Tag Info

Hot answers tagged

118

Let's hope and assume that facebook stores only hashes of current password (and potentially previous passwords). Here is what they can do: user sets first password to "first" and fb stores hash("first"). later on, users resets password and is asked to provide new password "First2" facebook can generate bunch of passwords (similar to the new one): ...


78

So, yes, they appear to have a deal with the Telecommunication Providers in different Countries. Well that's ONE explanation. Another one that I like better is simply that they have all their users' contact lists, thanks to their mobile application which no doubt reads everything and sends it back to their headquarters. All they have to do after you ...


17

I wouldn't know if they do (don't even use Facebook), but it's also possible that they use Hardware Security Modules (HSM) for their cryptoprocessing that don't store hashed passwords but merely reversibly encrypt them. With the volume of authorization requests they have to deal with, this would make perfect sense, as it's orders of magnitude faster than ...


14

Repeat the same process, but use a new prepaid phone number. If they can still guess who you are then it is freaky. If not, then it is probably your friends' contact lists which have been sucked up into Facebook. It would be an interesting exercise to try the same, but with your work number and see what kind of connections Facebook infers from that.


13

There's only one correct answer to this. Nobody knows (except Facebook). Facebook could store your facebook password in plaintext, but there also might be some scheme that uses fuzzy hashes or pre-computed hashes of similar passwords. There is really no way of knowing unless we were to break into facebook and audit all of their assets.


12

You are correct. App secret should be secret and should not be easily obtained by reverse engineering your client code. Facebook uses OAuth so everything I say here also applies to all the applications that use OAuth to authorize and authenticate. The app secret authenticates your client to facebook. Just like a username/password authenticates a user to a ...


9

From what I can tell from that article it was an error with the Facebook "Connect" API. This is the button on a site that says "Log in with Facebook". It is just a link the site owner puts on the page. When the user clicks it, you are redirected to Facebook's server. The site owners have no control over what happens after this. It doesn't "bypass ...


7

Rather than logging in to accounts they control, I expect voter fraud would be done by clickjacking or CSRF, harnessing the social viral power of Facebook to attract unwitting accomplices. With the prevalence lately of images on Facebook that claim that you can obtain a PS4 simply by "liking" and "sharing" an image and the sheer numbers of people who do so, ...


6

There is absolutely nothing in the OpenID/OAuth authentication methods that guarantees an individual signing-in through them is indeed a unique user. OpenID provides a bit more data in a form of a certificate (user name, email address, and notary) than OAuth's valet key authentication, but that alone isn't enough to prevent voting fraud. Using the word fraud ...


6

Looks like the source domain is legit to me. Here's the whois result for the domain: Registrant: Domain Administrator Facebook, Inc. 1601 Willow Road Menlo Park CA 94025 US domain@fb.com +1.6505434800 Fax: +1.6505434800 Domain Name: facebookmail.com Registrar Name: Markmonitor.com Registrar Whois: whois.markmonitor.com ...


5

Relax, no need to worry. The email address password+kjdmiikvhppi@facebookmail.com does seem to be authentic. It could be spoofed, but if it were spoofed it would be very likely moved automatically to the Junk or Spam folder. Of course, it is possible that the email is spoofed and it wasn't caught in the spam filter, but I personally think it's not very ...


5

Facebook embeds videos in the News Feed and Timeline by using previous knowledge of the way each site supports embedding videos. That means Facebook tries to "understand" the page to which you're linking, and then attempts to embed it; the user doesn't actually control how the embedding happens, ie. when you see an embedded video on Facebook, you can be sure ...


5

The main method are probably cookies. Facebook will save a small textfile on your computer. Everytime you go to Facebook again it tries to read this file. This way it recognizes when your last login was and probably some other data. At the moment my browser has 13 cookies which come from Facebook. So if Facebook can't read your cookies it thinks that the ...


5

The "verification email" serves three purposes (at least): To deter evil people who automatically create thousands of users, for nefarious purposes (e.g. spamming). With the verification of emails, then such people must at least provide working email addresses, which makes them more traceable than when they do not. Also, the least competent of such wannabe ...


5

Facebook's chat platform utilises the XMPP protocol, which does not disclose the IP address of the client. You are correct in saying that Facebook does not use P2P in their chat. As far as I know, it is not possible to get a facebook IP via web chat of a contact without using social engineering. It may be worth checking whether IP addresses are disclosed ...


