Tag Info

Hot answers tagged

131

Let's hope and assume that facebook stores only hashes of current password (and potentially previous passwords). Here is what they can do: user sets first password to "first" and fb stores hash("first"). later on, users resets password and is asked to provide new password "First2" facebook can generate bunch of passwords (similar to the new one): ...


85

So, yes, they appear to have a deal with the Telecommunication Providers in different Countries. Well that's ONE explanation. Another one that I like better is simply that they have all their users' contact lists, thanks to their mobile application which no doubt reads everything and sends it back to their headquarters. All they have to do after you ...


35

This is simply Facebook trying to provide a better user experience for those users who may have Caps Lock enabled, or who's devices automatically capitalize the first letter of the password. I don't think there any any cookies per your question. It is likely that the password hashing and storage is as standard as you would expect. The alternate passwords ...


17

I wouldn't know if they do (don't even use Facebook), but it's also possible that they use Hardware Security Modules (HSM) for their cryptoprocessing that don't store hashed passwords but merely reversibly encrypt them. With the volume of authorization requests they have to deal with, this would make perfect sense, as it's orders of magnitude faster than ...


17

Repeat the same process, but use a new prepaid phone number. If they can still guess who you are then it is freaky. If not, then it is probably your friends' contact lists which have been sucked up into Facebook. It would be an interesting exercise to try the same, but with your work number and see what kind of connections Facebook infers from that.


13

There's only one correct answer to this. Nobody knows (except Facebook). Facebook could store your facebook password in plaintext, but there also might be some scheme that uses fuzzy hashes or pre-computed hashes of similar passwords. There is really no way of knowing unless we were to break into facebook and audit all of their assets.


7

Directly, no. Indirectly, it's possible. One way: Have a web server, whose access log you control, up and running. Send your chat partner a unique hyperlink pointing to that web server, have them click the link. For example: http://yourdomain.com/JohnDoe.html (the web page does not have to exist, throwing a 404 is fine). Check your web server's access log ...


5

Down at the bottom-right corner of the Gmail inbox is a "last account activity" line with a "details" link. You can click on that link to get a list of IP addresses that the account has been accessed from.


3

I wouldn't put it past Facebook to "mess up". From the headers, it appears that Google's servers saw the request as coming from IP address 66.220.144.148, which is indeed part of the facebookmail.com domain. The Google server verified the DKIM signature on the email, relatively to the public key found in the DNS as a TXT record for ...


3

Another possibility is that Facebook stores a hash of your password, and a hash of the SOUNDEX of your password. Then when you enter your new password, it can compare the hash of its SOUNDEX with previously stored ones and respond that a password is too similar. This is, of course, purely conjecture.


3

Another possibility is that fb doesn't hash, but encrypt passwords with their master key. Than they could decrypt it anytime to compare it to your new one. Let's hope not - they should hash it! As Rell3oT pointed out, no one knows except fb. So all we can do is throw wild guesses into the ring.


3

Because using HTTPS for Facebook is optional. If you look in "Account Settings" and "Security Settings" there is an option for "Secure browsing". It has defaulted to on since July 2013 but you still have the option to turn it off. If they used HSTS then when you turned off "Secure browsing" the site would cease to work - at least, unless they did some ...


2

If it is server-to-server and you control the server that might be acceptable. But if this API is used from the client, No this is not OK. HTTPS will secure the secret from third-party eves-droppers but not from the user himself. Since the user controls the computer, they decide what certificates are trusted, and can install their own man-in-the-middle. ...


2

Many sites have social buttons. These images are hosted on the social networks servers. When these images are loaded in the browser, the browser will add the referer header. This allow the owners of the social network to know what sites you have visited. I believe this explains how facebook is able to track your browsing history. A web-browser plugin ...


2

First off, I am not associated with Facebook in any way, shape or form and I have no idea how the site code actually works. That said, this doesn't have to be a security issue at all. In very broad terms, here's how I suspect it's happening in the backend: Somewhere in FB's vast, vast database of user info there is a table that basically lists "The ...


