Hot answers tagged

159

I interpret your question as: What's the motivation for someone to use an alien Facebook account to play poker and stock it with chips? It's not that strange if you think about it this way: As poker is a game where knowledge about the dealt cards gives you a significant edge in the game, you'd like to use sock puppets at a table to know more about the ...


158

As you said, you saw this on facebook - so I tried these steps: Login with lukas@gmail.com and real password -> works Login with lukas@gmail.cmo and real password -> works, too (!) Login with luksa@gmail.com and real password -> also works Login with luksa@mail.com and real password -> also works Login with lukas@gmail.cmo and wrong password -> Wrong ...


157

Let's hope and assume that facebook stores only hashes of current password (and potentially previous passwords). Here is what they can do: user sets first password to "first" and fb stores hash("first"). later on, users resets password and is asked to provide new password "First2" facebook can generate bunch of passwords (similar to the new one): ...


92

So, yes, they appear to have a deal with the Telecommunication Providers in different Countries. Well that's ONE explanation. Another one that I like better is simply that they have all their users' contact lists, thanks to their mobile application which no doubt reads everything and sends it back to their headquarters. All they have to do after you ...


64

To me it seems as if someone is doing fraud from your account. They load your FB with money (from a stolen credit card). Lose at poker so the money goes to another FB account. Withdraw that with an anonymous prepaid credit card. There are lots of different ways of doing carding (fraud). I'd contact FB and maybe the police as you might get a loud knock on ...


36

This is simply Facebook trying to provide a better user experience for those users who may have Caps Lock enabled, or who's devices automatically capitalize the first letter of the password. I don't think there any cookies per your question. It is likely that the password hashing and storage is as standard as you would expect. The alternate passwords are ...


35

This is a proxy authentication pop up! And it's most likely a proxy related attack. When you connect to the Internet through a proxy, you'll be asked to enter username and password if the proxy requires an authentication. For example: Note that the whole text The server http:// ... The server says is editable, and you can change it in the proxy server ...


32

OP has clarified that this is Zynga Poker, in which no real money changes hands. That being the case, the most likely reasons for a fraudster to put money into your mother's account is that this scamp has acquired/purchased a block of PayPal account details and is systematically testing them to see if they work by hacking into Facebook accounts and using ...


32

TL;TR: it is probably a BlueCoat ProxySG or similar proxy which can be configured to behave that way. Nothing to worry about. Details: What you see is a dialog for HTTP basic access authentication. This is not what Facebook uses for authentication. This means that this dialog is not from Facebook itself. My guess is that facebook.com is filtered by your ...


19

Repeat the same process, but use a new prepaid phone number. If they can still guess who you are then it is freaky. If not, then it is probably your friends' contact lists which have been sucked up into Facebook (not so freaky, just regular FB creepy). It would be an interesting exercise to try the same, but with your work number and see what kind of ...


18

I wouldn't know if they do (don't even use Facebook), but it's also possible that they use Hardware Security Modules (HSM) for their cryptoprocessing that don't store hashed passwords but merely reversibly encrypt them. With the volume of authorization requests they have to deal with, this would make perfect sense, as it's orders of magnitude faster than ...


16

You are correct. App secret should be secret and should not be easily obtained by reverse engineering your client code. Facebook uses OAuth so everything I say here also applies to all the applications that use OAuth to authorize and authenticate. The app secret authenticates your client to facebook. Just like a username/password authenticates a user to a ...


14

There's only one correct answer to this. Nobody knows (except Facebook). Facebook could store your facebook password in plaintext, but there also might be some scheme that uses fuzzy hashes or pre-computed hashes of similar passwords. There is really no way of knowing unless we were to break into facebook and audit all of their assets.


14

Technically you can store the access token in your database, and use it for API calls until it expires. It might be more trouble than its worth, though. For one thing, as Jonathan notes in his comment above, now you have to worry about securing your database and the data in it - these tokens give access to some fairly privileged information about your ...


12

Here is what using Tor to access an ordinary, non-onion facebook URL looks like: You -> Tor... -> facebook.com Now both of those links (from you to Tor and from Tor to facebook.com) happen on the open internet, so an attacker might watch packets flowing across those links like this: You -> (attacker) -> Tor... -> (attacker) -> ...