4

I am not Facebook, but if I were designing their linking system my reasoning for following the links would be this: Shortlinking systems like bit.ly and tinyurl.com are ubiquitous. We need to follow the link to the end in order to scrape content from the page (images, blurb of text) to put in your feed, as well as to correlate you with others that have ...


4

Facebook chat is running on XMPP protocol. It is decentralised, but not P2P. It is similar to email - there is no central server, but lots of domain servers talking to each other and taking care of their clients. I doubt that it would be possible to get IP address from XMPP.


4

I would suggest sending them an email - that is the full extent of your responsibilities as a good citizen. And then delete your copy of their password. In some jurisdictions you could already be considered to have breached rules or even laws. Don't now go and do something that will be illegal. Don't teach them a lesson; don't hack their facebook account; ...


3

No. In practice, there is no good solution to this problem. If you include a third-party Javascript library into your web page (via <SCRIPT SRC=...>), you are trusting that Javascript. That includes trusting it not to DoS you. That's just how it works, and there's no solution, given the current browser security model. If you don't trust the ...


3

Sounds strongly like it is a phishing attempt. The best bet is always to contact the party the e-mail claims to be and forward them the message. They can confirm or deny if it is a fake and it is good to let them know about the fakes that are going on out in the wild. Update: Facebook does send legit e-mails from this domain, but there are also a LOT of ...


3

There's no right or wrong answer to this, it all depends on what information you have to protect. If you are storing people's personal information or sensitive intellectual property on your intranet then using facebook logins are a bad idea because FB has no interest in security. FB does not enforce strong passwords. They allow very simple passwords and ...


3

Well, yes, hackers can extract all the information on almost every Facebook users, assuming that: hackers controlling botnets collude toward this unified goal, as members of the Worldwide League of Hackerdom; the data people post on Facebook is deemed sufficiently interesting to motivate the said hackers into such a coordinated effort. Belief that either ...


3

Contrary to the other answers, actually YES it is possible. However it is not actually so simple, and not exactly as you put it. Instead of directing your victim to a profile, you can send him to your Facebook app. Of course, this app needs to be registered as a valid facebook app, and etc. In the URL to your app, you can submit certain parameters - ...


3

In the case of Facebook — I don’t know about other OAuth-enabled sites — there is a possibility to use the anonymous aka application access token. It’s a token created by concatenating appId with appSecret, for instance 504216299598238|59d273f6dddb0a2f72e727132f4a74a4. One could obtain this access token from the mobile app source and make authenticated ...


3

Because using HTTPS for Facebook is optional. If you look in "Account Settings" and "Security Settings" there is an option for "Secure browsing". It has defaulted to on since July 2013 but you still have the option to turn it off. If they used HSTS then when you turned off "Secure browsing" the site would cease to work - at least, unless they did some ...


3

Directly, no. Indirectly, it's possible. One way: Have a web server, whose access log you control, up and running. Send your chat partner a unique hyperlink pointing to that web server, have them click the link. For example: http://yourdomain.com/JohnDoe.html (the web page does not have to exist, throwing a 404 is fine). Check your web server's access log ...


3

Another possibility is that fb doesn't hash, but encrypt passwords with their master key. Than they could decrypt it anytime to compare it to your new one. Let's hope not - they should hash it! As Rell3oT pointed out, no one knows except fb. So all we can do is throw wild guesses into the ring.


3

Another possibility is that Facebook stores a hash of your password, and a hash of the SOUNDEX of your password. Then when you enter your new password, it can compare the hash of its SOUNDEX with previously stored ones and respond that a password is too similar. This is, of course, purely conjecture.


2

PGP/GPG is the defacto standard, getting a non-technical user started can be done. Take into consideration that there are applications that can hemp the non-technical user, but the user must become more security aware if he does not one to leak his private key. There is a tool called Silent Circle which was created by Phill Zimmerman, the man behind PGP, ...


2

The short answer is no, this will not work the way you intend it. To understand why, you first need to understand how Facebook gets you to the correct profile. In the client's browser are cookies which Facebook uses to recognize their account. So, when the client visits the link, Facebook reads the cookies on the client's browser and takes them to the ...



Only top voted, non community-wiki answers of a minimum length are eligible