Tag Info

Hot answers tagged

88

So, yes, they appear to have a deal with the Telecommunication Providers in different Countries. Well that's ONE explanation. Another one that I like better is simply that they have all their users' contact lists, thanks to their mobile application which no doubt reads everything and sends it back to their headquarters. All they have to do after you ...


35

This is simply Facebook trying to provide a better user experience for those users who may have Caps Lock enabled, or who's devices automatically capitalize the first letter of the password. I don't think there any any cookies per your question. It is likely that the password hashing and storage is as standard as you would expect. The alternate passwords ...


19

Repeat the same process, but use a new prepaid phone number. If they can still guess who you are then it is freaky. If not, then it is probably your friends' contact lists which have been sucked up into Facebook (not so freaky, just regular FB creepy). It would be an interesting exercise to try the same, but with your work number and see what kind of ...


12

Here is what using Tor to access an ordinary, non-onion facebook URL looks like: You -> Tor... -> facebook.com Now both of those links (from you to Tor and from Tor to facebook.com) happen on the open internet, so an attacker might watch packets flowing across those links like this: You -> (attacker) -> Tor... -> (attacker) -> ...


11

Visiting the .onion address never leaves the Tor network. Going to facebook.com over Tor exits the network and goes over the clear-net. That clear-net hop allows for an active attacker to get into your traffic. Now, your Facebook traffic is probably SSLed, right? If so, it doesn't matter much, but there's certainly more risk than not exiting the network ...


9

As you guessed, Facebook uses HTTPS, what that means is that requests to Facebook.com regardless of whether they are GET or POST requests are not sent over HTTP, instead they are sent over HTTPS in an encrypted form which the 'http' filter in Wireshark wont be able to display as regular HTTP requests. If you want to view the encrypted HTTPS traffic including ...


7

Technically you can store the access token in your database, and use it for API calls until it expires. It might be more trouble than its worth, though. For one thing, as Jonathan notes in his comment above, now you have to worry about securing your database and the data in it - these tokens give access to some fairly privileged information about your ...


5

Down at the bottom-right corner of the Gmail inbox is a "last account activity" line with a "details" link. You can click on that link to get a list of IP addresses that the account has been accessed from.


5

This has more to do with risk management. You do not have any contract with Facebook or Twitter. So you have a risk that they may change the contents of the JavaScript file without you knowing. This can be malicious or accidental, either way you have no control of this risk. So unless you get a contract with the external party which moves the liability to ...


4

I wouldn't put it past Facebook to "mess up". From the headers, it appears that Google's servers saw the request as coming from IP address 66.220.144.148, which is indeed part of the facebookmail.com domain. The Google server verified the DKIM signature on the email, relatively to the public key found in the DNS as a TXT record for ...


4

This is a normal facebook page. They just redirected you to a "Company page", that actually looks quite different than your personal "feed" page. The wifi actually redirected you to this page: https://www.facebook.com/CityLifeAUS and its pretty common for Wifi's to redirect you to their custom "start page" after authentication as a form of advertisement. ...


3

I think there is some confusion about the access token and how it is used which can cause a security problem. It is correct that the tokens can be a security risk, but this depends on the information you are asking for from the service. A friends list is more information than first and last name for instance, but that information is not as vital as personal ...


3

Yes, that, and a lot more if you use their mobile app. Also, they are not alone on harvesting everything; always read the app permissions list before installing an app, and consider whether you are willing to share your data with the app maker...


3

As a countermeasure against phishing emails. Such emails will look like legit email asking you to change or update your password, but their link will direct you to a false website (still looking as legit as possible, with URL such as micr0s0ft.com: here the letter 'O' was replaced by zeros '0', it looks like "microsoft.com" but it is not "microsoft.com") ...


3

I would recommend using Fiddler for this instead. First you will need to MITM yourself though as Facebook sends this request over HTTPS. You can do this in fiddler by going to Tools -> Fiddler Options -> HTTPS and ticking: Capture HTTPS Connects Decrypt HTTPS Traffic Then you will see a scary warning, as shown below: Clicking Yes will install an ...


