Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

More than 1MM Facebook accounts exposed

google.com

Post reply on HN
Print view View original

121–130 of 181 posts

Re: More than 1MM Facebook accounts exposed

#121

Post by Omegador »

mkjones wrote: post #73

My name is Matt Jones, and I work on the Facbook security team that looked into this tonight. We only send these URLs to the email address of the account owner for their ease of use and never make them publicly available. Even then we put protection in place to reduce the likelihood that anyone else could click through to the account. For a search engine to come across these links, the content of the emails would nee…

That page doesn't say anything about money. It says Facebook might decide not to sue you submit it.

Re: More than 1MM Facebook accounts exposed

#123

Post by mpyne »

leonkenneth wrote: post #119
elliotanderson wrote: post #109

Earlier quoted context omitted.

Would Facebook ever consider having the option of two factor authentication (something similar, if not compatible with Google Authentication/TOTP/MOTP apps)?

Actually it already has, see http://www.facebook.com/note.php?note_id=10150172618258920 .

I use it too, but I must admit to wishing they would make it compatible with Google Authenticator or some other OATH implementation. SMS'ed text codes take way too long to be a good second-step when you're having to login everyday like I do (not to mention logging in from work where my reception is almost nil).

Re: More than 1MM Facebook accounts exposed

#124

Post by windsurfer »

blauwbilgorgel wrote: post #118
mkjones wrote: post #73

My name is Matt Jones, and I work on the Facbook security team that looked into this tonight. We only send these URLs to the email address of the account owner for their ease of use and never make them publicly available. Even then we put protection in place to reduce the likelihood that anyone else could click through to the account. For a search engine to come across these links, the content of the emails would nee…

Since this is already out there as a known issue, and concerns Google too, check out: https://www.google.com/search?q=%22wants+to+be+friends+on+Fa... And you'll find at the time of writing 250.000 more results where the "wants to be friends" email with the auto-login link is posted on blogs. Many of these blogs are also hacked, in that they redirect you to Russian dating sites if you visit the homepage. An example of…

It's 47 minutes later and for your searches, I'm seeing 5 results and 309 results. Spooky.

Re: More than 1MM Facebook accounts exposed

#125

Post by shiftpgdn »

windsurfer wrote: post #124
blauwbilgorgel wrote: post #118

Earlier quoted context omitted.

Since this is already out there as a known issue, and concerns Google too, check out: https://www.google.com/search?q=%22wants+to+be+friends+on+Fa... And you'll find at the time of writing 250.000 more results where the "wants to be friends" email with the auto-login link is posted on blogs. Many of these blogs are also hacked, in that they redirect you to Russian dating sites if you visit the homepage. An example of…

It's 47 minutes later and for your searches, I'm seeing 5 results and 309 results. Spooky.

Somebody at the Google is certainly watching this thread and cleaning house.

Re: More than 1MM Facebook accounts exposed

#126

Post by blauwbilgorgel »

windsurfer wrote: post #124
blauwbilgorgel wrote: post #118

Earlier quoted context omitted.

Since this is already out there as a known issue, and concerns Google too, check out: https://www.google.com/search?q=%22wants+to+be+friends+on+Fa... And you'll find at the time of writing 250.000 more results where the "wants to be friends" email with the auto-login link is posted on blogs. Many of these blogs are also hacked, in that they redirect you to Russian dating sites if you visit the homepage. An example of…

It's 47 minutes later and for your searches, I'm seeing 5 results and 309 results. Spooky.

Yeah that was weird. I found another that still returns 233.000 results for me:

https://www.google.com/search?q=%22wants+to+be+friends%22+%2...

I must have made a typo at "don%27t". I corrected the first query and it now returns 238.000 results for me again.

Perhaps some Blogspot sites got hacked/ their users phished (I noticed suspicious posting activity dating back to November 2011), which would explain how they got access to the emails. Or these accounts are all fake (selling likes) and they use Blogspot to create online persona's and manage their accounts.

Re: More than 1MM Facebook accounts exposed

#127

Post by gcorne »

credo wrote: post #85
mkjones wrote: post #73

My name is Matt Jones, and I work on the Facbook security team that looked into this tonight. We only send these URLs to the email address of the account owner for their ease of use and never make them publicly available. Even then we put protection in place to reduce the likelihood that anyone else could click through to the account. For a search engine to come across these links, the content of the emails would nee…

You mention that the nonces expire after a period of time. If you don't plan on cutting the feature for ever, perhaps you could consider an alternative approach of limiting the validity of the URLs to the first visit and also removing the email-id (and other PII data) of the user from the URL.

When did the term "nonce" start being used in web application development to refer to a token that expires after a period of time instead of being a true one-time use number/token?

http://en.wikipedia.org/wiki/Cryptographic_nonce

Re: More than 1MM Facebook accounts exposed

#128

Post by Evbn »

lazyjones wrote: post #111
mkjones wrote: post #79

Earlier quoted context omitted.

I'm not sure either, but I doubt that Chrome or any of the badware-stopping features that are built in to it cause the URLs they're checking to be indexed. I'd be even more surprised if Firefox did this. If you've got the toolbar installed though, I'd be less surprised if they tried crawling or indexing URLs you go to. EDIT: It looks like they've explicitly said the toolbar does not cause things to appear in search r…

> EDIT: It looks like they've explicitly said the toolbar does not cause things to appear in search results I read this too after posting, but I'm skeptical. It wouldn't be the first time they claimed to not do things they later admitted doing ... The rationale being that search engines need a way to discover new URLs quickly and keep ahead of the competition (indexing speed and breadth). I'd also like to know what e…

You could make a good bit of easy money if you can prove your suspicions. But since you haven't...

Re: More than 1MM Facebook accounts exposed

#129

Post by durin42 »

gcorne wrote: post #127
credo wrote: post #85

Earlier quoted context omitted.

You mention that the nonces expire after a period of time. If you don't plan on cutting the feature for ever, perhaps you could consider an alternative approach of limiting the validity of the URLs to the first visit and also removing the email-id (and other PII data) of the user from the URL.

When did the term "nonce" start being used in web application development to refer to a token that expires after a period of time instead of being a true one-time use number/token? http://en.wikipedia.org/wiki/Cryptographic_nonce

They could both be one-time-use nonces and additionally have an expiration date. That was how I read the statement, but maybe that was generous.

Re: More than 1MM Facebook accounts exposed

#130

Post by Evbn »

cbjoe wrote: post #102
lazyjones wrote: post #77

Earlier quoted context omitted.

The URLs don't need to be posted online. Some browsers (Chrome, possibly Firefox with Safe Browsing mode, very likely any browser with a Google Toolbar installed) send visited URLs to Google and they will be indexed. I don't know if this is officially documented by Google, but several people have reported seeing this while testing new/beta websites that weren't published or linked anywhere.

Google indexes URLs despite measures such as robots.txt when these URLs are discovered by Google software including Chrome and their Toolbar.

Robots.txt is about fetching content, it has noting do to with indexing URLs or anything which is part of the content at non-robots.txt restricted locations.
Post reply on HN