Tag Info

Hot answers tagged

35

This is simply Facebook trying to provide a better user experience for those users who may have Caps Lock enabled, or who's devices automatically capitalize the first letter of the password. I don't think there any cookies per your question. It is likely that the password hashing and storage is as standard as you would expect. The alternate passwords are ...


12

Here is what using Tor to access an ordinary, non-onion facebook URL looks like: You -> Tor... -> facebook.com Now both of those links (from you to Tor and from Tor to facebook.com) happen on the open internet, so an attacker might watch packets flowing across those links like this: You -> (attacker) -> Tor... -> (attacker) -> ...


11

Visiting the .onion address never leaves the Tor network. Going to facebook.com over Tor exits the network and goes over the clear-net. That clear-net hop allows for an active attacker to get into your traffic. Now, your Facebook traffic is probably SSLed, right? If so, it doesn't matter much, but there's certainly more risk than not exiting the network ...


9

As you guessed, Facebook uses HTTPS, what that means is that requests to Facebook.com regardless of whether they are GET or POST requests are not sent over HTTP, instead they are sent over HTTPS in an encrypted form which the 'http' filter in Wireshark wont be able to display as regular HTTP requests. If you want to view the encrypted HTTPS traffic including ...


8

Technically you can store the access token in your database, and use it for API calls until it expires. It might be more trouble than its worth, though. For one thing, as Jonathan notes in his comment above, now you have to worry about securing your database and the data in it - these tokens give access to some fairly privileged information about your ...


6

This has more to do with risk management. You do not have any contract with Facebook or Twitter. So you have a risk that they may change the contents of the JavaScript file without you knowing. This can be malicious or accidental, either way you have no control of this risk. So unless you get a contract with the external party which moves the liability to ...


4

Despite the fact that Facebook locks accounts after many tries as the other answers said, you should keep in mind that "replacing your IP with a new one" is not as trivial as you make it sound. Most internet service provider allow you to release your IP lease and get a new IP address, but the attacker will usually receive one from a small pool of a few ...


4

This is a normal facebook page. They just redirected you to a "Company page", that actually looks quite different than your personal "feed" page. The wifi actually redirected you to this page: https://www.facebook.com/CityLifeAUS and its pretty common for Wifi's to redirect you to their custom "start page" after authentication as a form of advertisement. ...


4

Update May 2015: Facebook now uses HSTS. Good work. $ http -h get https://www.facebook.com Strict-Transport-Security: max-age=15552000; preload See also https://www.ssllabs.com/ssltest/analyze.html?d=facebook.com


3

As a countermeasure against phishing emails. Such emails will look like legit email asking you to change or update your password, but their link will direct you to a false website (still looking as legit as possible, with URL such as micr0s0ft.com: here the letter 'O' was replaced by zeros '0', it looks like "microsoft.com" but it is not "microsoft.com") ...


3

I think there is some confusion about the access token and how it is used which can cause a security problem. It is correct that the tokens can be a security risk, but this depends on the information you are asking for from the service. A friends list is more information than first and last name for instance, but that information is not as vital as personal ...


3

I would recommend using Fiddler for this instead. First you will need to MITM yourself though as Facebook sends this request over HTTPS. You can do this in fiddler by going to Tools -> Fiddler Options -> HTTPS and ticking: Capture HTTPS Connects Decrypt HTTPS Traffic Then you will see a scary warning, as shown below: Clicking Yes will install an ...


3

These sites set the HSTS header (HTTP Strict Transport Security). If you have visited these site without the Burp proxy before, your browser knows (cached) the HSTS policy and sees a mismatch. The HSTS Policy specifies a period of time during which the user shall access the server in a secure-only fashion. HTTP Strict Transport Security (HSTS) is a web ...


2

To specifically address the scenario, Facebook doesn't need to wait until a user logs in to capture an OAuth token. Since you're trusting Facebook as your authentication provider, they can generate a valid OAuth token for any user in their system anytime they please. Given that, there are three potentially correct answers here. This is not a threat, ...


