Facebook crawls links in PDFs you send in Messenger • Hacker News Board

Re: Facebook crawls links in PDFs you send in Messenger

#51

Post by ecf » Sat, Oct 26, 2019, 4:33 PM UTC

CydeWeys wrote: post #41

criddell wrote: post #4

Microsoft does this with Skype too. They say it's for detecting malicious links.

And I do appreciate that they're doing that even. I want that, just like I want spam filtering on my email. It's what else might be going on with the link analysis that's worrisome.

Just remember that almost every feature that’s “announced” is a masquerade for ad-tech software to do its thing.

Example, Facebook asking for phone numbers in the name of “security” when they don’t give a shit about security. They wanted to tie a phone number to the owner, and create a social graph based on their contact uploads.

Re: Facebook crawls links in PDFs you send in Messenger

#52

Post by beager » Sat, Oct 26, 2019, 4:36 PM UTC

NullPrefix wrote: post #34

beager wrote: post #17

A good way to enable delivery tracking for PDFs over messenger, I guess!

I assume, the tracking happens before the recipient sees the message. This could be used to track sent messages, not received.

Yep there’s still no “open” tracking on PDFs, at least afaik from a pixel/beacon standpoint. Entire businesses like docusign are built with that value prop in mind.

Re: Facebook crawls links in PDFs you send in Messenger

#53

Post by SlowRobotAhead » Sat, Oct 26, 2019, 4:36 PM UTC

espes wrote: post #48

javagram wrote: post #36

This will keep happening until they enable e2e. I’ve had Facebook block several links sent in private message groups, to completely legal and safe sites (Messenger prints out an obscure API error and refuses to send the content). They have done this for a long time.

You can choose to enable e2e on Messenger

Because the key, nonce, result, and keyshare or Diffie-Hellman exchange are all done inside of messenger... why would anyone believe this is legit?

It might be, IDK, but if it’s all inside their system, how could you audit that?

Re: Facebook crawls links in PDFs you send in Messenger

#54

Post by gojomo » Sat, Oct 26, 2019, 4:39 PM UTC

ahbyb wrote: post #40

GhostVII wrote: post #32

Earlier quoted context omitted.

The cost of uploading a PDF of links is probably not much less than the cost of following those links on your own. So I don't think you gain much by leveraging Facebook in this case.

What if I create a PDF with this content... https://news.ycombinator.com/item?id=1 https://news.ycombinator.com/item?id=2 https://news.ycombinator.com/item?id=3 and so on, until 10,000,000? Perhaps Facebook starts opening every link using 10,000 parallel threads. Can you really replicate that from your connection at home? Perhaps even the sysadmin of your victim site has whitelisted all Facebook IP addresses so their…

There's a fair chance the service which generates these outbound requests throttles itself, both with respect to how many requests it makes against any one domain/IP, or how many errors it will provoke per time period, or before human review.

Re: Facebook crawls links in PDFs you send in Messenger

#55

Post by st0le » Sat, Oct 26, 2019, 4:40 PM UTC

knzhou wrote: post #30

criddell wrote: post #4

Microsoft does this with Skype too. They say it's for detecting malicious links.

As always in big tech, you're damned if you do and damned if you don't.

Honestly, This is good to prevent malware but I imagine this breaks a bunch of things if for eg. If the link has a limited visit count. The link will "expire" before the recipient gets a chance to view it.

Re: Facebook crawls links in PDFs you send in Messenger

#56

Post by Nextgrid » Sat, Oct 26, 2019, 4:45 PM UTC

st0le wrote: post #55

knzhou wrote: post #30

Earlier quoted context omitted.

As always in big tech, you're damned if you do and damned if you don't.

Honestly, This is good to prevent malware but I imagine this breaks a bunch of things if for eg. If the link has a limited visit count. The link will "expire" before the recipient gets a chance to view it.

To be fair, an HTTP GET request should never modify the state of the system - hitting a link should not change anything.

If you need to expire links then make the initial link display a form with a submit button (which does a POST) to reveal the content (and expire the link). Legitimate crawlers don’t submit forms so it should be safe.

Re: Facebook crawls links in PDFs you send in Messenger

#57

Post by gojomo » Sat, Oct 26, 2019, 4:53 PM UTC

tialaramex wrote: post #25

austhrow743 wrote: post #11

Earlier quoted context omitted.

How do you check if a link is serving up something terrible without http requests to them?

You _could_ ask a service like Google Safe Search Just in case you didn't follow any of the previous HN discussion of how that's done consider the URL https://accounts.example.com/tmp/badmojo.exe You (Facebook in this case) run a hypothetical method SafeSearch('accounts.example.com') and also SafeSearch('example.com') and SafeSearch('accounts.example.com/tmp') and SafeSearch('accounts.example.com/tmp/badmojo.exe') Sa…

Sure, but this will only work for previously-known threats – for which someone else, presumably Google, has already done the request, analysis, and determination.

I doubt Facebook only wants to detect old threats, reliant on a competitor's standards & practices.

Re: Facebook crawls links in PDFs you send in Messenger

#58

Post by [deleted] » Sat, Oct 26, 2019, 4:55 PM UTC

[deleted]

Re: Facebook crawls links in PDFs you send in Messenger

#59

Post by heynk » Sat, Oct 26, 2019, 4:55 PM UTC

SlowRobotAhead wrote: post #53

espes wrote: post #48

Earlier quoted context omitted.

You can choose to enable e2e on Messenger

Because the key, nonce, result, and keyshare or Diffie-Hellman exchange are all done inside of messenger... why would anyone believe this is legit? It might be, IDK, but if it’s all inside their system, how could you audit that?

Couldn't you sort of test this by enabling E2E, sending a link that was previously blocked, and seeing if it is still blocked? That would at least show some sign if it's all a sham or not.

Re: Facebook crawls links in PDFs you send in Messenger

#60

Post by TooCreative » Sat, Oct 26, 2019, 5:02 PM UTC

javagram wrote: post #36

This will keep happening until they enable e2e. I’ve had Facebook block several links sent in private message groups, to completely legal and safe sites (Messenger prints out an obscure API error and refuses to send the content). They have done this for a long time.

e2e would not necessarily stop it. Since FB controls the apps that send and receive the message, they can do whatever they want to the unencrypted message on both sides.