Facebook is an online social networking service founded in February 2004 by Mark Zuckerberg.

learn more… | top users | synonyms

1
vote
1answer
39 views

Are photos on Facebook servers stored with the geotagging metadata in their EXIF headers?

If i download photo from Facebook, will i be able to read its geotagging metadata, or Facebook just parse the uploaded photo, record all EXIF headers into the database (to show the camera model ...
1
vote
0answers
35 views

Facebook Login and OpenID Connect [closed]

Can someone confirm whether Facebook Login API (https://developers.facebook.com/docs/facebook-login/v2.2) is based on OpenID Connect (http://openid.net/connect/) specification? Thanks, Sameer
1
vote
1answer
106 views

How to suspend a silent oberserver from Facebook account?

A friend of mine told me about the following problem: She used to login on Facebook on a computer of her boyfriend. After they broke up she recognized that he was able to login to her account from his ...
1
vote
0answers
86 views

Password automatically typed into user box on facebook [closed]

Just want to ask some questions regarding on this strange experience while logging on my account on Facebook There are cases that I'm accidentally typing my password into the username box of the ...
2
votes
1answer
95 views

While logged in to Google etc., can a malicious site discover my ID?

If I visited a malicious site while being logged in to Google, Hotmail, Facebook, or Twitter in the same browser window, how hard is it for the site to discover my account IDs without my explicit ...
5
votes
2answers
276 views

Should we store accesstoken in our database for oauth2?

I have a requirement to implement Facebook and Google login in my web application. I also need to access a user's Facebook/Google+ friend list. I have gone through the complete OAuth2 documentation of ...
3
votes
1answer
144 views

Using Facebook via Tor

I think about using Tor for nearly everthing, including Facebook, because FB often tags the users even on other sites, for example per Like-Button, Cookies etc. Now I think about using the Tor ...
1
vote
1answer
82 views

Can Facebook login to my app?

This sounds maybe like a stupid question, but I'm wondering myself if this is theoretically possible. Let's say I'm using Facebook login in my app. If the login is successful I get I get back an ...
23
votes
1answer
2k views

Facebook password lowercase and uppercase

Recently I logged into my Facebook account and then noticed that my caps lock was on. So I tried to log in again with and without capslock on. I got in both times. Then I tried to log in with the ...
-2
votes
1answer
104 views

Stopping nosey people on Facebook [closed]

I thought I would ask this question here as it as to do with security. There are a few people on my Facebook that are close to me in real life. I don't mind it in real life (considering my real life ...
4
votes
2answers
189 views

Two-factor verification without a mobile phone?

Currently, some services use a second layer of veficiation if logging in from a new device: Gmail and Facebook send a text or call with a code Facebook generates a code in the mobile application ...
0
votes
1answer
432 views

What is the risk of installing Facebook Video Calling jar file?

I'm trying to talk with somebody on Facebook, but after many Facebook privacy scandals, it's a big question. Secondly on OSX, it's giving me the error that “FacebookVideoCalling_v1.6.jar” can’t be ...
1
vote
0answers
63 views

suspicious oauth2 implementation detail in facebook API

in RFC 6749 The OAuth 2.0 Authorization Framework 2.3.1. Client Password definitely states that authentication at TokenEndpoint can be done in two alternate ways HTTP basic authentication - ...
2
votes
1answer
957 views

Is this Facebook email real or phishing?

I received this email from what is supposedly Facebook today. Here's a screenshot: I was not aware I had credits or credits existed on Facebook and apparently I have $2.30 worth. It looks legitimate ...
0
votes
2answers
142 views

Track my girlfriend's stolen computer

My girlfriend just told me that her computer was stolen, the computer was hibernated and the second the thief turn the computer on a lots a things will open automatically. I'm hoping I can get the ...
0
votes
0answers
137 views

Exploit circulating Facebook with a .pnh file embedded in a <img> tag

Not sure how long this link will be up, but this is the page where users get redirected after trying to read a fake news post in someone timeline. [WARNING: ACCESS IN A CONTROLLED ENVIRONMENT] ...
0
votes
0answers
100 views

OAuth - Facebook custom authorization grant

I've developed my own custom authorization grant. The steps I am undertaking are the following: I get the facebook authorization code from the mobile device (this is an an API for mobile devices) I ...
0
votes
1answer
169 views

Did somebody connect to my facebook account?

