More than 1MM Facebook accounts exposed

Weird. I clicked on one of the links and it asked me if I was that user, and, if so, that I should click the login button. When I did, it logged me in as that user.

Edit: This happens for multiple users.

Edit2: It looks like if you click on the link, it automatically expires. bCODE is "an identifier that can be sent to a mobile phone/device and used as a ticket/voucher/identification or other type of token." I'm guessing somehow these tokens (the ones that auto log you in) never got used, plus the old ones were saved and contain email info. Not sure how Google could have gotten them though. Probably just got accidentally listed, despite robots.txt.

Re: More than 1MM Facebook accounts exposed

#9

Post by tlrobinson » Fri, Nov 02, 2012, 5:58 AM UTC

I wonder if this is the source of the Facebook data leak ("I just bought more than 1 million Facebook data entries") last week?

Re: More than 1MM Facebook accounts exposed

#10

Post by [deleted] » Fri, Nov 02, 2012, 5:58 AM UTC

reg29 wrote: post #7

benguild wrote: post #3

I don't see anything except results for "bcode"

When I click on a link I see another person's email address in the login box. I assume it's a facebook user's email. See these two examples : http://www.facebook.com/login.php?next=http%3A%2F%2Fwww.face... http://www.facebook.com/login.php?next=http%3A%2F%2Fwww.face...

[deleted]