12

Allowing username or email iteration may be a security problem for most sites, but not for Facebook. For sites as large as Facebook, finding emails that have accounts is easy because the sites have so many users. This holds for other huge user databases like Google and Microsoft. These companies just have to be secure in the face of their username/email ...


11

Visiting the .onion address never leaves the Tor network. Going to facebook.com over Tor exits the network and goes over the clear-net. That clear-net hop allows for an active attacker to get into your traffic. Now, your Facebook traffic is probably SSLed, right? If so, it doesn't matter much, but there's certainly more risk than not exiting the network ...


10

Edit: Facebook now use HSTS, so both question and answer and now incorrect. Because using HTTPS for Facebook is optional. If you look in "Account Settings" and "Security Settings" there is an option for "Secure browsing". It has defaulted to on since July 2013 but you still have the option to turn it off. If they used HSTS then when you turned off "Secure ...


9

From what I can tell from that article it was an error with the Facebook "Connect" API. This is the button on a site that says "Log in with Facebook". It is just a link the site owner puts on the page. When the user clicks it, you are redirected to Facebook's server. The site owners have no control over what happens after this. It doesn't "bypass ...


9

Directly, no. Indirectly, it's possible. One way: Have a web server, whose access log you control, up and running. Send your chat partner a unique hyperlink pointing to that web server, have them click the link. For example: http://yourdomain.com/JohnDoe.html (the web page does not have to exist, throwing a 404 is fine). Check your web server's access log ...


9

As you guessed, Facebook uses HTTPS, what that means is that requests to Facebook.com regardless of whether they are GET or POST requests are not sent over HTTP, instead they are sent over HTTPS in an encrypted form which the 'http' filter in Wireshark wont be able to display as regular HTTP requests. If you want to view the encrypted HTTPS traffic including ...


8

Summary: HSTS is coming, but the site has some hurdles related to protecting user information such as not telling a website who you are when you click on a link. Explanation of that particular issue: https://www.facebook.com/notes/facebook-engineering/protecting-privacy-with-referrers/392382738919 Firefox is the last major holdout. Here's comment 14 (March ...


8

It's also entirely possible that the entire thing is a confidence scam. In this type of scam, someone gives you some money to let people engage in high-risk behavior (e.g. gambling), and the victim plays increasingly high-risk bets until, at some point, the other players at the victim's table (in reality, an assistant or bot ('shills'?) of the con artist) ...


7

Rather than logging in to accounts they control, I expect voter fraud would be done by clickjacking or CSRF, harnessing the social viral power of Facebook to attract unwitting accomplices. With the prevalence lately of images on Facebook that claim that you can obtain a PS4 simply by "liking" and "sharing" an image and the sheer numbers of people who do so, ...


7

A bookmarklet is basically a snippet of Javascript that runs on the website. As such, it has access to all your data on the site. Most bookmarklets don't do anything with your data, but it is certainly possible and you should always be careful.


7

The message means that Facebook has received some unusual requests from your computer, like for example a large number of attempts to guess passwords for different accounts or attempts to post spam. So Facebook assumes that you have some kind of malware on your computer and recommends you to install a malware scanner to get rid of it. For more information ...


6

Looks like the source domain is legit to me. Here's the whois result for the domain: Registrant: Domain Administrator Facebook, Inc. 1601 Willow Road Menlo Park CA 94025 US domain@fb.com +1.6505434800 Fax: +1.6505434800 Domain Name: facebookmail.com Registrar Name: Markmonitor.com Registrar Whois: whois.markmonitor.com ...


6

There is absolutely nothing in the OpenID/OAuth authentication methods that guarantees an individual signing-in through them is indeed a unique user. OpenID provides a bit more data in a form of a certificate (user name, email address, and notary) than OAuth's valet key authentication, but that alone isn't enough to prevent voting fraud. Using the word fraud ...


6

Facebook chat is running on XMPP protocol. It is decentralised, but not P2P. It is similar to email - there is no central server, but lots of domain servers talking to each other and taking care of their clients. I doubt that it would be possible to get IP address from XMPP.


6

Facebook's chat platform utilises the XMPP protocol, which does not disclose the IP address of the client. You are correct in saying that Facebook does not use P2P in their chat. As far as I know, it is not possible to get a facebook IP via web chat of a contact without using social engineering. It may be worth checking whether IP addresses are disclosed ...



Only top voted, non community-wiki answers of a minimum length are eligible