The Stack Overflow podcast is back! Listen to an interview with our new CEO.
596

Facebook is allowing you to make a handful of mistakes to ease the login process. A Facebook engineer explained the process at a conference. The gist of it is that Facebook will try various permutations of the input you submitted and see if they match the hash they have in their database. For example, if your password is "myRealPassword!" but you submit "...


76

It is long know that Facebook allows you on purpose to log in with the password case reversed or the first character capitalized (see this article). They do this while storing only a hashed password. Are you seeing that more differences are allowed? Apparently, they also have some similar usability features for the email address. Automatically "correcting" ...


46

I went on that website and this is what I saw: They are using the Customer Chat Plugin from Facebook. They don't know your name, they're just embedding an iframe to allow you to speak with their Facebook page's administrator(s). Only Facebook knows who you are.


25

If you consider the login process as a whole, this measure can actually increase security. Instead of granting users several login attempts to manually fix common misspellings, the site tries to fix those misspellings automatically. As a result, the average number of login attempts a user needs goes down, which means a more strict rate limiting to an ...


13

You should change the password at all the places where you have used it. Some Additional tips: Use a password manager. Use two factor authentication in every possible places. Never reuse passwords.


12

Do you trust that Facebook and everyone they sell the data to will not use it for evil? Allowing Facebook to install a root certificate on your phone makes it possible for them to intercept any and all communications, even encrypted ones. They will be able to view everything from arbitrary private conversations to banking transactions or online purchases. ...


11

I'm figuring that the foundational knowledge about this topic is slowly being lost to time, and there are new course modules in schools around the world to cover this type of thing, so I think it's appropriate to cover it here. There is a separation between the content of a site and the advertisements shown on the site. Sites like Instagram (or newspapers, ...


8

Short answer: yes. Everything you send to Facebook is stored and processed, and that includes more than posts or pictures. All your likes, all links you click, all friends you check, how much time you spend on Facebook, how many times you use it, which hours you check. Everything. They earn money by knowing everything possible about you and everyone you ...


7

As far as I know there is no actual proof that FaceApp is used for malicious purposes, the same that there is no public available proof that companies like Huawei (China) or Kaspersky (Russia) will knowingly harm the (American, European, ...) security. The main argument here is that there might be increased risk since the government in these countries might ...


6

Facebook and Twitter have very...specific, controversial security postures. They serve a broad market and the security space does not always appreciate everything they do. My recommendation for an app you're building might be not to follow Facebook and Twitter's examples in terms of security. For resources, I recommend looking to OWASP first. If you're not ...


6

They probably won't. After all, dispelling and selling everyone's not-so-well-kept secrets - where they live, who they know, where they shop and what for... - is the social networks' business. Reaching this data is unlikely to require anything as dramatic as bribing high-ranking fb engineers. Face recognition data is largely used in the open, with the ...


5

At the moment it is impossible to know how secure it is, because it basically doesn't exist yet. It will be launched in 2020. Also, everything that revolves around blockchains tends to be controversial, because the at the moment the "blockchain" is still a solution in search of a problem. So I guess most answers will be based on speculation, and this ...


5

Facebook does not need to store the deleted photos. All they need to do is to use the photos you uploaded to extract the biometric details to be able to recognise your face. That data is what they use to verify new photos. This is all outlined in their privacy and security settings. You can turn the feature to collect facial biometric data off.


4

To determine if the account is authentic, Facebook looks at whether the photo is unique. -Wired They simply need to see if the photo is in the system to decide whether to investigate you further. If you upload a photo used by another user, you may be trying to create a fake account. Facebook also tries to determine the location where the photo was ...


3

Here's a couple of channels that may leak your location: friends tagging you in photos friends being in the same place as you (facebook finds friend groups, so if one of your friends is at bowling then FB may just try to advertise bowling to the whole friend group) other sites may have "share with facebook" buttons which report your current ip to facebook ...


