638 votes
Accepted

Why can I log in to my Facebook account with a misspelled email/password?

Facebook is allowing you to make a handful of mistakes to ease the login process. A Facebook engineer explained the process at a conference. The gist of it is that Facebook will try various ...
Allison's user avatar
  • 4,005
179 votes
Accepted

Does correcting misspelled usernames create a security risk?

As you said, you saw this on facebook - so I tried these steps: Login with [email protected] and real password -> works Login with [email protected] and real password -> works, too (!) Login with luksa@...
Lukas's user avatar
  • 3,188
168 votes
Accepted

Internet courtship: Why would a hacker buy me poker chips?

I interpret your question as: What's the motivation for someone to use an alien Facebook account to play poker and stock it with chips? It's not that strange if you think about it this way: As ...
Tobi Nary's user avatar
  • 14.4k
145 votes
Accepted

Logged out of Facebook on all devices on a sudden. Should I be worried about being hacked?

Facebook reported a data leak today and forced a large number of accounts to log off as a precaution. Source: NY Times and Facebook. That NYT article says "The company forced more than 90 million ...
Teun Vink's user avatar
  • 6,918
121 votes

How does Facebook track your browsing without third party cookies?

Facebook does not need to use third-party cookies to track you as you move from site to site, if the sites contain Facebook's javascript code (e.g. for the Facebook 'like' button). In this case, ...
mti2935's user avatar
  • 23.1k
105 votes
Accepted

I was tricked on Facebook into downloading an obfuscated script

This is a typical obfuscated JavaScript malware which targets the Windows Script Host to download the rest of the payload. In this case, it downloads what appears to be mainly a Chrome Extension (...
Alexander O'Mara's user avatar
89 votes

Find IM user location via netstat?

That article is wrong and that website in general seems like a very unreliable source for anything. With the netstat tool, among other stuff, you can see established TCP connections. When you use ...
skooog's user avatar
  • 1,008
87 votes

Why can I log in to my Facebook account with a misspelled email/password?

It is long know that Facebook allows you on purpose to log in with the password case reversed or the first character capitalized (see this article). They do this while storing only a hashed password. ...
Ángel's user avatar
  • 18.8k
64 votes

Internet courtship: Why would a hacker buy me poker chips?

To me it seems as if someone is doing fraud from your account. They load your FB with money (from a stolen credit card). Lose at poker so the money goes to another FB account. Withdraw that with an ...
k1308517's user avatar
  • 1,272
45 votes
Accepted

Website seeing my Facebook data?

I went on that website and this is what I saw: They are using the Customer Chat Plugin from Facebook. They don't know your name, they're just embedding an iframe to allow you to speak with their ...
Benoit Esnard's user avatar
37 votes

Why I am getting Facebook login pop up for every site?

This is a proxy authentication pop up! And it's most likely a proxy related attack. When you connect to the Internet through a proxy, you'll be asked to enter username and password if the proxy ...
Eibo's user avatar
  • 2,495
36 votes
Accepted

Why I am getting Facebook login pop up for every site?

TL;TR: it is probably a BlueCoat ProxySG or similar proxy which can be configured to behave that way. Nothing to worry about. Details: What you see is a dialog for HTTP basic access authentication. ...
Steffen Ullrich's user avatar
35 votes
Accepted

Is authentication using Facebook/Google considered good practice?

I am quite sure that there are some sites which require you to login with your facebook/google account on their site (so the URL shown is not facebook/google). I am sure there are some desktop ...
Out of Band's user avatar
  • 9,293
33 votes

Internet courtship: Why would a hacker buy me poker chips?

OP has clarified that this is Zynga Poker, in which no real money changes hands. That being the case, the most likely reasons for a fraudster to put money into your mother's account is that this ...
Richard's user avatar
  • 939
33 votes
Accepted

Does Facebook storing old passwords compromise security?

The other answers look pretty reasonable, but I wanted to add a few possibilities. If an attacker recovers one or more of your passwords from other breaches, it seems like plugging them into Facebook'...
abathur's user avatar
  • 498
31 votes
Accepted

How is Facebook not considered spyware?

