Tag Info

Hot answers tagged

114

Let's hope and assume that facebook stores only hashes of current password (and potentially previous passwords). Here is what they can do: user sets first password to "first" and fb stores hash("first"). later on, users resets password and is asked to provide new password "First2" facebook can generate bunch of passwords (similar to the new one): ...


17

I wouldn't know if they do (don't even use Facebook), but it's also possible that they use Hardware Security Modules (HSM) for their cryptoprocessing that don't store hashed passwords but merely reversibly encrypt them. With the volume of authorization requests they have to deal with, this would make perfect sense, as it's orders of magnitude faster than ...


13

There's only one correct answer to this. Nobody knows (except Facebook). Facebook could store your facebook password in plaintext, but there also might be some scheme that uses fuzzy hashes or pre-computed hashes of similar passwords. There is really no way of knowing unless we were to break into facebook and audit all of their assets.


5

The "verification email" serves three purposes (at least): To deter evil people who automatically create thousands of users, for nefarious purposes (e.g. spamming). With the verification of emails, then such people must at least provide working email addresses, which makes them more traceable than when they do not. Also, the least competent of such wannabe ...


5

Facebook embeds videos in the News Feed and Timeline by using previous knowledge of the way each site supports embedding videos. That means Facebook tries to "understand" the page to which you're linking, and then attempts to embed it; the user doesn't actually control how the embedding happens, ie. when you see an embedded video on Facebook, you can be sure ...


5

The main method are probably cookies. Facebook will save a small textfile on your computer. Everytime you go to Facebook again it tries to read this file. This way it recognizes when your last login was and probably some other data. At the moment my browser has 13 cookies which come from Facebook. So if Facebook can't read your cookies it thinks that the ...


5

Relax, no need to worry. The email address password+kjdmiikvhppi@facebookmail.com does seem to be authentic. It could be spoofed, but if it were spoofed it would be very likely moved automatically to the Junk or Spam folder. Of course, it is possible that the email is spoofed and it wasn't caught in the spam filter, but I personally think it's not very ...


4

I would suggest sending them an email - that is the full extent of your responsibilities as a good citizen. And then delete your copy of their password. In some jurisdictions you could already be considered to have breached rules or even laws. Don't now go and do something that will be illegal. Don't teach them a lesson; don't hack their facebook account; ...


4

Facebook's chat platform utilises the XMPP protocol, which does not disclose the IP address of the client. You are correct in saying that Facebook does not use P2P in their chat. As far as I know, it is not possible to get a facebook IP via web chat of a contact without using social engineering. It may be worth checking whether IP addresses are disclosed ...


3

Another possibility is that Facebook stores a hash of your password, and a hash of the SOUNDEX of your password. Then when you enter your new password, it can compare the hash of its SOUNDEX with previously stored ones and respond that a password is too similar. This is, of course, purely conjecture.


3

Because using HTTPS for Facebook is optional. If you look in "Account Settings" and "Security Settings" there is an option for "Secure browsing". It has defaulted to on since July 2013 but you still have the option to turn it off. If they used HSTS then when you turned off "Secure browsing" the site would cease to work - at least, unless they did some ...


3

Another possibility is that fb doesn't hash, but encrypt passwords with their master key. Than they could decrypt it anytime to compare it to your new one. Let's hope not - they should hash it! As Rell3oT pointed out, no one knows except fb. So all we can do is throw wild guesses into the ring.


3

Facebook chat is running on XMPP protocol. It is decentralised, but not P2P. It is similar to email - there is no central server, but lots of domain servers talking to each other and taking care of their clients. I doubt that it would be possible to get IP address from XMPP.


3

There's no right or wrong answer to this, it all depends on what information you have to protect. If you are storing people's personal information or sensitive intellectual property on your intranet then using facebook logins are a bad idea because FB has no interest in security. FB does not enforce strong passwords. They allow very simple passwords and ...


2

The sum of what the client stores and what your server stores must be sufficient to recover the user-specific secret data (e.g. Facebook access token). What the client stores is, mostly, the user's password (the only permanent storage area on the client side is the user's brain, if we want to allow the user to use several distinct machines at will). If I ...


2

I was at the 10th ISC conference of security and cryptology last week and there I saw someone proposed a method for storing user-pass tokens using Neural Network. He's created a NN that learns user-pass tokens and updated itself using a fast NN learning method. It is a new method and promise security but needs lots of attention on learning. UPDATE The ...


2

I am not a lawyer, but it doesn't sound like any crime was committed, so the police aren't going to be able to help you. You can talk to a lawyer in your jurisdiction to be sure if any laws apply in this case, but if you publicly posted pictures, then they didn't steal anything by using them unless you had copyright notices posted with the images. If a ...


2

If it is server-to-server and you control the server that might be acceptable. But if this API is used from the client, No this is not OK. HTTPS will secure the secret from third-party eves-droppers but not from the user himself. Since the user controls the computer, they decide what certificates are trusted, and can install their own man-in-the-middle. ...


2

Most jurisdictions define computer crimes in terms of accessing systems to which you do not have legitimate access. Whether you gain that access by guessing the password or exploiting a web server loophole does not matter - you do not have a legitimate right to access the system, so if you access his Email accounts then it is illegal. I would suggest, that ...


2

Directly, no. Indirectly, it's possible. One way: Have a web server, whose access log you control, up and running. Send your chat partner a unique hyperlink pointing to that web server, have them click the link. For example: http://yourdomain.com/JohnDoe.html (the web page does not have to exist, throwing a 404 is fine). Check your web server's access log ...


2

PGP/GPG is the defacto standard, getting a non-technical user started can be done. Take into consideration that there are applications that can hemp the non-technical user, but the user must become more security aware if he does not one to leak his private key. There is a tool called Silent Circle which was created by Phill Zimmerman, the man behind PGP, ...


1

Take a look at NoScript. Obviously its main purpose is to deactivate JavaScript (and other "add-ons" to your browser) globally and activate it only for selected (i.e. trusted) sites. Nevertheless it can be operated differently, e.g. you can leave JavaScript activated, while still profiting from other security mechanisms, e.g. its ClearClick technology, which ...


1

Images are available through a CDN. This promotes faster loading and lower system load. It's also rather crucial for anything that's marked as public content. Since users can still copy and reupload images (to Facebook or elsewhere), the value of preventing CDN access to a known URL is very low. The technical complexity to add ACL rules is not immense, but ...


1

Simply: yes, encrypt it. And don't store the encryption key in the database. The token is tied to your app, so an attacker might not be able to use it alone, but if they can breach your database and get your app secret too they can use the token. You'd have to encrypt the app secret and the user tokens.


1

You can probably obtain information by looking at the browser cache. When the browser downloads pages, it stores copies of them in local files, so as to speed up operations if asked to inspect the same page again. Whether a specific page will be cached or not depends on what the server says about the page (there are HTTP headers for that); old pages are ...


1

In Facebook its possible to create account with another person email, but your account still unverified until you use one of the verification methods (phone, another email). The account can even be activated/verified if the real owner of the email address accidentally confirms by clicking on the link. Just go to the login page, and use the password ...


1

When an application is accessed using Facebook, an access token is associated with the user. This access token allows the app to have access level privilege to the user's profile. If this access token is stolen then it can be used to post contents onto the user's profile without his/her consent.


1

Without using PGP or some similar client based system, the best bet is a trusted mail server on both ends that enforce TLS to be used for e-mail exchange. It may or may not be possible for TLS to be broken by a highly sophisticated attacker like the NSA using quantum computers at this time, but it would still be highly expensive and thus unlikely they would ...



Only top voted, non community-wiki answers of a minimum length are eligible