3

Disclaimer: I am the creator of Grabify No you cannot have your Facebook account hacked by clicking on a Grabify link. To view the information it logs, you can see that here: https://grabify.link/faq/features To remove any of you logs from the website, you can do that here: https://grabify.link/removeme


3

Facebook controls everything inside the WhatsApp environment, i.e. the applications on the phones, the web access and the transport of the messages. Because of this it could also make any changes which would decrease the security in a way that the end-user will not notice. It might also make the changes in a way that security experts will not notice unless ...


3

Besides the fact the facebook account could have been created there is also the posibility that the emails are phising attempts that only look like they are coming from facebook. So do not follow links in the emails, it may not be facebook they go to. The idea in another answer to reset the password to prevent the account from being accessible by those who ...


2

Here are some habits I've implemented in order to limit Facebook's reach on my personal info: I have a browser dedicated to using Facebook and Instagram (which is owned by Facebook) and don't use it for anything else I have one of those anti-track plugins on my main browser that basically removes any known embedded trackers (Google Analytics, Facebook share ...


2

It's really less about what you have to hide and more about the chilling effect that happens when one corporate giant gets an unfair share of information - like the WhatsApp purchase mentioned in that article indicated. Any mega corp knowing exactly who their biggest competitor at every point in time is a scary thought. It would be one thing if everyone ...


2

Most likely culprit is shadow profiling (this is a pretty good article). This means that Facebook (and most other big tech companies) keep a profile on you even though you aren't specifically logged in. It's relatively easy to find you based on several metrics, which include but are not limited to: browser user-agent screen resolution IP installed fonts ...


2

Do not confuse end-to-end encryption with the generic idea of encryption. Encryption: you make the contents of a file visible to a restricted audience, probably including yourself End-to-end encryption: you create a scheme so that other people having conversations will encrypt messages each other but you make yourself, the owner of the schema, unable to ...


2

You are probably safe if these are true: You didn't click the link* Your browser is updated with the latest patches** You aren't using any chrome or browser extensions*** Your computer is updated with the latest OS patches**** Generally, most exploits utilize well known vulnerabilities in common software like your browser, operating system, popular ...


1

'Why does Google not encrypt your Whatsapp messages'? As mentioned briefly in the comment above, it is something that we will never really know, unless privy to the agreements between FB and Google. We can speculate though: Google makes it's money from data and information. The more information it gathers, the more opportunities it has to make money. Very ...


1

There are many possible use cases for this. Some of them are Location data - You told that you know this person. Both of you might have been in the same location many times. Contact Info - You have never synced your contacts online, but the other person might have. He did have your contact information. Same University - As you told, you both are from same ...


1

There is a keyboard combination in most browsers that saves the content of a link, in OS-X Chrome option+click does this. I know I often fat finger command+click(open in new tab) as option+click. This typo results in the browser saving the page and all resources of that page (javascript, css, images) into a folder by default on the desktop. I would suggest ...


1

Sorry, I have no tinfoil hat for you today. System 1 saves your photos and leaves a check in box "Account is ready for face verification". System 2 checks said box and puts your account on an internal list of accounts that have to be verified. You delete your photos and system 1 unchecks box "Account is ready for face verification". System 2 does not ...


1

For example, if someone somehow finds my Twitter password and installs the Twitter app on their smartphone wouldn't they get instantaneous access to my Twitter account? So how exactly does Google Authenticator on my device stop the hacker from accessing my account when they are not going to access it over the web in the first place? (Say they'll use a "...


1

The answer to the question, is there some way to report the issue, is yes! You can report the incident here: https://www.facebook.com/hacked


1

IP addresses are rarely a good way to identify someone: home IPs change often depending on the ISP, and the NAT'ed IP won't necessarily enable you to legally implicate someone within the network if there are multiple clients. The best way to de-obfuscate someone is to convince them to give up their info willingly. Standing up a forum or website that you ...


Only top voted, non community-wiki answers of a minimum length are eligible