Tag Info

Hot answers tagged

128

Let's hope and assume that facebook stores only hashes of current password (and potentially previous passwords). Here is what they can do: user sets first password to "first" and fb stores hash("first"). later on, users resets password and is asked to provide new password "First2" facebook can generate bunch of passwords (similar to the new one): ...


83

So, yes, they appear to have a deal with the Telecommunication Providers in different Countries. Well that's ONE explanation. Another one that I like better is simply that they have all their users' contact lists, thanks to their mobile application which no doubt reads everything and sends it back to their headquarters. All they have to do after you ...


35

This is simply Facebook trying to provide a better user experience for those users who may have Caps Lock enabled, or who's devices automatically capitalize the first letter of the password. I don't think there any any cookies per your question. It is likely that the password hashing and storage is as standard as you would expect. The alternate passwords ...


17

Repeat the same process, but use a new prepaid phone number. If they can still guess who you are then it is freaky. If not, then it is probably your friends' contact lists which have been sucked up into Facebook. It would be an interesting exercise to try the same, but with your work number and see what kind of connections Facebook infers from that.


17

I wouldn't know if they do (don't even use Facebook), but it's also possible that they use Hardware Security Modules (HSM) for their cryptoprocessing that don't store hashed passwords but merely reversibly encrypt them. With the volume of authorization requests they have to deal with, this would make perfect sense, as it's orders of magnitude faster than ...


13

There's only one correct answer to this. Nobody knows (except Facebook). Facebook could store your facebook password in plaintext, but there also might be some scheme that uses fuzzy hashes or pre-computed hashes of similar passwords. There is really no way of knowing unless we were to break into facebook and audit all of their assets.


5

Facebook's chat platform utilises the XMPP protocol, which does not disclose the IP address of the client. You are correct in saying that Facebook does not use P2P in their chat. As far as I know, it is not possible to get a facebook IP via web chat of a contact without using social engineering. It may be worth checking whether IP addresses are disclosed ...


5

Facebook chat is running on XMPP protocol. It is decentralised, but not P2P. It is similar to email - there is no central server, but lots of domain servers talking to each other and taking care of their clients. I doubt that it would be possible to get IP address from XMPP.


5

Down at the bottom-right corner of the Gmail inbox is a "last account activity" line with a "details" link. You can click on that link to get a list of IP addresses that the account has been accessed from.


4

I would suggest sending them an email - that is the full extent of your responsibilities as a good citizen. And then delete your copy of their password. In some jurisdictions you could already be considered to have breached rules or even laws. Don't now go and do something that will be illegal. Don't teach them a lesson; don't hack their facebook account; ...


3

Directly, no. Indirectly, it's possible. One way: Have a web server, whose access log you control, up and running. Send your chat partner a unique hyperlink pointing to that web server, have them click the link. For example: http://yourdomain.com/JohnDoe.html (the web page does not have to exist, throwing a 404 is fine). Check your web server's access log ...


3

Another possibility is that fb doesn't hash, but encrypt passwords with their master key. Than they could decrypt it anytime to compare it to your new one. Let's hope not - they should hash it! As Rell3oT pointed out, no one knows except fb. So all we can do is throw wild guesses into the ring.


3

Another possibility is that Facebook stores a hash of your password, and a hash of the SOUNDEX of your password. Then when you enter your new password, it can compare the hash of its SOUNDEX with previously stored ones and respond that a password is too similar. This is, of course, purely conjecture.


3

Because using HTTPS for Facebook is optional. If you look in "Account Settings" and "Security Settings" there is an option for "Secure browsing". It has defaulted to on since July 2013 but you still have the option to turn it off. If they used HSTS then when you turned off "Secure browsing" the site would cease to work - at least, unless they did some ...


3

I wouldn't put it past Facebook to "mess up". From the headers, it appears that Google's servers saw the request as coming from IP address 66.220.144.148, which is indeed part of the facebookmail.com domain. The Google server verified the DKIM signature on the email, relatively to the public key found in the DNS as a TXT record for ...


