Tag Info

Hot answers tagged

88

So, yes, they appear to have a deal with the Telecommunication Providers in different Countries. Well that's ONE explanation. Another one that I like better is simply that they have all their users' contact lists, thanks to their mobile application which no doubt reads everything and sends it back to their headquarters. All they have to do after you ...


35

This is simply Facebook trying to provide a better user experience for those users who may have Caps Lock enabled, or who's devices automatically capitalize the first letter of the password. I don't think there any any cookies per your question. It is likely that the password hashing and storage is as standard as you would expect. The alternate passwords ...


19

Repeat the same process, but use a new prepaid phone number. If they can still guess who you are then it is freaky. If not, then it is probably your friends' contact lists which have been sucked up into Facebook (not so freaky, just regular FB creepy). It would be an interesting exercise to try the same, but with your work number and see what kind of ...


12

Here is what using Tor to access an ordinary, non-onion facebook URL looks like: You -> Tor... -> facebook.com Now both of those links (from you to Tor and from Tor to facebook.com) happen on the open internet, so an attacker might watch packets flowing across those links like this: You -> (attacker) -> Tor... -> (attacker) -> ...


11

Visiting the .onion address never leaves the Tor network. Going to facebook.com over Tor exits the network and goes over the clear-net. That clear-net hop allows for an active attacker to get into your traffic. Now, your Facebook traffic is probably SSLed, right? If so, it doesn't matter much, but there's certainly more risk than not exiting the network ...


5

Down at the bottom-right corner of the Gmail inbox is a "last account activity" line with a "details" link. You can click on that link to get a list of IP addresses that the account has been accessed from.


4

Technically you can store the access token in your database, and use it for API calls until it expires. It might be more trouble than its worth, though. For one thing, as Jonathan notes in his comment above, now you have to worry about securing your database and the data in it - these tokens give access to some fairly privileged information about your ...


4

This is a normal facebook page. They just redirected you to a "Company page", that actually looks quite different than your personal "feed" page. The wifi actually redirected you to this page: https://www.facebook.com/CityLifeAUS and its pretty common for Wifi's to redirect you to their custom "start page" after authentication as a form of advertisement. ...


3

I wouldn't put it past Facebook to "mess up". From the headers, it appears that Google's servers saw the request as coming from IP address 66.220.144.148, which is indeed part of the facebookmail.com domain. The Google server verified the DKIM signature on the email, relatively to the public key found in the DNS as a TXT record for ...


3

Yes, that, and a lot more if you use their mobile app. Also, they are not alone on harvesting everything; always read the app permissions list before installing an app, and consider whether you are willing to share your data with the app maker...


3

As a countermeasure against phishing emails. Such emails will look like legit email asking you to change or update your password, but their link will direct you to a false website (still looking as legit as possible, with URL such as micr0s0ft.com: here the letter 'O' was replaced by zeros '0', it looks like "microsoft.com" but it is not "microsoft.com") ...


2

Many sites have social buttons. These images are hosted on the social networks servers. When these images are loaded in the browser, the browser will add the referer header. This allow the owners of the social network to know what sites you have visited. I believe this explains how facebook is able to track your browsing history. A web-browser plugin ...


2

First off, I am not associated with Facebook in any way, shape or form and I have no idea how the site code actually works. That said, this doesn't have to be a security issue at all. In very broad terms, here's how I suspect it's happening in the backend: Somewhere in FB's vast, vast database of user info there is a table that basically lists "The ...


2

They can be used for large-scale spamming of links that may lead to advertising (best case scenario), phishing (most likely scenario) or worse : malware, and maybe use social engineering to convince the account's "friends" (the friends of the real owner of the account) to click on them or even download and install the malware. That malware can then be used ...


2

If you type '/showplaces' on any Skype conversation, Skype will show you the "endpoints" used by your account. Send this information to "Skype Police Dept" (polrequest@skype.net) and they help you out.