3

It is true that bearer tokens and session tokens should not be passed int he url. The reasons are (according to OWASP): might disclose the session ID (in web links and logs, web browser history and bookmarks, the Referer header or search engines) In this specific case, I think Facebook did not care since the usage is logout - so after it has been ...


3

Update May 2015: Facebook now uses HSTS. Good work. $ http -h get https://www.facebook.com Strict-Transport-Security: max-age=15552000; preload See also https://www.ssllabs.com/ssltest/analyze.html?d=facebook.com


2

If i'm not wrong, At FAcebook -> settings -> security -> Active Sessions There is a history of devices connected to your account by date , with some useful info IP and city browser SO you can switch to a difference browser, and if some one else log in will report with a browser that you don't use. You can also disconnect them (unlink) from that panel ...


2

They can be used for large-scale spamming of links that may lead to advertising (best case scenario), phishing (most likely scenario) or worse : malware, and maybe use social engineering to convince the account's "friends" (the friends of the real owner of the account) to click on them or even download and install the malware. That malware can then be used ...


2

Many sites have social buttons. These images are hosted on the social networks servers. When these images are loaded in the browser, the browser will add the referer header. This allow the owners of the social network to know what sites you have visited. I believe this explains how facebook is able to track your browsing history. A web-browser plugin ...


2

First off, I am not associated with Facebook in any way, shape or form and I have no idea how the site code actually works. That said, this doesn't have to be a security issue at all. In very broad terms, here's how I suspect it's happening in the backend: Somewhere in FB's vast, vast database of user info there is a table that basically lists "The ...


2

If you type '/showplaces' on any Skype conversation, Skype will show you the "endpoints" used by your account. Send this information to "Skype Police Dept" (polrequest@skype.net) and they help you out.


2

To specifically address the scenario, Facebook doesn't need to wait until a user logs in to capture an OAuth token. Since you're trusting Facebook as your authentication provider, they can generate a valid OAuth token for any user in their system anytime they please. Given that, there are three potentially correct answers here. This is not a threat, ...


2

Several initiatives are ongoing to address this issue. Google has been working with the YubiKey folks to create a tiny dedicated USB dongle device to act as a second factor. You can see details here Forbes story here. You can also use YubiKey today to kludge up a solution if you are so inclined.


2

This really depends on the sites you're logged in to and how alert you are as a person. I can imagine the following scenarios (not specific to any of the sites you mentioned, but just general scenarios): Sensitive information is transmitted in the URL: For each request, a session ID is transmitted in the URL. In this case proxy servers will log the ...


2

It sounds like you got a notification from Facebook that required you to sign in, then at the login page it autofilled the form fields with the family member's credentials that she neglected to remove from the web browser before giving you the laptop. If that was the case, then note that following a link to Facebook will not pre-populate the form on your ...


2

Network traffic destined to the .onion address will only leave the Tor network inside the Facebook datacenter. Therefore outsiders on hostile networks (e.g. countries with strong censorship, corporate LANs with strict social media policies, malicious Tor exit node) will only see Tor-related traffic going in/out from your computer. Keep in mind this does ...


2

Despite the fact that Facebook locks accounts after many tries as the other answers said, you should keep in mind that "replacing your IP with a new one" is not as trivial as you make it sound. Most internet service provider allow you to release your IP lease and get a new IP address, but the attacker will usually receive one from a small pool of a few ...


2

If they keep coming back, it means that you have some software running checks on them. You should take some tool to analyze the running processes on your machine. Use Process Explorer to look at the current running processes (so that you can find out which one is recreating the reported keys and Autoruns to check the list of programs initiated ...


2

These sites set the HSTS header (HTTP Strict Transport Security). If you have visited these site without the Burp proxy before, your browser knows (cached) the HSTS policy and sees a mismatch. The HSTS Policy specifies a period of time during which the user shall access the server in a secure-only fashion. HTTP Strict Transport Security (HSTS) is a web ...



Only top voted, non community-wiki answers of a minimum length are eligible