Should we store accesstoken in our database for oauth2?

I have a requirement to implement Facebook and Google login in my web application. I also need to access a user's Facebook/Google+ friend list. I have gone through the complete OAuth2 documentation of ...
4
votes
1answer
183 views

Using Facebook via Tor

I think about using Tor for nearly everthing, including Facebook, because FB often tags the users even on other sites, for example per Like-Button, Cookies etc. Now I think about using the Tor ...
1
vote
1answer
89 views

Can Facebook login to my app?

This sounds maybe like a stupid question, but I'm wondering myself if this is theoretically possible. Let's say I'm using Facebook login in my app. If the login is successful I get I get back an ...
23
votes
1answer
2k views

Facebook password lowercase and uppercase

Recently I logged into my Facebook account and then noticed that my caps lock was on. So I tried to log in again with and without capslock on. I got in both times. Then I tried to log in with the ...
-2
votes
1answer
167 views

Stopping nosey people on Facebook [closed]

I thought I would ask this question here as it as to do with security. There are a few people on my Facebook that are close to me in real life. I don't mind it in real life (considering my real life ...
4
votes
2answers
265 views

Two-factor verification without a mobile phone?

Currently, some services use a second layer of veficiation if logging in from a new device: Gmail and Facebook send a text or call with a code Facebook generates a code in the mobile application ...
0
votes
1answer
865 views

What is the risk of installing Facebook Video Calling jar file?

I'm trying to talk with somebody on Facebook, but after many Facebook privacy scandals, it's a big question. Secondly on OSX, it's giving me the error that “FacebookVideoCalling_v1.6.jar” can’t be ...
1
vote
0answers
87 views

suspicious oauth2 implementation detail in facebook API

in RFC 6749 The OAuth 2.0 Authorization Framework 2.3.1. Client Password definitely states that authentication at TokenEndpoint can be done in two alternate ways HTTP basic authentication - ...
2
votes
1answer
4k views

Is this Facebook email real or phishing?

I received this email from what is supposedly Facebook today. Here's a screenshot: I was not aware I had credits or credits existed on Facebook and apparently I have $2.30 worth. It looks legitimate ...
0
votes
2answers
186 views

Track my girlfriend's stolen computer

My girlfriend just told me that her computer was stolen, the computer was hibernated and the second the thief turn the computer on a lots a things will open automatically. I'm hoping I can get the ...
0
votes
0answers
157 views

Exploit circulating Facebook with a .pnh file embedded in a <img> tag

Not sure how long this link will be up, but this is the page where users get redirected after trying to read a fake news post in someone timeline. [WARNING: ACCESS IN A CONTROLLED ENVIRONMENT] ...
0
votes
0answers
126 views

OAuth - Facebook custom authorization grant

I've developed my own custom authorization grant. The steps I am undertaking are the following: I get the facebook authorization code from the mobile device (this is an an API for mobile devices) I ...
0
votes
1answer
190 views

Did somebody connect to my facebook account?

I have a problem. I'm not sure, but I think that somebody (in our home network) found out a password to my Facebook account and sometimes logs in. Is there a way to find out whether it is true? There ...
0
votes
2answers
119 views

Malicious capabilities of Social Botnets

A fairly new concept in Malware, especially in the case of botnets, is the emergence of social botnets. These botnets are comprised of accounts (either a newly created account or an existing hijacked ...
44
votes
5answers
75k views

Anonymity on Facebook - how do they suggest people I should know?

I want to know how Facebook discovers the people who you know in real life or who know you. I tried the following to see if Facebook can still discover my acquaintances in real life and suggest them ...
2
votes
1answer
813 views

Facebook oAuth2 for Javascript client application

When implementing Facebook login using oAuth2 (the Javascript version), I receive an access token back from the Facebook auth server. So far so good. The problem I have is that I want to implement a ...
1
vote
2answers
154 views

How can Facebook use history data in browser

Web is filled up with the recent decision by Facebook to track user browsing history like adage.com andNYTimes. How can a web application use browsing history which is local to that browser? Is it ...
1
vote
1answer
394 views

How could the Skype app log me out from my Facebook account on OSX? Isn't this a huge security flaw?

According to this post (and to my personal experience), installing the Skype app on Facebook and the Skype client on OSX Mavericks will result in you being logged out from Facebook every time you ...
0
votes
0answers
193 views

Starting database security for web app that logs in with Facebook/Google JS SDKs

I have been making a web app that uses Facebook and Google JavaScript APIs to login (no email login) on the client side and currently it accesses a localhost MySQL database directly using PHP and ...
0
votes
1answer
148 views

Is this social engineering on facebook?

Today, I received a mail from fb saying that two of my friends have mentioned me in a comment. When I opened fb to see that comment, it was filled with random names (which obviously were their ...
0
votes
2answers
159 views

Can running a script while logged in compromise my facebook password?

In websites related to facebook malware analysis and information, we often see messages to the effect of if you have run this facebook app then your account has been compromised, or if you went to ...
-1
votes
3answers
385 views

Is there a safe way to open a possibly spam facebook attachment?

I got a spam attachment from two of my facebook friends I know it is spam because of the nature of the content I also know that these aren't the type of people to send such a message to me ...
2
votes
0answers
349 views

Content-Security-Policy & Facebook login

This question seems to be related to http://stackoverflow.com/questions/15913200/facebook-js-sdk-not-executed-in-my-chrome-extension , but I am not developing a chrome extension. I am developing a ...
0
votes
1answer
171 views

Protect from Facebook like clickjack

In the past month I've seen a better grade growth in sites that have clickjacking scripts that make you like the webpage or the Facebook site's Page when you click anywhere on the page. I have even ...
1
vote
1answer
616 views

Heartbleed and Facebook logins on (once) vulnerable sites [duplicate]

Users have been advised to consult a list of sites affected by heartbleed and to change their passwords on those sites once they are no longer vulnerable. Facebook appears to have been unaffected; but ...
1
vote
0answers
63 views

Purpose of Secure Key in Facebook(and other provider) in OAUTH?

I see lot of OAUTH provider give us a secure key. What is the purpose of secure key in Facebook(and other provider) in OAUTH?
131
votes
5answers
16k views

Does Facebook store plain-text passwords?

I was about to reset my Facebook password and got this error: Your new password is too similar to your current password. Please try another password. I assumed that Facebook stores only password ...
1
vote
1answer
95 views

What makes it difficult for Facebook to implement restriction/ACL for accessing uploaded photo? [closed]

Facebook claims to allow restrict sharing to friends, certain network, or even custom when I upload photos. But it appears that this security is only in effect for the page where the photo is ...
0
votes
1answer
200 views

WireShark and Facebook [closed]

Some time ago i try Wireshark at my home local network just for see how it works. I scan the connection of my mac to the router and also to other external ips. The flow of connections were high when i ...
4
votes
2answers
2k views

Why doesn't Facebook use HSTS

To force a browser to always use HTTPS for a website (and not rely on 302 redirects to visit the HTTPS version), HTTP Strict Transport Security can be used. Please refer to ...