Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Links sent privately through Facebook Messenger can be read by anyone

medium.com

Post reply on HN
Print view View original

51–60 of 70 posts

Re: Links sent privately through Facebook Messenger can be read by anyone

#51

Post by niftich »

tuna-piano wrote: post #50
zeveb wrote: post #48

Were they using 256-bit random identifiers then this wouldn't be a problem. In that case, the IDs would serve as capabilities to the resources.

Anyone know why they would choose to use incremented integers and not 256-bit identifiers? This seems like a gaping hole to me that makes me uncomfortable sharing links in the tool. I would much, much, much rather not have link previews than be open to this sort of simple exploit. Seems like someone could just write a script to pull down a few thousand links, and then search for links from specific sites, private Goo…

In an earlier thread about this I wrote [1] that the contributing factors FB does aren't egregious by themselves. Specifically, in their view all of their link previews are public, as they were originally intended to catalogue the web.

Having predictable, incrementing integers as IDs for public resources isn't a problem. The problem is most people perceive Messenger as a private chat, and don't expect their privately-shared links to be catalogued in a publically accessible, trivially crawlable object store.

[1] https://news.ycombinator.com/item?id=11873258

Re: Links sent privately through Facebook Messenger can be read by anyone

#52

Post by tuna-piano »

It's infuriating to me as a user that certain aspects of a private 1-1 conversation are made public for a "feature" as trivial as a link preview, especially when it seems the fix would be as simple as having a larger, random identifier.

Does anyone know what will happen when Facebook Messenger is encrypted end to end?

Re: Links sent privately through Facebook Messenger can be read by anyone

#53

Post by tuna-piano »

IkmoIkmo wrote: post #4

Facebook's response seems inadequate. Because let's be frank here: 1) There are obvious security concerns thinkable. For example, plenty of websites (google docs, dropbox etc) offer an 'anyone with this link can view document' option. Which is generally safe, given these randomly generated links usually contain > 100 bits of entropy. Access to the link is access to the document, and so the link is a PW. 2) This link…

Couldn't an attacker simply run a script (from multiple source IPs) to get a large number of FB Messenger URLs - then parse the results for specific things - dropbox links, google docs links and other services that are secured through a long URL? I would guess there are examples of services that would be high value to attackers and are secured through the URL... although I can't think of any in particular.

Re: Links sent privately through Facebook Messenger can be read by anyone

#55

Post by GauntletWizard »

moron4hire wrote: post #45
KingMob wrote: post #27

Earlier quoted context omitted.

> It's only secret until someone guesses the link - something they can do without the URL even going through Messenger. Not really - a sufficiently large random number is effectively unguessable in your lifetime. This is no different than sharing a password with your partner in a private Facebook chat and discovering that outsiders can stumble on it.

Your one particular file is effectively unguessable, but that does not mean that guessing at files is a fruitless endeavor.

No, actually. It really doesn't take that many bits of entropy for you to be unable to find any documents in a haystack of entries. My file ID is 45 characters of base-64 encoded string. This is a total entropy of 225 bytes. If there are a quintillion files in google drive (a hundred million files per person who has ever lived), you were loading a million possible files per second, you'd still take several times the expected time to the heat death of the universe to randomly stumble upon one.

Re: Links sent privately through Facebook Messenger can be read by anyone

#56

Post by morley »

IkmoIkmo wrote: post #4

Facebook's response seems inadequate. Because let's be frank here: 1) There are obvious security concerns thinkable. For example, plenty of websites (google docs, dropbox etc) offer an 'anyone with this link can view document' option. Which is generally safe, given these randomly generated links usually contain > 100 bits of entropy. Access to the link is access to the document, and so the link is a PW. 2) This link…

According to the article, you need the resource ID of the link to query it in the API. The resource ID seems difficult to get; you basically need to be viewing the conversation (and thus the link) to get the ID. While I agree it's _possible_ to stumble onto sensitive information by downloading resource IDs, that seems too unwieldy to present a serious risk to any particular user. (It's the same amount of risk as, for example, trying to guess the URL of someone's hypothetical photo on the CDN.) Unless there's a way to get a list of resource IDs given someone's username, I'm inclined to think that this is a pretty minor security risk in the larger scheme of things, though it is scary to type a resource ID into their API tester and see a sensitive link come out.

Re: Links sent privately through Facebook Messenger can be read by anyone

#57

Post by epaulson »

aab0 wrote: post #54

This reminds me of the similar thing in Microsoft Office recently: it automatically shortened all links in documents, even private ones, with a URL shortener service. URL shortener services are, by design, easy to brute force enumerate. Cue popcorn...

The relevant blog post:

https://freedom-to-tinker.com/blog/vitaly/gone-in-six-charac...

Re: Links sent privately through Facebook Messenger can be read by anyone

#59

Post by dragonwriter »

IkmoIkmo wrote: post #4

Facebook's response seems inadequate. Because let's be frank here: 1) There are obvious security concerns thinkable. For example, plenty of websites (google docs, dropbox etc) offer an 'anyone with this link can view document' option. Which is generally safe, given these randomly generated links usually contain > 100 bits of entropy. Access to the link is access to the document, and so the link is a PW. 2) This link…

> For example, plenty of websites (google docs, dropbox etc) offer an 'anyone with this link can view document' option. Which is generally safe, given these randomly generated links usually contain > 100 bits of entropy. Access to the link is access to the document, and so the link is a PW.

This isn't really particular safe even if its unguessable, its more the internet equivalent of a casual privacy lock.

Re: Links sent privately through Facebook Messenger can be read by anyone

#60

Post by donatj »

chillacy wrote: post #38
donatj wrote: post #13

Earlier quoted context omitted.

https://www.cnet.com/news/facebook-scans-chats-and-posts-for...

While catching child predators and murderers is a good thing, I can't help but consider that if facebook operated in china, they'd be catching political dissidents, or if facebook operated in uganda, they'd be catching homosexual users.

Exactly. Ideally the communication should be encrypted in a way such that Facebook couldn't decrypt it if they wanted to.
Post reply on HN