I have a problem. I'm not sure, but I think that somebody (in our home network) found out a password to my Facebook account and sometimes logs in. Is there a way to find out whether it is true? There ...
0
votes
2answers
97 views

Malicious capabilities of Social Botnets

A fairly new concept in Malware, especially in the case of botnets, is the emergence of social botnets. These botnets are comprised of accounts (either a newly created account or an existing hijacked ...
42
votes
5answers
37k views

Anonymity on Facebook - how do they suggest people I should know?

I want to know how Facebook discovers the people who you know in real life or who know you. I tried the following to see if Facebook can still discover my acquaintances in real life and suggest them ...
2
votes
1answer
679 views

Facebook oAuth2 for Javascript client application

When implementing Facebook login using oAuth2 (the Javascript version), I receive an access token back from the Facebook auth server. So far so good. The problem I have is that I want to implement a ...
1
vote
2answers
128 views

How can Facebook use history data in browser

Web is filled up with the recent decision by Facebook to track user browsing history like adage.com andNYTimes. How can a web application use browsing history which is local to that browser? Is it ...
1
vote
1answer
294 views

How could the Skype app log me out from my Facebook account on OSX? Isn't this a huge security flaw?

According to this post (and to my personal experience), installing the Skype app on Facebook and the Skype client on OSX Mavericks will result in you being logged out from Facebook every time you ...
0
votes
0answers
161 views

Starting database security for web app that logs in with Facebook/Google JS SDKs

I have been making a web app that uses Facebook and Google JavaScript APIs to login (no email login) on the client side and currently it accesses a localhost MySQL database directly using PHP and ...
0
votes
1answer
129 views

Is this social engineering on facebook?

Today, I received a mail from fb saying that two of my friends have mentioned me in a comment. When I opened fb to see that comment, it was filled with random names (which obviously were their ...
0
votes
2answers
128 views

Can running a script while logged in compromise my facebook password?

In websites related to facebook malware analysis and information, we often see messages to the effect of if you have run this facebook app then your account has been compromised, or if you went to ...
-1
votes
3answers
303 views

Is there a safe way to open a possibly spam facebook attachment?

I got a spam attachment from two of my facebook friends I know it is spam because of the nature of the content I also know that these aren't the type of people to send such a message to me ...
2
votes
0answers
288 views

Content-Security-Policy & Facebook login

This question seems to be related to http://stackoverflow.com/questions/15913200/facebook-js-sdk-not-executed-in-my-chrome-extension , but I am not developing a chrome extension. I am developing a ...
0
votes
1answer
138 views

Protect from Facebook like clickjack

In the past month I've seen a better grade growth in sites that have clickjacking scripts that make you like the webpage or the Facebook site's Page when you click anywhere on the page. I have even ...
1
vote
1answer
602 views

Heartbleed and Facebook logins on (once) vulnerable sites [duplicate]

Users have been advised to consult a list of sites affected by heartbleed and to change their passwords on those sites once they are no longer vulnerable. Facebook appears to have been unaffected; but ...
1
vote
0answers
53 views

Purpose of Secure Key in Facebook(and other provider) in OAUTH?

I see lot of OAUTH provider give us a secure key. What is the purpose of secure key in Facebook(and other provider) in OAUTH?
124
votes
5answers
14k views

Does Facebook store plain-text passwords?

