Tag Info

Hot answers tagged

119

Let's hope and assume that facebook stores only hashes of current password (and potentially previous passwords). Here is what they can do: user sets first password to "first" and fb stores hash("first"). later on, users resets password and is asked to provide new password "First2" facebook can generate bunch of passwords (similar to the new one): ...


78

So, yes, they appear to have a deal with the Telecommunication Providers in different Countries. Well that's ONE explanation. Another one that I like better is simply that they have all their users' contact lists, thanks to their mobile application which no doubt reads everything and sends it back to their headquarters. All they have to do after you ...


17

I wouldn't know if they do (don't even use Facebook), but it's also possible that they use Hardware Security Modules (HSM) for their cryptoprocessing that don't store hashed passwords but merely reversibly encrypt them. With the volume of authorization requests they have to deal with, this would make perfect sense, as it's orders of magnitude faster than ...


14

Repeat the same process, but use a new prepaid phone number. If they can still guess who you are then it is freaky. If not, then it is probably your friends' contact lists which have been sucked up into Facebook. It would be an interesting exercise to try the same, but with your work number and see what kind of connections Facebook infers from that.


13

There's only one correct answer to this. Nobody knows (except Facebook). Facebook could store your facebook password in plaintext, but there also might be some scheme that uses fuzzy hashes or pre-computed hashes of similar passwords. There is really no way of knowing unless we were to break into facebook and audit all of their assets.


5

The "verification email" serves three purposes (at least): To deter evil people who automatically create thousands of users, for nefarious purposes (e.g. spamming). With the verification of emails, then such people must at least provide working email addresses, which makes them more traceable than when they do not. Also, the least competent of such wannabe ...


5

Facebook's chat platform utilises the XMPP protocol, which does not disclose the IP address of the client. You are correct in saying that Facebook does not use P2P in their chat. As far as I know, it is not possible to get a facebook IP via web chat of a contact without using social engineering. It may be worth checking whether IP addresses are disclosed ...


5

Down at the bottom-right corner of the Gmail inbox is a "last account activity" line with a "details" link. You can click on that link to get a list of IP addresses that the account has been accessed from.


4

Facebook chat is running on XMPP protocol. It is decentralised, but not P2P. It is similar to email - there is no central server, but lots of domain servers talking to each other and taking care of their clients. I doubt that it would be possible to get IP address from XMPP.


4

I would suggest sending them an email - that is the full extent of your responsibilities as a good citizen. And then delete your copy of their password. In some jurisdictions you could already be considered to have breached rules or even laws. Don't now go and do something that will be illegal. Don't teach them a lesson; don't hack their facebook account; ...


3

Another possibility is that Facebook stores a hash of your password, and a hash of the SOUNDEX of your password. Then when you enter your new password, it can compare the hash of its SOUNDEX with previously stored ones and respond that a password is too similar. This is, of course, purely conjecture.


3

Another possibility is that fb doesn't hash, but encrypt passwords with their master key. Than they could decrypt it anytime to compare it to your new one. Let's hope not - they should hash it! As Rell3oT pointed out, no one knows except fb. So all we can do is throw wild guesses into the ring.


3

Because using HTTPS for Facebook is optional. If you look in "Account Settings" and "Security Settings" there is an option for "Secure browsing". It has defaulted to on since July 2013 but you still have the option to turn it off. If they used HSTS then when you turned off "Secure browsing" the site would cease to work - at least, unless they did some ...


3

Directly, no. Indirectly, it's possible. One way: Have a web server, whose access log you control, up and running. Send your chat partner a unique hyperlink pointing to that web server, have them click the link. For example: http://yourdomain.com/JohnDoe.html (the web page does not have to exist, throwing a 404 is fine). Check your web server's access log ...


2

If it is server-to-server and you control the server that might be acceptable. But if this API is used from the client, No this is not OK. HTTPS will secure the secret from third-party eves-droppers but not from the user himself. Since the user controls the computer, they decide what certificates are trusted, and can install their own man-in-the-middle. ...