2

If i'm not wrong, At FAcebook -> settings -> security -> Active Sessions There is a history of devices connected to your account by date , with some useful info IP and city browser SO you can switch to a difference browser, and if some one else log in will report with a browser that you don't use. You can also disconnect them (unlink) from that panel ...


2

To specifically address the scenario, Facebook doesn't need to wait until a user logs in to capture an OAuth token. Since you're trusting Facebook as your authentication provider, they can generate a valid OAuth token for any user in their system anytime they please. Given that, there are three potentially correct answers here. This is not a threat, ...


2

This really depends on the sites you're logged in to and how alert you are as a person. I can imagine the following scenarios (not specific to any of the sites you mentioned, but just general scenarios): Sensitive information is transmitted in the URL: For each request, a session ID is transmitted in the URL. In this case proxy servers will log the ...


2

It sounds like you got a notification from Facebook that required you to sign in, then at the login page it autofilled the form fields with the family member's credentials that she neglected to remove from the web browser before giving you the laptop. If that was the case, then note that following a link to Facebook will not pre-populate the form on your ...


2

Several initiatives are ongoing to address this issue. Google has been working with the YubiKey folks to create a tiny dedicated USB dongle device to act as a second factor. You can see details here Forbes story here. You can also use YubiKey today to kludge up a solution if you are so inclined.


2

Network traffic destined to the .onion address will only leave the Tor network inside the Facebook datacenter. Therefore outsiders on hostile networks (e.g. countries with strong censorship, corporate LANs with strict social media policies, malicious Tor exit node) will only see Tor-related traffic going in/out from your computer. Keep in mind this does ...


2

Despite the fact that Facebook locks accounts after many tries as the other answers said, you should keep in mind that "replacing your IP with a new one" is not as trivial as you make it sound. Most internet service provider allow you to release your IP lease and get a new IP address, but the attacker will usually receive one from a small pool of a few ...


2

If they keep coming back, it means that you have some software running checks on them. You should take some tool to analyze the running processes on your machine. Use Process Explorer to look at the current running processes (so that you can find out which one is recreating the reported keys and Autoruns to check the list of programs initiated ...


1

As soon as you download something, the site will know, and you have no control over who they share this information with. However, as @AJAr points out, the privacy policy of the site may affect it - as may the law. However, both the law, and a violation by a site of it's privacy policy, cannot change the damage that has already been done. You can try to ...


1

The answer to this is limited by the extents of sharing and personality one might deem significant to their own privacy. Most websites like these are legally obligated to reference a privacy policy linked at the foot of every page to describe what information is collected, how it may be shared and with whom (in terms of the content provider's relationship ...


1

Most big websites do filter out EXIF and geocache data. If you were to take a picture on your phone with geocache on, and then upload it to a ftp server it would still have the EXIF and geocache data. I'm almost positive facebook keeps a original copy of the photo and then just redistributes a copy of it onto their website with different headers etc. At the ...


1

One possibility is that her passwords are being synced through the browser. If this is true then even if she changes her password it can be updated on any synced device (convenient for someone who is not in this situation). To remedy this, she will need to change her browser sync settings and password, then change her facebook password (and others) again. I ...


1

I think there is some confusion about the access token and how it is used which can cause a security problem. It is correct that the tokens can be a security risk, but this depends on the information you are asking for from the service. A friends list is more information than first and last name for instance, but that information is not as vital as personal ...


1

If I'm reading your question correctly, you'll be fine. You're still hooked up to Facebook via SSL, whose security isn't, at the moment, broken. Tor now includes HTTPS Everywhere, which would force Facebook to use SSL (assuming it was supported) even if it didn't do so by default (which, at the moment, it does). Since Firesheep (a bit later in 2010 than that ...


1

Short awnser: Yes and No Explanation: Facebook Claims they use TLS/SSL everywhere, but after a bit of poking around using Wireshark, i found out that logging in, visiting timeline etc. all go over HTTPS (no port 80 connections detected), when visiting certain elements though, like apps/games, photo's and such, i detected HTTP connections through port 80. ...



Only top voted, non community-wiki answers of a minimum length are eligible