Hot answers tagged

158

As you said, you saw this on facebook - so I tried these steps: Login with lukas@gmail.com and real password -> works Login with lukas@gmail.cmo and real password -> works, too (!) Login with luksa@gmail.com and real password -> also works Login with luksa@mail.com and real password -> also works Login with lukas@gmail.cmo and wrong password -> Wrong ...


35

This is a proxy authentication pop up! And it's most likely a proxy related attack. When you connect to the Internet through a proxy, you'll be asked to enter username and password if the proxy requires an authentication. For example: Note that the whole text The server http:// ... The server says is editable, and you can change it in the proxy server ...


32

TL;TR: it is probably a BlueCoat ProxySG or similar proxy which can be configured to behave that way. Nothing to worry about. Details: What you see is a dialog for HTTP basic access authentication. This is not what Facebook uses for authentication. This means that this dialog is not from Facebook itself. My guess is that facebook.com is filtered by your ...


12

Allowing username or email iteration may be a security problem for most sites, but not for Facebook. For sites as large as Facebook, finding emails that have accounts is easy because the sites have so many users. This holds for other huge user databases like Google and Microsoft. These companies just have to be secure in the face of their username/email ...


9

The message means that Facebook has received some unusual requests from your computer, like for example a large number of attempts to guess passwords for different accounts or attempts to post spam. So Facebook assumes that you have some kind of malware on your computer and recommends you to install a malware scanner to get rid of it. For more information ...


1

Based on the details you've provided here, I would say "Yes, that is a security risk" because it 100% identifies who is registered on the site. I don't know how many times a request can be submitted before a block is placed (CAPTCHA, IP-block, etc) but an attacker could simply "brute-force" a set of usernames and emails to obtain a pretty clear list of who ...



Only top voted, non community-wiki answers of a minimum length are eligible