2

If it is server-to-server and you control the server that might be acceptable. But if this API is used from the client, No this is not OK. HTTPS will secure the secret from third-party eves-droppers but not from the user himself. Since the user controls the computer, they decide what certificates are trusted, and can install their own man-in-the-middle. ...


2

Most jurisdictions define computer crimes in terms of accessing systems to which you do not have legitimate access. Whether you gain that access by guessing the password or exploiting a web server loophole does not matter - you do not have a legitimate right to access the system, so if you access his Email accounts then it is illegal. I would suggest, that ...


2

In Facebook its possible to create account with another person email, but your account still unverified until you use one of the verification methods (phone, another email). The account can even be activated/verified if the real owner of the email address accidentally confirms by clicking on the link. Just go to the login page, and use the password ...


2

Many sites have social buttons. These images are hosted on the social networks servers. When these images are loaded in the browser, the browser will add the referer header. This allow the owners of the social network to know what sites you have visited. I believe this explains how facebook is able to track your browsing history. A web-browser plugin ...


2

First off, I am not associated with Facebook in any way, shape or form and I have no idea how the site code actually works. That said, this doesn't have to be a security issue at all. In very broad terms, here's how I suspect it's happening in the backend: Somewhere in FB's vast, vast database of user info there is a table that basically lists "The ...


2

If you type '/showplaces' on any Skype conversation, Skype will show you the "endpoints" used by your account. Send this information to "Skype Police Dept" (polrequest@skype.net) and they help you out.


2

If i'm not wrong, At FAcebook -> settings -> security -> Active Sessions There is a history of devices connected to your account by date , with some useful info IP and city browser SO you can switch to a difference browser, and if some one else log in will report with a browser that you don't use. You can also disconnect them (unlink) from that panel ...


2

They can be used for large-scale spamming of links that may lead to advertising (best case scenario), phishing (most likely scenario) or worse : malware, and maybe use social engineering to convince the account's "friends" (the friends of the real owner of the account) to click on them or even download and install the malware. That malware can then be used ...


2

Several initiatives are ongoing to address this issue. Google has been working with the YubiKey folks to create a tiny dedicated USB dongle device to act as a second factor. You can see details here Forbes story here. You can also use YubiKey today to kludge up a solution if you are so inclined.


2

To specifically address the scenario, Facebook doesn't need to wait until a user logs in to capture an OAuth token. Since you're trusting Facebook as your authentication provider, they can generate a valid OAuth token for any user in their system anytime they please. Given that, there are three potentially correct answers here. This is not a threat, ...


1

Images are available through a CDN. This promotes faster loading and lower system load. It's also rather crucial for anything that's marked as public content. Since users can still copy and reupload images (to Facebook or elsewhere), the value of preventing CDN access to a known URL is very low. The technical complexity to add ACL rules is not immense, but ...


1

it certainly is. you might want to google "Phishing". edit: i'm curious, what code did they ask to paste in the web console?


1

Short Answer: No, it can't. Explanation: The only way to obtain your password via a script is when you login (using keylogger etc.), since facebook secures, hashes & encrypts the password, its not visible anywhere. So a script wouldn't get to the password via the website, only via things such as a keylogger. addition: To prevent this scenario, keep ...


1

These programs typically make use of the fact that you were already authenticated to Facebook, so it does not need to steal your credentials as it already has access to your account. It is the same principle as you opening up your browser and already being logged into facebook. If you run this from within a VM that you have not logged into facebook through ...


1

But I have been told by others that it is possible to run scripts on facebook just by clicking a link (for example, if I click a link something gets posted on my wall that has all of my friends tagged in it). Is this true? Lookup Cross Site Request Forgery. I imagine Facebook takes a number of steps to prevent this kind of thing though. Downloading ...



Only top voted, non community-wiki answers of a minimum length are eligible