Hot answers tagged

12

Here is what using Tor to access an ordinary, non-onion facebook URL looks like: You -> Tor... -> facebook.com Now both of those links (from you to Tor and from Tor to facebook.com) happen on the open internet, so an attacker might watch packets flowing across those links like this: You -> (attacker) -> Tor... -> (attacker) -> ...


11

Visiting the .onion address never leaves the Tor network. Going to facebook.com over Tor exits the network and goes over the clear-net. That clear-net hop allows for an active attacker to get into your traffic. Now, your Facebook traffic is probably SSLed, right? If so, it doesn't matter much, but there's certainly more risk than not exiting the network ...


9

As you guessed, Facebook uses HTTPS, what that means is that requests to Facebook.com regardless of whether they are GET or POST requests are not sent over HTTP, instead they are sent over HTTPS in an encrypted form which the 'http' filter in Wireshark wont be able to display as regular HTTP requests. If you want to view the encrypted HTTPS traffic including ...


6

This has more to do with risk management. You do not have any contract with Facebook or Twitter. So you have a risk that they may change the contents of the JavaScript file without you knowing. This can be malicious or accidental, either way you have no control of this risk. So unless you get a contract with the external party which moves the liability to ...


5

Despite the fact that Facebook locks accounts after many tries as the other answers said, you should keep in mind that "replacing your IP with a new one" is not as trivial as you make it sound. Most internet service provider allow you to release your IP lease and get a new IP address, but the attacker will usually receive one from a small pool of a few ...


5

From the first paragraph of the link you've provided: As a result, apps that don't support SHA-2 certificate signatures will no longer be able to connect to Facebook starting on October 1, 2015. I would read this differently to your interpretation. This is not a requirement to the apps to have certificates signed with SHA-2 but it is a requirement to ...


5

Go through the apps you gave some permission on facebook. Especially the "post on my behalf" permission. Remove any you don't trust (or don't remember giving them permissions). Anyway, it might be a one time thing, and there is nothing to get rid of. Read through this blog post for more information. In the extreme case, you might be indeed infected by ...


5

It is almost certain that whatever you do, your data will not be irrevocably destroyed. Even if the organisation you trusted with your personal data had the best of intentions it would be an enormous effort to really physically delete all of your data from all the places it will have been duplicated to, including backups and SSD spare sectors. No ...


5

We don't know what security measures Facebook exactly provides but spoofing the source IP of a TCP connection (which is used when accessing a web site) and still doing something useful with the connection is impossible in practice. This means that it is more likely that the site was really accessed from the shown IP address (no spoofing), that the database ...


4

There are several possibilities here: A tab in Firefox has a website that keeps connecting and refreshing an internal IP address. That might be a home NAS appliance that by coincidence has the same IP with your computer A Javascript script from a legitimate website attempts to scan the internal network using Cross Origin Requests or WebSockets. This ...


4

Update May 2015: Facebook now uses HSTS. Good work. $ http -h get https://www.facebook.com Strict-Transport-Security: max-age=15552000; preload See also https://www.ssllabs.com/ssltest/analyze.html?d=facebook.com


4

This is a normal facebook page. They just redirected you to a "Company page", that actually looks quite different than your personal "feed" page. The wifi actually redirected you to this page: https://www.facebook.com/CityLifeAUS and its pretty common for Wifi's to redirect you to their custom "start page" after authentication as a form of advertisement. ...


3

As a countermeasure against phishing emails. Such emails will look like legit email asking you to change or update your password, but their link will direct you to a false website (still looking as legit as possible, with URL such as micr0s0ft.com: here the letter 'O' was replaced by zeros '0', it looks like "microsoft.com" but it is not "microsoft.com") ...


3

These sites set the HSTS header (HTTP Strict Transport Security). If you have visited these site without the Burp proxy before, your browser knows (cached) the HSTS policy and sees a mismatch. The HSTS Policy specifies a period of time during which the user shall access the server in a secure-only fashion. HTTP Strict Transport Security (HSTS) is a web ...