2

Most jurisdictions define computer crimes in terms of accessing systems to which you do not have legitimate access. Whether you gain that access by guessing the password or exploiting a web server loophole does not matter - you do not have a legitimate right to access the system, so if you access his Email accounts then it is illegal. I would suggest, that ...


2

I am not a lawyer, but it doesn't sound like any crime was committed, so the police aren't going to be able to help you. You can talk to a lawyer in your jurisdiction to be sure if any laws apply in this case, but if you publicly posted pictures, then they didn't steal anything by using them unless you had copyright notices posted with the images. If a ...


2

In Facebook its possible to create account with another person email, but your account still unverified until you use one of the verification methods (phone, another email). The account can even be activated/verified if the real owner of the email address accidentally confirms by clicking on the link. Just go to the login page, and use the password ...


2

The sum of what the client stores and what your server stores must be sufficient to recover the user-specific secret data (e.g. Facebook access token). What the client stores is, mostly, the user's password (the only permanent storage area on the client side is the user's brain, if we want to allow the user to use several distinct machines at will). If I ...


2

I was at the 10th ISC conference of security and cryptology last week and there I saw someone proposed a method for storing user-pass tokens using Neural Network. He's created a NN that learns user-pass tokens and updated itself using a fast NN learning method. It is a new method and promise security but needs lots of attention on learning. UPDATE The ...


2

They can be used for large-scale spamming of links that may lead to advertising (best case scenario), phishing (most likely scenario) or worse : malware, and maybe use social engineering to convince the account's "friends" (the friends of the real owner of the account) to click on them or even download and install the malware. That malware can then be used ...


2

Many sites have social buttons. These images are hosted on the social networks servers. When these images are loaded in the browser, the browser will add the referer header. This allow the owners of the social network to know what sites you have visited. I believe this explains how facebook is able to track your browsing history. A web-browser plugin ...


2

First off, I am not associated with Facebook in any way, shape or form and I have no idea how the site code actually works. That said, this doesn't have to be a security issue at all. In very broad terms, here's how I suspect it's happening in the backend: Somewhere in FB's vast, vast database of user info there is a table that basically lists "The ...


2

If i'm not wrong, At FAcebook -> settings -> security -> Active Sessions There is a history of devices connected to your account by date , with some useful info IP and city browser SO you can switch to a difference browser, and if some one else log in will report with a browser that you don't use. You can also disconnect them (unlink) from that panel ...


2

If you type '/showplaces' on any Skype conversation, Skype will show you the "endpoints" used by your account. Send this information to "Skype Police Dept" (polrequest@skype.net) and they help you out.


2

I wouldn't put it past Facebook to "mess up". From the headers, it appears that Google's servers saw the request as coming from IP address 66.220.144.148, which is indeed part of the facebookmail.com domain. The Google server verified the DKIM signature on the email, relatively to the public key found in the DNS as a TXT record for ...


1

it certainly is. you might want to google "Phishing". edit: i'm curious, what code did they ask to paste in the web console?


1

These programs typically make use of the fact that you were already authenticated to Facebook, so it does not need to steal your credentials as it already has access to your account. It is the same principle as you opening up your browser and already being logged into facebook. If you run this from within a VM that you have not logged into facebook through ...


1

But I have been told by others that it is possible to run scripts on facebook just by clicking a link (for example, if I click a link something gets posted on my wall that has all of my friends tagged in it). Is this true? Lookup Cross Site Request Forgery. I imagine Facebook takes a number of steps to prevent this kind of thing though. Downloading ...


1

Take a look at NoScript. Obviously its main purpose is to deactivate JavaScript (and other "add-ons" to your browser) globally and activate it only for selected (i.e. trusted) sites. Nevertheless it can be operated differently, e.g. you can leave JavaScript activated, while still profiting from other security mechanisms, e.g. its ClearClick technology, which ...



Only top voted, non community-wiki answers of a minimum length are eligible