I was about to reset my Facebook password and got this error: Your new password is too similar to your current password. Please try another password. I assumed that Facebook stores only password ...
1
vote
1answer
89 views

What makes it difficult for Facebook to implement restriction/ACL for accessing uploaded photo? [closed]

Facebook claims to allow restrict sharing to friends, certain network, or even custom when I upload photos. But it appears that this security is only in effect for the page where the photo is ...
0
votes
1answer
178 views

WireShark and Facebook [closed]

Some time ago i try Wireshark at my home local network just for see how it works. I scan the connection of my mac to the router and also to other external ips. The flow of connections were high when i ...
2
votes
2answers
1k views

Why doesn't Facebook use HSTS

To force a browser to always use HTTPS for a website (and not rely on 302 redirects to visit the HTTPS version), HTTP Strict Transport Security can be used. Please refer to ...
0
votes
1answer
215 views

Should I encrypt Long-lived Facebook Access Token when storing them in my DB?

I own an application that grabs some Long-Lived Facebook Access token, in order to be use later according to the corresponding logged user. Should I need to encrypt them before storing them, to avoid ...
1
vote
2answers
369 views

Extracting Facebook ID or E-Mail from Browser History

While i was looking at my browser history i noticed there has been a facebook login from my computer, there are some facebook related messaging and profile links in my browser history (chrome). The ...
3
votes
1answer
433 views

Is it safe to use the official Facebook apps in a public Wifi?

I know, that my login credentials are sent in clear text for every body to read, when I log into facebook without using https from my mobile phone's browser in an public / non encrypted wifi. And I ...
0
votes
2answers
263 views

Is HTTPS + FacebookID + Secret Header token sufficient for a user login?

Disclosure - I'm not a security professional - but I have a security issue (I think) I need to articulate to a client. We have a partner organisation that has built an API for a mobile app we're ...
-4
votes
2answers
243 views

Inform someone about a hacked account [closed]

I'm not a hacker but recently I was able to get someone's email password. I want to teach him a lesson to be careful when using internet and to pay attention to his passwords but I have some problems: ...
1
vote
3answers
18k views

Trace facebook user ip. Is it even possible?

As I know facebook chat is working like user <> server <> user and it's not P2P. I was talking with some guys today and they were pretty sure it's possible to netstat a facebook user IP ...
2
votes
1answer
925 views

How could someone create a Facebook account with my email address without stealing it?

Someone with the same name as my sister seems to have inadvertently created a Facebook account with her email address. The funny thing is that this person doesn't seem to have ever accessed my ...
1
vote
0answers
257 views

Implementing OAuth flow in JavaScript

I am making a custom auth flow for the application. It is inspired by OAuth 2.0. Dev sends user to an auth page on my domain, passing callback_url and api_id. I redirect user to callback_url, passing ...
7
votes
2answers
308 views

How does an attacker abuse Facebook Connect with a leaked secret key?

I am reading about Facebook Connect and it looks a lot like OpenID Connect. Are these two similar enough that the Facebook Connect secret key is an OAuth Client Secret and therefore the same attacks ...
9
votes
3answers
3k views

Best practices on securely storing access tokens

What would be the best practices for storing access tokens of another api for your users? In particular I'm developing an application with some friends that let's user log into Facebook to both ...
5
votes
1answer
282 views

Safe to drop email verification when using Facebook login

If a user registers an account on my Website with Facebook authentication, can I safely skip the "verification email" that is usually sent to users who sign up without Facebook (that is, from a ...
-3
votes
1answer
759 views

Track IP address of criminals [closed]

Quite recently someone had maliciously stolen my pictures and created a fake Facebook and Instagram in my name, with abusive captions under my pictures. However, with the advice from the police, I had ...
3
votes
1answer
235 views

Should I trust and play every embedded video on Facebook?

Regarding to trusted sites like YouTube, should I trust other videos when embedded to Facebook, usually, when user shares a link a thumbnail image will be created and previewed, then, we need only to ...
-1
votes
1answer
244 views

How Facebook Determines User Browser Change? [duplicate]

I recently logged in to my Facebook from other PC and got notice. Please login from the PC you previously logged in. I want to know what information Facebook uses to determine this change? I changed ...
7
votes
1answer
422 views

Is there a list of phone numbers Facebook uses to send auth tokens?

Up to a few days ago, I always received Facebook auth tokens from numbers +181338477XX, except a few times from +85294985XXX. Problem is that lately I've been receiving codes directly from Italian ...