2

This really depends on the sites you're logged in to and how alert you are as a person. I can imagine the following scenarios (not specific to any of the sites you mentioned, but just general scenarios): Sensitive information is transmitted in the URL: For each request, a session ID is transmitted in the URL. In this case proxy servers will log the ...


2

It sounds like you got a notification from Facebook that required you to sign in, then at the login page it autofilled the form fields with the family member's credentials that she neglected to remove from the web browser before giving you the laptop. If that was the case, then note that following a link to Facebook will not pre-populate the form on your ...


2

Network traffic destined to the .onion address will only leave the Tor network inside the Facebook datacenter. Therefore outsiders on hostile networks (e.g. countries with strong censorship, corporate LANs with strict social media policies, malicious Tor exit node) will only see Tor-related traffic going in/out from your computer. Keep in mind this does ...


2

Several initiatives are ongoing to address this issue. Google has been working with the YubiKey folks to create a tiny dedicated USB dongle device to act as a second factor. You can see details here Forbes story here. You can also use YubiKey today to kludge up a solution if you are so inclined.


2

If they keep coming back, it means that you have some software running checks on them. You should take some tool to analyze the running processes on your machine. Use Process Explorer to look at the current running processes (so that you can find out which one is recreating the reported keys and Autoruns to check the list of programs initiated ...


2

Yes, that, and a lot more if you use their mobile app. Also, they are not alone on harvesting everything; always read the app permissions list before installing an app, and consider whether you are willing to share your data with the app maker...


2

I know that facebook has a few different security settings and that not everyone uses them to the fullest extent, so I will just go with the settings that I know from personal experience. Your mileage may vary. Facebook has a built in method of determining a users chosen devices that are allowed to access the account. If someone from a new device attempts ...


2

It is true that bearer tokens and session tokens should not be passed int he url. The reasons are (according to OWASP): might disclose the session ID (in web links and logs, web browser history and bookmarks, the Referer header or search engines) In this specific case, I think Facebook did not care since the usage is logout - so after it has been ...


2

It looks like the IPv6 address of the machine that connected. It is made up of eight groups of four hexadecimal digits. You can search for the owner of the network and inform the ISP of that network. There are many but http://ip-lookup.net will search for info about IPv6 addresses. Update: I ran a lookup on my own address and got better results with ...


2

The only reason I can think of for which this procedure can make sense is to prevent someone who has physical access to your computer/smartphone from logging in the site. Given that the Facebook session is usually opened for most users, anyone with access to the computer/smartphone of these users could get access to the site, impersonating them. If you ...


1

Facebook does temporarily lock accounts. After too many authentication failures, it temporarily locks the facebook account for a few hours, and requires a security question/verification code to unlock the account for more verification attempts. After a 24 timeout period, you can log in again. To the consumer, 24 hours without Facebook is not the end of the ...


1

Token expiration may take place on the server side causing the client to reauth after x time. If youre looking to do social logins this method should be fine as long as youre transmitting the data over SSL and not saving credentials (U/P Combos) on your systems. The login endpoint should be running on HTTPS (again, read, secure) and should be connecting to ...


1

As soon as you download something, the site will know, and you have no control over who they share this information with. However, as @AJAr points out, the privacy policy of the site may affect it - as may the law. However, both the law, and a violation by a site of it's privacy policy, cannot change the damage that has already been done. You can try to ...


1

The answer to this is limited by the extents of sharing and personality one might deem significant to their own privacy. Most websites like these are legally obligated to reference a privacy policy linked at the foot of every page to describe what information is collected, how it may be shared and with whom (in terms of the content provider's relationship ...


1

I've been thinking about this and may have come up with an answer that will work for us, though I can't say whether it would work for you. In our environment, the main reason we might need to use access tokens is to operate on behalf of a user after some automated or backend process is complete, or on a schedule. In such a scenario we can't simply ask the ...


1

Most big websites do filter out EXIF and geocache data. If you were to take a picture on your phone with geocache on, and then upload it to a ftp server it would still have the EXIF and geocache data. I'm almost positive facebook keeps a original copy of the photo and then just redistributes a copy of it onto their website with different headers etc. At the ...



Only top voted, non community-wiki answers of a minimum length are eligible