41–50 of 70 posts
This is only a lapse in security if you're relying upon URL obfuscation for security to begin with. It is only actionable if you can MITM or otherwise easedrop and find the graph ID. Title rating: unreasonably alarmist
Earlier quoted context omitted.
Doesn't that make them liable for anything they miss? Eg: they're scanning chats for discussions about criminal activities, and reporting what they find to the police. If some people plan a murder in Facebook chat, it goes unnoticed, and they commit the murder, the victim's family could potentially sue Facebook for providing a forum for the planning to take place. Facebook can no longer claim that they're not respons…
The victim's family could potentially sue Facebook for providing a forum for the planning to take place, but is any judge going to rule in favour of the family? I think you'd have to establish that if Facebook Chat hadn't existed, then the murder never would have been planned (as opposed to the criminals simply using some other channel of communication such as email or talking on the phone). Just because Facebook is…
The FCC classified Internet Service Providers as common carriers, effective June 12, 2015, for the purpose of enforcing net neutrality. Before that time, the Good Samaritan provision of the Communications Decency Act established immunity from liability for third party content on grounds of libel or slander, and the DMCA established that ISPs that comply with the DMCA would not be liable for the copyright violations of third parties on their network.
My understanding (which may be flawed) is that "ISP" covers things like discussion forums, public chatrooms, and private(ish) chat like Skype and Facebook Messenger, and that the liability immunity goes beyond libel and slander. But, ISPs that filter third-party content are not protected because they're exerting control over the content, and implicitly approve of anything that is not filtered.
[0] https://en.wikipedia.org/wiki/Common_carrier#Telecommunicati...
FB also considers "won't fix" a bug I found a while ago that allows anyone to send anyone else on FB a spoofed email that comes from @facebook.com, without knowing their email address ¯\_(ツ)_/¯.
That's pretty severe surely. Any more information?
This probably isn't a popular opinion, but I fail to see how this is a problem with Facebook. The Google Docs URL is public whether or not you send it through Facebook. It's only secret until someone guesses the link (Edit: maybe not mathematically in the case of Google Docs, but many other services use 'unlisted' URLs without having a long token to guess) - something they can do without the URL even going through Me…
> It's only secret until someone guesses the link - something they can do without the URL even going through Messenger. Not really - a sufficiently large random number is effectively unguessable in your lifetime. This is no different than sharing a password with your partner in a private Facebook chat and discovering that outsiders can stumble on it.
This is only a lapse in security if you're relying upon URL obfuscation for security to begin with. It is only actionable if you can MITM or otherwise easedrop and find the graph ID. Title rating: unreasonably alarmist
What about WhatsApp? It fetches a page's title as soon as you type in a URL. I assume the fetching happens on the client, but does the URL (or the title itself) get uploaded somewhere?
This is only a lapse in security if you're relying upon URL obfuscation for security to begin with. It is only actionable if you can MITM or otherwise easedrop and find the graph ID. Title rating: unreasonably alarmist
Which is perfectly reasonable to do: a URL containing a cryptographically-secure identifier is itself a cryptographically-secure identifier. An example would be http://foo.invalid/ed2e898ff0b132202cb0bd0dea0d389a7b6439160....
Another example would be OAuth2 bearer tokens, which may be encoded in the URL as a parameter.
> It is only actionable if you can MITM or otherwise easedrop and find the graph ID.
It looks like the graph IDs are enumerable, rather than being high-entropy, so it looks like you can trawl through the graph looking for interesting objects.
Were they using 256-bit random identifiers then this wouldn't be a problem. In that case, the IDs would serve as capabilities to the resources.
I would much, much, much rather not have link previews than be open to this sort of simple exploit.
Seems like someone could just write a script to pull down a few thousand links, and then search for links from specific sites, private Google Docs documents, etc.