[deleted]
More than 1MM Facebook accounts exposed
141–150 of 181 posts
Re: More than 1MM Facebook accounts exposed
#142Can someone explain this to me?
Yeah, me too. I think I got to this too late to understand what's going on here :)
Re: More than 1MM Facebook accounts exposed
#143Earlier quoted context omitted.
Actually it already has, see http://www.facebook.com/note.php?note_id=10150172618258920 .
I use it too, but I must admit to wishing they would make it compatible with Google Authenticator or some other OATH implementation. SMS'ed text codes take way too long to be a good second-step when you're having to login everyday like I do (not to mention logging in from work where my reception is almost nil).
I can't speak for the iOS app but the Android app will generate tokens.
Re: More than 1MM Facebook accounts exposed
#144Earlier quoted context omitted.
It shouldn't take you more than one Google query to find the place to report Facebook security problems. I don't think it's a good idea to link it from the general support section -- you don't want the security team that is hopefully carefully monitoring this stuff to have to wade through thousands of regular customer service complaints.
It shouldn't... but it could be easier. I've been in the situation before where I wanted to report malware on facebook and I couldn't figure out where to report it. I agree that you don't want reporting a security issue to supersede the general case of problems, but as things stand it is hard to figure out how to report a real security issue if you don't know about that magic whitehat url. Googling "facebook security…
shrug
Perhaps you're right. But "Facebook report a vulnerability" works just fine and that's what I would have tried if I were trying to report a vulnerability.
Re: More than 1MM Facebook accounts exposed
#145Earlier quoted context omitted.
Actually it already has, see http://www.facebook.com/note.php?note_id=10150172618258920 .
I use it too, but I must admit to wishing they would make it compatible with Google Authenticator or some other OATH implementation. SMS'ed text codes take way too long to be a good second-step when you're having to login everyday like I do (not to mention logging in from work where my reception is almost nil).
We're working on improving this flow.
However, if you tell us to trust a given computer when you log in, you shouldn't have to enter the code more than once.
Re: More than 1MM Facebook accounts exposed
#146My name is Matt Jones, and I work on the Facbook security team that looked into this tonight. We only send these URLs to the email address of the account owner for their ease of use and never make them publicly available. Even then we put protection in place to reduce the likelihood that anyone else could click through to the account. For a search engine to come across these links, the content of the emails would nee…
That page doesn't say anything about money. It says Facebook might decide not to sue you submit it.
https://www.facebook.com/whitehat/bounty/ describes our bug bounty program, linked to from the "bounty" tab on the left of https://www.facebook.com/whitehat/.
Re: More than 1MM Facebook accounts exposed
#147My name is Matt Jones, and I work on the Facbook security team that looked into this tonight. We only send these URLs to the email address of the account owner for their ease of use and never make them publicly available. Even then we put protection in place to reduce the likelihood that anyone else could click through to the account. For a search engine to come across these links, the content of the emails would nee…
The URLs don't need to be posted online. Some browsers (Chrome, possibly Firefox with Safe Browsing mode, very likely any browser with a Google Toolbar installed) send visited URLs to Google and they will be indexed. I don't know if this is officially documented by Google, but several people have reported seeing this while testing new/beta websites that weren't published or linked anywhere.
Hi there, allow me to correct this misconception. I've debunked that idea often enough that I wrote a blog post about this four years ago: http://www.mattcutts.com/blog/toolbar-indexing-debunk-post/ I wrote an earlier debunk post in 2006 too: http://www.mattcutts.com/blog/debunking-toolbar-doesnt-lead-...
I noticed a new twist in your post though: you're saying that because of Safe Browsing (which checks for e.g. malware as users surf the web), those urls are sent to Google. The way that Chrome and Firefox actually do Safe Browsing is that they download an encrypted blob which allows the browser to do a lookup for dangerous urls on the client side--not by sending any urls to Google. I believe that if there's a match in the client-side encrypted table, only then does the browser send the now-suspect url to Google for checking.
Here's more info: https://developers.google.com/safe-browsing/ I believe the correct mental model of the Safe Browsing API in browsers is "Download a hash table of believed-to-be-dangerous urls. As you surf, check against that local hash table. If you find a match/collision, then the user might be about to land on a bad url, so check for more info at that point."
Hope that helps. Further down in the discussion, someone posted this helpful link with more explanation: http://blog.alexyakunin.com/2010/03/nice-bloom-filter-applic...
Re: More than 1MM Facebook accounts exposed
#148Earlier quoted context omitted.
This is how everything started: A friend forward me an email from a FB group notification Something like: http://www.facebook.com/n/?groups%[id here]%2Fpermalink%[id here]%2F&mid=[id here]&bcode=[id here]-mjoi&n_m=[email adress here] When I clicked the url I got automatically logged into my friend's account. So is definitely a Facebook security issue. Then I tried some google searches to see if I could find some urls…
I suspect this was caused by Google software, most likely Chrome or Google Toolbar, sending these private URLs to Google to be indexed.
See elsewhere on this discussion where I debunked your theory.
Re: More than 1MM Facebook accounts exposed
#149Common misinterpretation on how Google handle `Disallow` in robots.txt Q. If I block Google from crawling a page using a robots.txt disallow directive, will it disappear from search results? [1] robots.txt Disallow does not guarantee that a page will not appear in results: Google may still decide, based on external information such as incoming links, that it is relevant. If you wish to explicitly block a page from be…
Here's a video that explains how and why we handle robots.txt that way: http://www.mattcutts.com/blog/robots-txt-remove-url/
Re: More than 1MM Facebook accounts exposed
#150What is the meaning of the square brackets in the Google query syntax? I could not find any official documentation.
They indicate doing a search. If I say do a search for [flowers] then someone should type the actual word flowers into Google. We use the brackets to make it clear what the literal text of a search query is.