Hot answers tagged facebook
9
From what I can tell from that article it was an error with the Facebook "Connect" API.
This is the button on a site that says "Log in with Facebook". It is just a link the site owner puts on the page. When the user clicks it, you are redirected to Facebook's server. The site owners have no control over what happens after this.
It doesn't "bypass ...
8
You are correct. App secret should be secret and should not be easily obtained by reverse engineering your client code.
Facebook uses OAuth so everything I say here also applies to all the applications that use OAuth to authorize and authenticate. The app secret authenticates your client to facebook. Just like a username/password authenticates a user to a ...
7
Rather than logging in to accounts they control, I expect voter fraud would be done by clickjacking or CSRF, harnessing the social viral power of Facebook to attract unwitting accomplices.
With the prevalence lately of images on Facebook that claim that you can obtain a PS4 simply by "liking" and "sharing" an image and the sheer numbers of people who do so, ...
6
There is absolutely nothing in the OpenID/OAuth authentication methods that guarantees an individual signing-in through them is indeed a unique user. OpenID provides a bit more data in a form of a certificate (user name, email address, and notary) than OAuth's valet key authentication, but that alone isn't enough to prevent voting fraud. Using the word fraud ...
4
I am not Facebook, but if I were designing their linking system my reasoning for following the links would be this:
Shortlinking systems like bit.ly and tinyurl.com are ubiquitous.
We need to follow the link to the end in order to scrape content from the page (images, blurb of text) to put in your feed, as well as to correlate you with others that have ...
4
Contrary to the other answers, actually YES it is possible. However it is not actually so simple, and not exactly as you put it.
Instead of directing your victim to a profile, you can send him to your Facebook app. Of course, this app needs to be registered as a valid facebook app, and etc.
In the URL to your app, you can submit certain parameters - ...
3
Relax, no need to worry. The email address password+kjdmiikvhppi@facebookmail.com does seem to be authentic. It could be spoofed, but if it were spoofed it would be very likely moved automatically to the Junk or Spam folder. Of course, it is possible that the email is spoofed and it wasn't caught in the spam filter, but I personally think it's not very ...
3
There's no right or wrong answer to this, it all depends on what information you have to protect. If you are storing people's personal information or sensitive intellectual property on your intranet then using facebook logins are a bad idea because FB has no interest in security. FB does not enforce strong passwords. They allow very simple passwords and ...
3
Well, yes, hackers can extract all the information on almost every Facebook users, assuming that:
hackers controlling botnets collude toward this unified goal, as members of the Worldwide League of Hackerdom;
the data people post on Facebook is deemed sufficiently interesting to motivate the said hackers into such a coordinated effort.
Belief that either ...
3
Looks like the source domain is legit to me. Here's the whois result for the domain:
Registrant:
Domain Administrator
Facebook, Inc.
1601 Willow Road
Menlo Park CA 94025
US
domain@fb.com +1.6505434800 Fax: +1.6505434800
Domain Name: facebookmail.com
Registrar Name: Markmonitor.com
Registrar Whois: whois.markmonitor.com
...
3
No. In practice, there is no good solution to this problem. If you include a third-party Javascript library into your web page (via <SCRIPT SRC=...>), you are trusting that Javascript. That includes trusting it not to DoS you. That's just how it works, and there's no solution, given the current browser security model.
If you don't trust the ...
3
In the case of Facebook — I don’t know about other OAuth-enabled sites — there is a possibility to use the anonymous aka application access token. It’s a token created by concatenating appId with appSecret, for instance 504216299598238|59d273f6dddb0a2f72e727132f4a74a4.
One could obtain this access token from the mobile app source and make authenticated ...
2
The short answer is no, this will not work the way you intend it.
To understand why, you first need to understand how Facebook gets you to the correct profile. In the client's browser are cookies which Facebook uses to recognize their account. So, when the client visits the link, Facebook reads the cookies on the client's browser and takes them to the ...
2
You're going about it fine, and your intuition that using a security token on an insecure channel is insecure rings true. Many sites have fallen victim to impersonation attacks because they failed to protect session cookies via TLS (gmail, facebook, twitter, linkedIn, and many others). The short answer is use OAuth2.0 properly and then use TLS for any ...
2
First, this seems to have originated from a mistake by someone at facebook who has access to update their JS scripts to their CDN that was not noticed/fixed by someone at facebook for 15-20 minutes. I doubt it was a malicious attack (as it only redirected to an error page and only applied to people currently logged into facebook rather than everyone).
So ...
2
Sounds strongly like it is a phishing attempt. The best bet is always to contact the party the e-mail claims to be and forward them the message. They can confirm or deny if it is a fake and it is good to let them know about the fakes that are going on out in the wild.
Update: Facebook does send legit e-mails from this domain, but there are also a LOT of ...
2
Technically speaking, you are correct. Your Facebook data isn't encrypted and can be read by anyone with direct access to Facebook's database infrastructure.
Facebook's Data Use Policy, emphasis my own.
We use the information we receive about you in connection with the services and features we provide to you and other users like your friends, our ...
1
You asked if @em.facebookmail.com legitimate?
I performed some quick online IP reputations scans check from notable online vendors and here is the response. Quick snapshots.
Total tests performed 3
Test passed 3
http://www.urlvoid.com/scan/em.facebookmail.com/
http://onlinelinkscan.com/results/em-facebookmail-com/
http://www.phishtank.com/
...
1
Not real hijacking but serious security concern anyway!
Ok, journalist love to use strong words. So placing hijacking in title is right for trapping readers.
I'ts not really an hijacking as the link was present on victim website intentionally.
But.
As some of this sites are securised, while facebook don't, I think there seem to be a trick to work around ...
1
There isn't really much of an implication to security in this event. It wasn't linked to any compromise and was simply an error by a service provider. It does illustrate how widely used services like Facebook have become entangled with Single Sign On systems, but that isn't necessarily a bad thing strictly speaking as long as the single sign on isn't used ...
1
I'm not sure if i understood your question correctly, but there is already a system that controls from which domains JavaScript will be accepted.
If you are the owner of a website, then you can add the Content-Security-Policy (CSP) to the header of your pages. In the CSP you can define the domains, from whose a page accepts JavaScript. If the users browser ...
1
Perhaps this can help you.
http://www.adsafe.org/ - ADsafe makes it safe to put guest code (such as third party scripted advertising or widgets) on a web page. ADsafe defines a subset of JavaScript that is powerful enough to allow guest code to perform valuable interactions, while at the same time preventing malicious or accidental damage or intrusion.
...
1
Basic steps to securing your Facebook account:
Use a strong password
Link to a mobile device
Enable HTTPS
Enable login notifications
Enable login approvals
Check active sessions for suspicious activity
1
Facebook Login uses OAuth2.0 for authentication and authorization. The Login Dialog creates a trusted link between you, your users and their info.
Check the Facebook for developers website for details.
1
If at all possible, don't store OAuth tokens! Storing OAuth tokens makes your users susceptible to an attack vector they aren't aware of.
If you must store OAuth tokens then AES encrypt them with the best key you can use for this purpose. If users use a password to enter your site then generate an AES key based on the clear text password of each user (e.g. ...
1
No, this isn't possible. Otherwise https://facebook.com would also reveal your identity: it opens a page with your name on it and everything from your stream.
What you are thinking about can be done with a cross-site scripting attack. This would inject a script into the page, which can do whatever it wants with the website. It can send info it gathered to ...
Only top voted, non community-wiki answers of a minimum length are eligible
