Fun with your friend's Facebook and Tinder sessions
robertheaton.com
Fun with your friend's Facebook and Tinder sessions
1–10 of 59 posts
Re: Fun with your friend's Facebook and Tinder sessions
#2TL;DR Lock your machine before leaving the room.
Re: Fun with your friend's Facebook and Tinder sessions
#3Wonder if the match referenced at the end is true. Fun read.
Re: Fun with your friend's Facebook and Tinder sessions
#4I'm trying to think about whether there's a way for Facebook and/or Tinder to mitigate this attack without degrading user experience. Because the auth token used is from the response to the last request ever made from Steve's computer, having a changing auth token on each request wouldn't help in this scenario. Restricting an auth token to an IP address wouldn't work since both users are presumably behind the same NAT (all devices on the same residential WiFi router) - not to mention that IP addresses change all the time. Restricting an auth token to a user agent string would stop the first attempt at this hack - but then someone would simply tell the proxy to mimic the UA of Steve's desktop - but then could Facebook refuse to honor mobile application authorization requests if the mobile device is mimicking a desktop browser's UA?
Re: Fun with your friend's Facebook and Tinder sessions
#5I'm trying to think about whether there's a way for Facebook and/or Tinder to mitigate this attack without degrading user experience. Because the auth token used is from the response to the last request ever made from Steve's computer, having a changing auth token on each request wouldn't help in this scenario. Restricting an auth token to an IP address wouldn't work since both users are presumably behind the same NA…
If each computer had a unique hardware private key, that could stop it. But I'm not sure that they do? (Or even if some do, can HTML5 access that somehow?)
Re: Fun with your friend's Facebook and Tinder sessions
#6I'm trying to think about whether there's a way for Facebook and/or Tinder to mitigate this attack without degrading user experience. Because the auth token used is from the response to the last request ever made from Steve's computer, having a changing auth token on each request wouldn't help in this scenario. Restricting an auth token to an IP address wouldn't work since both users are presumably behind the same NA…
I wonder if it's feasible to reference the TLS/SSL session against the session cookie? While the HTTPS session itself is probably transient, you can tell something is up if the same session cookie is being used with two different HTTPS keys.
Re: Fun with your friend's Facebook and Tinder sessions
#7Hack aside, really wonderfully written. Very funny and well explained.
Re: Fun with your friend's Facebook and Tinder sessions
#8I'm trying to think about whether there's a way for Facebook and/or Tinder to mitigate this attack without degrading user experience. Because the auth token used is from the response to the last request ever made from Steve's computer, having a changing auth token on each request wouldn't help in this scenario. Restricting an auth token to an IP address wouldn't work since both users are presumably behind the same NA…
If each computer had a unique hardware private key, that could stop it. But I'm not sure that they do? (Or even if some do, can HTML5 access that somehow?)
Re: Fun with your friend's Facebook and Tinder sessions
#9I made a tinder auto liker script a while back to help my non-nerdy friends out. That's where I learn't about the man in middle attack trick.
Very well written I should say.
Re: Fun with your friend's Facebook and Tinder sessions
#10It's much easier to use the bottinder chrome extension (or whatever it's called now) than dealing with the proxy. Really it's as simple as exporting the cookies, importing them into chrome, and firing up botinder.