3

I would recommend using Fiddler for this instead. First you will need to MITM yourself though as Facebook sends this request over HTTPS. You can do this in fiddler by going to Tools -> Fiddler Options -> HTTPS and ticking: Capture HTTPS Connects Decrypt HTTPS Traffic Then you will see a scary warning, as shown below: Clicking Yes will install an ...


3

does it mean all previews are sent from FB server? Or the link is embedded from the source? When you share a page on social media, the platform (in this case Facebook) pulls in certain information from the embedded webpage, including the title, author information, page summary, and often an image. More information can be specified in the html header in ...


2

Network traffic destined to the .onion address will only leave the Tor network inside the Facebook datacenter. Therefore outsiders on hostile networks (e.g. countries with strong censorship, corporate LANs with strict social media policies, malicious Tor exit node) will only see Tor-related traffic going in/out from your computer. Keep in mind this does ...


2

I know that facebook has a few different security settings and that not everyone uses them to the fullest extent, so I will just go with the settings that I know from personal experience. Your mileage may vary. Facebook has a built in method of determining a users chosen devices that are allowed to access the account. If someone from a new device attempts ...


2

Yes, that, and a lot more if you use their mobile app. Also, they are not alone on harvesting everything; always read the app permissions list before installing an app, and consider whether you are willing to share your data with the app maker...


2

Without an official statement from Facebook how these posts were made, we can only speculate. Many organizations which use Facebook professionally for social media campaigns, like election campaign offices of politicians, do not use Facebook directly but use software tools to post content. Such tools can be configured to schedule a time and date when a ...


2

If they keep coming back, it means that you have some software running checks on them. You should take some tool to analyze the running processes on your machine. Use Process Explorer to look at the current running processes (so that you can find out which one is recreating the reported keys and Autoruns to check the list of programs initiated ...


2

It is true that bearer tokens and session tokens should not be passed int he url. The reasons are (according to OWASP): might disclose the session ID (in web links and logs, web browser history and bookmarks, the Referer header or search engines) In this specific case, I think Facebook did not care since the usage is logout - so after it has been ...


2

It looks like the IPv6 address of the machine that connected. It is made up of eight groups of four hexadecimal digits. You can search for the owner of the network and inform the ISP of that network. There are many but http://ip-lookup.net will search for info about IPv6 addresses. Update: I ran a lookup on my own address and got better results with ...


2

The only reason I can think of for which this procedure can make sense is to prevent someone who has physical access to your computer/smartphone from logging in the site. Given that the Facebook session is usually opened for most users, anyone with access to the computer/smartphone of these users could get access to the site, impersonating them. If you ...


2

It's entirely possible that this has no bearing on your own devices or settings. Let's talk about the way one could go about designing that feature: Consider all connections one or two steps away. From those who have enabled syncing their contacts, consider those with a fuzzily matched name. Factored with some other heuristic scoring, you start seeing ...


2

We do not know how Facebook implements security internally, so we can only guess. But common best-practices regarding admin authentication is to use the IP address as an additional authentication factor, but not the only one. For example, it would not be uncommon to only allow admins to connect from specific IP addresses which were authorized for this, but ...


1

The site works (most likely- I haven't visited it either) by requesting YOUR permissions to see and record what YOU do. It then looks in its database to see if your friends also use it- if they do, it can show you what THEY have done. It can't show you what anyone who is not a member of their site is doing, which is why it is so insistent that you get your ...


1

Ideally you should not. If they have successfully authenticated through another means, don't impose further burdens on them. You can see that this method is used by the Stack Exchange network (for example) - after you have authenticated through Google, you don't have to create a password.


1

If you had notification alerts on, you would receive the login alert over SMS / E-mail (depends on you what have you chosen). And if you suspect that someone hacked into your account immediately change your password. Now, to answer your question: "Is there a way I can see why this SMS was sent?" There are no results for this question and I can't ...


1

It can be that he viewed your page or that you have some mutual facebook friends. Like old highschool/college friends or other people. Also the question you're asking is not relevant for this forum.



Only top voted, non community-wiki answers of a minimum length are eligible