I've been using the destructible.io for temp links. It was posted here not too long ago, useful and if anyone else tries to access it, it deletes itself https://destructible.io
Links sent privately through Facebook Messenger can be read by anyone
61–70 of 70 posts
Re: Links sent privately through Facebook Messenger can be read by anyone
#62Re: Links sent privately through Facebook Messenger can be read by anyone
#63Please. Delete. Your. Accounts.
What are you waiting for?
Challenge:
Start a decentralized FB clone. Evangelize.
Re: Links sent privately through Facebook Messenger can be read by anyone
#64Facebook's response seems inadequate. Because let's be frank here: 1) There are obvious security concerns thinkable. For example, plenty of websites (google docs, dropbox etc) offer an 'anyone with this link can view document' option. Which is generally safe, given these randomly generated links usually contain > 100 bits of entropy. Access to the link is access to the document, and so the link is a PW. 2) This link…
According to the article, you need the resource ID of the link to query it in the API. The resource ID seems difficult to get; you basically need to be viewing the conversation (and thus the link) to get the ID. While I agree it's _possible_ to stumble onto sensitive information by downloading resource IDs, that seems too unwieldy to present a serious risk to any particular user. (It's the same amount of risk as, for…
So near the end of the article, author actually shows that it's easy to write a scraper that finds other URLs by enumerating their IDs.
Re: Links sent privately through Facebook Messenger can be read by anyone
#65Earlier quoted context omitted.
Ok, if I send you an email from facebookadminforsure@gmail.com with a link saying "Your Facebook account has been compromised" that takes to a phising page, you probably won't click. If I try to spoof my email to make it look like I'm sending it from @facebook.com, your webmail provider will tell you this email might be fraudulent (and likely place it straight in the spam folder) With this method, you get a legit ema…
> If I try to spoof my email to make it look like I'm sending it from @facebook.com, your webmail provider will tell you this email might be fraudulent (and likely place it straight in the spam folder) I'm looking at the headers of an automated message sent by Facebook (so-and-so shared a post), received by Gmail: Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) XXX@facebookmail.com; spf…
This is a special case which passes dkim, spf and dmarc.
Re: Links sent privately through Facebook Messenger can be read by anyone
#66This is one of the reasons many corporations have rules about only using internal messaging applications. Or, block external messaging apps. In environments I've managed, I've always enforced the rule: Anything confidential sent via a messaging app is no longer confidential. Skype, Facebook & G+/GTalk have all "followed" URLs sent via their applications for at least a few years (that I have noticed). Anti-virus appli…
That is true. However, lots of internal messaging app is not 'convenient' per say, especially for senior managers. And I see no fix for that problem.
Re: Links sent privately through Facebook Messenger can be read by anyone
#67This is one of the reasons many corporations have rules about only using internal messaging applications. Or, block external messaging apps. In environments I've managed, I've always enforced the rule: Anything confidential sent via a messaging app is no longer confidential. Skype, Facebook & G+/GTalk have all "followed" URLs sent via their applications for at least a few years (that I have noticed). Anti-virus appli…
That is true. However, lots of internal messaging app is not 'convenient' per say, especially for senior managers. And I see no fix for that problem.
I don't disagree with the lack of convenience, but that doesn't mean choosing convenience over what's right for the company is a good decision.
From a legal and HR standpoint, those types of policies need to be documented for all employees. Senior managers may also have fiduciary responsibility and the reminder is generally a good idea.
Re: Links sent privately through Facebook Messenger can be read by anyone
#68This is one of the reasons many corporations have rules about only using internal messaging applications. Or, block external messaging apps. In environments I've managed, I've always enforced the rule: Anything confidential sent via a messaging app is no longer confidential. Skype, Facebook & G+/GTalk have all "followed" URLs sent via their applications for at least a few years (that I have noticed). Anti-virus appli…
While that in itself is not necessarily desire behavior, the fact that this link is accessible to parties not part of the chat is by far the bigger problem.
Definitely. But, it wouldn't be a problem if people understood the implications of using external services in the first place (or were unable to do so via technical means).
Re: Links sent privately through Facebook Messenger can be read by anyone
#69Facebook's response seems inadequate. Because let's be frank here: 1) There are obvious security concerns thinkable. For example, plenty of websites (google docs, dropbox etc) offer an 'anyone with this link can view document' option. Which is generally safe, given these randomly generated links usually contain > 100 bits of entropy. Access to the link is access to the document, and so the link is a PW. 2) This link…
Couldn't an attacker simply run a script (from multiple source IPs) to get a large number of FB Messenger URLs - then parse the results for specific things - dropbox links, google docs links and other services that are secured through a long URL? I would guess there are examples of services that would be high value to attackers and are secured through the URL... although I can't think of any in particular.
[deleted]
Re: Links sent privately through Facebook Messenger can be read by anyone
#70https://m.facebook.com/composer/mbasic/?csid=2d645076-9e83-4...
I was sent this link but upon opening it I'm redirected to a page that says I am not permitted to view such. Can anyone explain to me why I was sent this and what it could potentially mean?