2

If i'm not wrong, At FAcebook -> settings -> security -> Active Sessions There is a history of devices connected to your account by date , with some useful info IP and city browser SO you can switch to a difference browser, and if some one else log in will report with a browser that you don't use. You can also disconnect them (unlink) from that panel ...


2

They can be used for large-scale spamming of links that may lead to advertising (best case scenario), phishing (most likely scenario) or worse : malware, and maybe use social engineering to convince the account's "friends" (the friends of the real owner of the account) to click on them or even download and install the malware. That malware can then be used ...


2

Several initiatives are ongoing to address this issue. Google has been working with the YubiKey folks to create a tiny dedicated USB dongle device to act as a second factor. You can see details here Forbes story here. You can also use YubiKey today to kludge up a solution if you are so inclined.


2

If you type '/showplaces' on any Skype conversation, Skype will show you the "endpoints" used by your account. Send this information to "Skype Police Dept" (polrequest@skype.net) and they help you out.


2

To specifically address the scenario, Facebook doesn't need to wait until a user logs in to capture an OAuth token. Since you're trusting Facebook as your authentication provider, they can generate a valid OAuth token for any user in their system anytime they please. Given that, there are three potentially correct answers here. This is not a threat, ...


2

This really depends on the sites you're logged in to and how alert you are as a person. I can imagine the following scenarios (not specific to any of the sites you mentioned, but just general scenarios): Sensitive information is transmitted in the URL: For each request, a session ID is transmitted in the URL. In this case proxy servers will log the ...


1

There's an option "Who should see this?". As far as I know, changing that to custom and including someone, as you've mentioned here, your mom into "Don't share this", you can avoid getting monitored. For that commenting thing, you can choose to share only close friends, or like above, choose custom list. I guess, that's the only way


1

You can use a cloud-based password manager and a USB dongle. This would be the safest and most convenient solution especially if your phone is unavailable. USB dongle can be strengthened with a code. The token serves as a "something you have" factor and the code is "something you know" just like with your credit card. The database of your login credentials ...


1

Edit: I changed the workflow for the login. If a user would have multiple third party accounts, and each account uses a different email address, then the email address is not a valid identifier. Now I'm using local userId. 1) When the user wants to log in using a third party access such as Facebook or Google, then the client requests an access token with ...


1

it certainly is. you might want to google "Phishing". edit: i'm curious, what code did they ask to paste in the web console?


1

Short Answer: No, it can't. Explanation: The only way to obtain your password via a script is when you login (using keylogger etc.), since facebook secures, hashes & encrypts the password, its not visible anywhere. So a script wouldn't get to the password via the website, only via things such as a keylogger. addition: To prevent this scenario, keep ...


1

These programs typically make use of the fact that you were already authenticated to Facebook, so it does not need to steal your credentials as it already has access to your account. It is the same principle as you opening up your browser and already being logged into facebook. If you run this from within a VM that you have not logged into facebook through ...


1

But I have been told by others that it is possible to run scripts on facebook just by clicking a link (for example, if I click a link something gets posted on my wall that has all of my friends tagged in it). Is this true? Lookup Cross Site Request Forgery. I imagine Facebook takes a number of steps to prevent this kind of thing though. Downloading ...


1

Take a look at NoScript. Obviously its main purpose is to deactivate JavaScript (and other "add-ons" to your browser) globally and activate it only for selected (i.e. trusted) sites. Nevertheless it can be operated differently, e.g. you can leave JavaScript activated, while still profiting from other security mechanisms, e.g. its ClearClick technology, which ...


1

The sms vulnerability reported to Facebook was something else as far as I saw, it uses the Facebook's response to unregistered numbers to receive an unused confirmation code to reset password of other users... If you are using an Android device, I strongly suggest you should check your mobile for any malicious applications. While I was doing some research ...



Only top voted, non community-wiki answers of a minimum length are eligible