Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

More than 1MM Facebook accounts exposed

google.com

Post reply on HN
Print view View original

101–110 of 181 posts

Re: More than 1MM Facebook accounts exposed

#101

Post by cbjoe »

nico-roddz wrote: post #53
jpadvo wrote: post #24

Here's one theory and analysis of what might have happened. Some people's emails got out into the public internet, and were indexed. Some of these emails were from Facebook, and included links to resources that require login. These links pre-populated the username field for convenience, or in some cases auto-login the user. Facebook's engineers probably did not anticipate email notifications to users being crawled by…

This is how everything started: A friend forward me an email from a FB group notification Something like: http://www.facebook.com/n/?groups%[id here]%2Fpermalink%[id here]%2F&mid=[id here]&bcode=[id here]-mjoi&n_m=[email adress here] When I clicked the url I got automatically logged into my friend's account. So is definitely a Facebook security issue. Then I tried some google searches to see if I could find some urls…

I suspect this was caused by Google software, most likely Chrome or Google Toolbar, sending these private URLs to Google to be indexed.

Re: More than 1MM Facebook accounts exposed

#102

Post by cbjoe »

lazyjones wrote: post #77
mkjones wrote: post #73

My name is Matt Jones, and I work on the Facbook security team that looked into this tonight. We only send these URLs to the email address of the account owner for their ease of use and never make them publicly available. Even then we put protection in place to reduce the likelihood that anyone else could click through to the account. For a search engine to come across these links, the content of the emails would nee…

The URLs don't need to be posted online. Some browsers (Chrome, possibly Firefox with Safe Browsing mode, very likely any browser with a Google Toolbar installed) send visited URLs to Google and they will be indexed. I don't know if this is officially documented by Google, but several people have reported seeing this while testing new/beta websites that weren't published or linked anywhere.

Google indexes URLs despite measures such as robots.txt when these URLs are discovered by Google software including Chrome and their Toolbar.

Re: More than 1MM Facebook accounts exposed

#103

Post by campbellmorgan »

anonymouz wrote: post #96
accountoftheday wrote: post #92

Earlier quoted context omitted.

The Roman numeral M (mille) means 1000. M^2 therefore equals one million.

If that's truly how people use it, it is very strange. In actual roman numerals MM = 2000. Using 'M' as a roman numeral but then multiplying digits makes no sense at all (you'd need numerals for all the prime numbers to represent arbitrary numbers...). And in SI, the prefix 'M' (mega) already means 1 million, so to me it seems MM is the notation that maximizes confusion.

I totally agree - there's not a roman numeral justifaction for it at all and it's very confusing in normal situations. My understanding is that it comes from financial (specifically trader) jargon and I suspect it probably originated to differentiate it from some other use of "m", but don't know for sure... Maybe someone else knows why it arose?

Re: More than 1MM Facebook accounts exposed

#104

Post by codeka »

anonymouz wrote: post #87

I'm somewhat curious, why MM for million/mega and not M? Or does the second M stand for some unit?

I always thought it was short for "million monthly" so when you see something like "we have 10MM users" it would be 10 million monthly active users (i.e. 10 million users who have been active in the past month). I have no idea what it means here.

Re: More than 1MM Facebook accounts exposed

#106

Post by maxerickson »

lazyjones wrote: post #77
mkjones wrote: post #73

My name is Matt Jones, and I work on the Facbook security team that looked into this tonight. We only send these URLs to the email address of the account owner for their ease of use and never make them publicly available. Even then we put protection in place to reduce the likelihood that anyone else could click through to the account. For a search engine to come across these links, the content of the emails would nee…

The URLs don't need to be posted online. Some browsers (Chrome, possibly Firefox with Safe Browsing mode, very likely any browser with a Google Toolbar installed) send visited URLs to Google and they will be indexed. I don't know if this is officially documented by Google, but several people have reported seeing this while testing new/beta websites that weren't published or linked anywhere.

Safe browsing in Firefox is implemented client side, it doesn't share urls with Google.

Re: More than 1MM Facebook accounts exposed

#107

Post by vitalique »

chalst wrote: post #75
tszming wrote: post #55

Common misinterpretation on how Google handle `Disallow` in robots.txt Q. If I block Google from crawling a page using a robots.txt disallow directive, will it disappear from search results? [1] robots.txt Disallow does not guarantee that a page will not appear in results: Google may still decide, based on external information such as incoming links, that it is relevant. If you wish to explicitly block a page from be…

You can do access control on the contents of HTTP_REFERER: if the browser visits a page in your robots.txt by following a Google link, serve them up a 403 forbidden. (In Apache 2.4, this can all be done using mod_authz_core.) You could maybe say in your 403 forbidden message that Google has been forbidden from indexing the page (use ErrorDocument). If enough sites did that, Google might change their policy.

Google's default for logged in users is to use https and strip searched phrases when leaving SERP, so HTTP_REFERER will be empty. A lot of security software also cuts HTTP_REFERER. Being behind proxy may cause it to be empty, too. In general, I don't think you can rely on headers sent by the the browser. You don't know if they are real or forged.

Re: More than 1MM Facebook accounts exposed

#108

Post by elliotanderson »

mkjones wrote: post #79
lazyjones wrote: post #77

Earlier quoted context omitted.

The URLs don't need to be posted online. Some browsers (Chrome, possibly Firefox with Safe Browsing mode, very likely any browser with a Google Toolbar installed) send visited URLs to Google and they will be indexed. I don't know if this is officially documented by Google, but several people have reported seeing this while testing new/beta websites that weren't published or linked anywhere.

I'm not sure either, but I doubt that Chrome or any of the badware-stopping features that are built in to it cause the URLs they're checking to be indexed. I'd be even more surprised if Firefox did this. If you've got the toolbar installed though, I'd be less surprised if they tried crawling or indexing URLs you go to. EDIT: It looks like they've explicitly said the toolbar does not cause things to appear in search r…

At least in terms of malware detection, Chrome utilises a bloom filter in the first instance to identify the probability of a URL being malicious before making remote calls. If it is found to be positive, only then does it submit it to Google for more precise verification.

1. http://blog.alexyakunin.com/2010/03/nice-bloom-filter-applic...

Re: More than 1MM Facebook accounts exposed

#109

Post by elliotanderson »

mkjones wrote: post #73

My name is Matt Jones, and I work on the Facbook security team that looked into this tonight. We only send these URLs to the email address of the account owner for their ease of use and never make them publicly available. Even then we put protection in place to reduce the likelihood that anyone else could click through to the account. For a search engine to come across these links, the content of the emails would nee…

Would Facebook ever consider having the option of two factor authentication (something similar, if not compatible with Google Authentication/TOTP/MOTP apps)?

Re: More than 1MM Facebook accounts exposed

#110

Post by codeka »

codeka wrote: post #104
anonymouz wrote: post #87

I'm somewhat curious, why MM for million/mega and not M? Or does the second M stand for some unit?

I always thought it was short for "million monthly" so when you see something like "we have 10MM users" it would be 10 million monthly active users (i.e. 10 million users who have been active in the past month). I have no idea what it means here.

OK, so after a bit of searching, it seems that it comes from the Latin word for "thousand", millia[1]. And it's apparently common in financial contexts.

So 1M is 1,000. 1MM is 1,000,000. 1MMM is 1,000,000,000 (though the former and latter are not as common). Still seems like a confusing way to abbreviate to me.

[1]: http://en.wikipedia.org/wiki/Mile

Post reply on HN