Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook detects if you are logged in Gmail

webapps.stackexchange.com

Post reply on HN
Print view View original

11–20 of 98 posts

Re: Facebook detects if you are logged in Gmail

#11

Post by ks »

the_mitsuhiko wrote: post #6

It's not very hard to do. The trick is to know a resource that only the user can access and then trigger an HTTP request to it. For instance if you have website a and say the user profile "mitsuhiko" can only be edited when you are logged in as "mitsuhiko" on http://a.example.com/profile/edit/mitsuhiko you could use this code to see if the logged in user is "mitsuhiko": Why does this work? Because onload is fired if…

That's not a secure method. Because it's browser based it can be faked with a proxy or simply modifying the local hostname file and map the domain to a server you control.

Re: Facebook detects if you are logged in Gmail

#12

Post by the_mitsuhiko »

antimatter15 wrote: post #9
the_mitsuhiko wrote: post #6

It's not very hard to do. The trick is to know a resource that only the user can access and then trigger an HTTP request to it. For instance if you have website a and say the user profile "mitsuhiko" can only be edited when you are logged in as "mitsuhiko" on http://a.example.com/profile/edit/mitsuhiko you could use this code to see if the logged in user is "mitsuhiko": Why does this work? Because onload is fired if…

Except something like this would be easily spoofable, ie. you could set your hosts file to make all a.example.com links return HTTP 200's, or open firebug to call user_is_logged_in() and you could reset passwords without any email. Also, for something like that you should use instead so it's less of an XSS risk.

> Except something like this would be easily spoofable, ie. you could set your hosts file to make all a.example.com links return HTTP 200's, or open firebug to call user_is_logged_in() and you could reset passwords without any email.

Yes. But depending on how gmail works it could me made reliable and secure. For instance if you can share images with gmail users you could generate a unique image for that user, do the same thing with an tag, access the image data with JavaScript, send it back to the server and compare if the contents are the one you shared.

I do not have a gmail account so I don't know if this is possible, it it seems like it would be possible for Google+ from briefly looking at it.

Re: Facebook detects if you are logged in Gmail

#13

Post by ks »

aiham wrote: post #10
the_mitsuhiko wrote: post #6

It's not very hard to do. The trick is to know a resource that only the user can access and then trigger an HTTP request to it. For instance if you have website a and say the user profile "mitsuhiko" can only be edited when you are logged in as "mitsuhiko" on http://a.example.com/profile/edit/mitsuhiko you could use this code to see if the logged in user is "mitsuhiko": Why does this work? Because onload is fired if…

You should post that as an answer to the question.

I doubt FB uses that method. As explained in other threads it is too insecure.

Re: Facebook detects if you are logged in Gmail

#14

Post by patrickaljord »

the_mitsuhiko wrote: post #6

It's not very hard to do. The trick is to know a resource that only the user can access and then trigger an HTTP request to it. For instance if you have website a and say the user profile "mitsuhiko" can only be edited when you are logged in as "mitsuhiko" on http://a.example.com/profile/edit/mitsuhiko you could use this code to see if the logged in user is "mitsuhiko": Why does this work? Because onload is fired if…

This could guess that you are connected to your gmail but not to what gmail account, so this method would be pretty random.

Re: Facebook detects if you are logged in Gmail

#15

Post by antimatter15 »

the_mitsuhiko wrote: post #12
antimatter15 wrote: post #9

Earlier quoted context omitted.

Except something like this would be easily spoofable, ie. you could set your hosts file to make all a.example.com links return HTTP 200's, or open firebug to call user_is_logged_in() and you could reset passwords without any email. Also, for something like that you should use instead so it's less of an XSS risk.

> Except something like this would be easily spoofable, ie. you could set your hosts file to make all a.example.com links return HTTP 200's, or open firebug to call user_is_logged_in() and you could reset passwords without any email. Yes. But depending on how gmail works it could me made reliable and secure. For instance if you can share images with gmail users you could generate a unique image for that user, do the…

But with all that, you would need cooperation by both Google and Facebook for the feature and it would be just as complex as simply using OAuth.

Re: Facebook detects if you are logged in Gmail

#16

Post by the_mitsuhiko »

antimatter15 wrote: post #15
the_mitsuhiko wrote: post #12

Earlier quoted context omitted.

> Except something like this would be easily spoofable, ie. you could set your hosts file to make all a.example.com links return HTTP 200's, or open firebug to call user_is_logged_in() and you could reset passwords without any email. Yes. But depending on how gmail works it could me made reliable and secure. For instance if you can share images with gmail users you could generate a unique image for that user, do the…

But with all that, you would need cooperation by both Google and Facebook for the feature and it would be just as complex as simply using OAuth.

It would work on any service that allows you to share an image with one individual user.

Re: Facebook detects if you are logged in Gmail

#17

Post by [deleted] »

the_mitsuhiko wrote: post #12
antimatter15 wrote: post #9

Earlier quoted context omitted.

Except something like this would be easily spoofable, ie. you could set your hosts file to make all a.example.com links return HTTP 200's, or open firebug to call user_is_logged_in() and you could reset passwords without any email. Also, for something like that you should use instead so it's less of an XSS risk.

> Except something like this would be easily spoofable, ie. you could set your hosts file to make all a.example.com links return HTTP 200's, or open firebug to call user_is_logged_in() and you could reset passwords without any email. Yes. But depending on how gmail works it could me made reliable and secure. For instance if you can share images with gmail users you could generate a unique image for that user, do the…

[deleted]

Re: Facebook detects if you are logged in Gmail

#18

Post by the_mitsuhiko »

[deleted] wrote: post #17
the_mitsuhiko wrote: post #12

Earlier quoted context omitted.

> Except something like this would be easily spoofable, ie. you could set your hosts file to make all a.example.com links return HTTP 200's, or open firebug to call user_is_logged_in() and you could reset passwords without any email. Yes. But depending on how gmail works it could me made reliable and secure. For instance if you can share images with gmail users you could generate a unique image for that user, do the…

[deleted]

Only facebook knows the image it generated. Since that image is only shared with that one mail address you won't be able to spoof it unless you control that mail address.

Re: Facebook detects if you are logged in Gmail

#19

Post by raganwald »

Not sure how they are doing this, but I have gotten tired of having to play “whack-a-mole” with FB scraping private information from my browser in other ways, so what I have done is sandboxed it: I have a separate “Facebook” account on OS X, and I assume that anything I do on that account is shared with Facebook.

I don’t log into Facebook for any reason on my normal user account, and I don’t log into anything else on my Facebook account. They can still sniff certain things using browser fingerprinting and so on, but this seems like the best I can do for the moment on my desktop.

Re: Facebook detects if you are logged in Gmail

#20

Post by ks »

the_mitsuhiko wrote: post #12
antimatter15 wrote: post #9

Earlier quoted context omitted.

Except something like this would be easily spoofable, ie. you could set your hosts file to make all a.example.com links return HTTP 200's, or open firebug to call user_is_logged_in() and you could reset passwords without any email. Also, for something like that you should use instead so it's less of an XSS risk.

> Except something like this would be easily spoofable, ie. you could set your hosts file to make all a.example.com links return HTTP 200's, or open firebug to call user_is_logged_in() and you could reset passwords without any email. Yes. But depending on how gmail works it could me made reliable and secure. For instance if you can share images with gmail users you could generate a unique image for that user, do the…

I deleted my other question about how FB can know that the image is not a fake. My finger hit the wrong button ;) I'll answer here. Your idea can be done, but I don't see the advantage it would have over other methods.
Post reply on HN