Very Simple, Facebook IS spyware. It is also "Consensual" spyware...yeah, it's spying on you, but you agreed to it (even if you didn't read the agreement before checking the "I Agree" box), and it ...
Cos Callis's user avatar
29 votes

I was tricked on Facebook into downloading an obfuscated script

I haven't got the time to fully reverse-engineer what this script does, but it seems to link to several .jpg files that are actually not images but text, and then references some .au3 files, ...
André Borie's user avatar
  • 12.8k
29 votes

Why can I log in to my Facebook account with a misspelled email/password?

If you consider the login process as a whole, this measure can actually increase security. Instead of granting users several login attempts to manually fix common misspellings, the site tries to fix ...
Dmitry Grigoryev's user avatar
26 votes

How does Facebook track your browsing without third party cookies?

In addition to the other answers: The website you visited could have sent information about your visit directly to Facebook using their "Server-side API". This doesn't need any client-side ...
Aaron F's user avatar
  • 361
17 votes
Accepted

Privacy data concern: Facebook account appearing with a search for phone number, despite it never being added - what should I do?

There isn't much you can do about it besides deleting your Facebook profile (different from deactivating it - though I'm sure in both cases nothing is really deleted). As for how Facebook got your ...
André Borie's user avatar
  • 12.8k
17 votes

Find IM user location via netstat?

In addition to @skooog's answer which states that the IP address that you are detecting is not that of the user: IP address geolocation is, at least for IPv4, doomed to fail except in specific edge-...
wizzwizz4's user avatar
  • 275
16 votes

Does correcting misspelled usernames create a security risk?

Allowing username or email iteration may be a security problem for most sites, but not for Facebook. For sites as large as Facebook, finding emails that have accounts is easy because the sites have so ...
Neil Smithline's user avatar
15 votes

I was tricked on Facebook into downloading an obfuscated script

From what it looks like, a malicious actor leverage what is known as a XML External Entity vulnerability (XXE) and then a Server-Side Request Forgery (SSRF). Facebook's servers were tricked into ...
grepNstepN's user avatar
14 votes

I entered my password in a possible scam website. What should I do?

You should change the password at all the places where you have used it. Some Additional tips: Use a password manager. Use two factor authentication in every possible places. Never reuse passwords.
Rohith K D's user avatar
  • 1,029
13 votes

Logged out of Facebook on all devices on a sudden. Should I be worried about being hacked?

Are there any chances that someone was successfully able to get into my account? If yes, then how could they bypass the two-factor authentication? If your account had 2fa, it seems unlikely that an ...
Beanluc's user avatar
  • 305
13 votes
Accepted

What are the risks of installing a root certificate from Facebook on your phone?

Do you trust that Facebook and everyone they sell the data to will not use it for evil? Allowing Facebook to install a root certificate on your phone makes it possible for them to intercept any and ...
forest's user avatar
  • 66.6k
11 votes
Accepted

How did the Facebook Originull vulnerablity of Access-Control-Allow-Origin: null allow cross-origin access?

I'm Ysrael and I'm the researcher that found this vulnerability. Let's divide your question into 2 parts: A. How did the Origin of the browser become null? B. How the null Origin affect Facebook ...
Ysrael Gurt's user avatar
11 votes

Does Mozilla's new "Facebook Container" have any advantages over uBlock Origin?

To understand the differences, we have to look at the different goals of the two. Or in other words: What do they want to do? What do they do? And how does it affect you as an end user? In this answer ...
Tom K.'s user avatar
  • 7,975
11 votes
Accepted

How did Instagram know the content of my WhatsApp conversation and Google searches?

I'm figuring that the foundational knowledge about this topic is slowly being lost to time, and there are new course modules in schools around the world to cover this type of thing, so I think it's ...
schroeder's user avatar
  • 129k
10 votes

I was tricked on Facebook into downloading an obfuscated script

Is this an exploit on Facebook? Most likely. The unscrupulous are always trying to find ways to gain access to bank accounts, passwords, friend lists, and anything else they can do to turn a buck. ...
phyrfox's user avatar
  • 5,744

Only top scored, non community-wiki answers of a minimum length are eligible