Facebook crawls links in PDFs you send in Messenger • Hacker News Board

Re: Facebook crawls links in PDFs you send in Messenger

#61

Post by jacquesm » Sat, Oct 26, 2019, 5:07 PM UTC

heynk wrote: post #59

SlowRobotAhead wrote: post #53

Earlier quoted context omitted.

Because the key, nonce, result, and keyshare or Diffie-Hellman exchange are all done inside of messenger... why would anyone believe this is legit? It might be, IDK, but if it’s all inside their system, how could you audit that?

Couldn't you sort of test this by enabling E2E, sending a link that was previously blocked, and seeing if it is still blocked? That would at least show some sign if it's all a sham or not.

That would guarantee absolutely nothing.

Re: Facebook crawls links in PDFs you send in Messenger

#62

Post by 0xffff2 » Sat, Oct 26, 2019, 5:11 PM UTC

jacquesm wrote: post #61

heynk wrote: post #59

Earlier quoted context omitted.

Couldn't you sort of test this by enabling E2E, sending a link that was previously blocked, and seeing if it is still blocked? That would at least show some sign if it's all a sham or not.

That would guarantee absolutely nothing.

If the link was still blocked it would guarantee that Facebook is still eavesdropping.

Re: Facebook crawls links in PDFs you send in Messenger

#63

Post by mikorym » Sat, Oct 26, 2019, 5:16 PM UTC

You can also use canary tokens for this. [1]

I am not personally affiliated with them, but I believe they are South African.

[1] https://www.canarytokens.org/generate

Re: Facebook crawls links in PDFs you send in Messenger

#64

Post by strstr » Sat, Oct 26, 2019, 5:18 PM UTC

manojlds wrote: post #49

sushid wrote: post #43

Earlier quoted context omitted.

This is links INSIDE a pdf. Thats one step further than most people assumed.

Mostly to scan the PDF and ensure it's safe I believe, or atleast that's would be the stated reason.

I can believe that (despite the obvious creepyness), since FB users have a knack for getting owned and spreading that ownage to other users.

Re: Facebook crawls links in PDFs you send in Messenger

#65

Post by rohug » Sat, Oct 26, 2019, 5:26 PM UTC

javagram wrote: post #36

This will keep happening until they enable e2e. I’ve had Facebook block several links sent in private message groups, to completely legal and safe sites (Messenger prints out an obscure API error and refuses to send the content). They have done this for a long time.

Worth noting WhatsApp also provides link previews now. Although it is supposedly e2e communication, the link previews are likely generated by reaching out to a similar facebook unfurl service.

They can then have a single map of phone num -> links rendered between fb and whatsapp.

Re: Facebook crawls links in PDFs you send in Messenger

#66

Post by supernova87a » Sat, Oct 26, 2019, 5:28 PM UTC

_8j50 wrote: post #44

Not in the least surprising. Wouldn't be surprised if Gmail does this to..."detect phishing" (pdfs containing phish links are common). Always a plausible reason they can use.

There's no surprise. Gmail does.

If you search for a text string in Gmail, it will return emails that contain that text only in scanned images or PDFs that are in your mailbox.

Re: Facebook crawls links in PDFs you send in Messenger

#67

Post by SlowRobotAhead » Sat, Oct 26, 2019, 5:29 PM UTC

0xffff2 wrote: post #62

jacquesm wrote: post #61

Earlier quoted context omitted.

That would guarantee absolutely nothing.

If the link was still blocked it would guarantee that Facebook is still eavesdropping.

Other guy was right. Think about this easy scenario

  If (E2E_ENABLED) {

  SkipCrawler();  

  SkipContentChecks();  

}

Re: Facebook crawls links in PDFs you send in Messenger

#68

Post by yellow_lead » Sat, Oct 26, 2019, 5:35 PM UTC

javagram wrote: post #36

This will keep happening until they enable e2e. I’ve had Facebook block several links sent in private message groups, to completely legal and safe sites (Messenger prints out an obscure API error and refuses to send the content). They have done this for a long time.

I experienced this too, Facebook will block most torrent links, regardless of if they're legal or not. I've taken to encoding these with Base64 first and instructing the recipient to decode them.

Re: Facebook crawls links in PDFs you send in Messenger

#69

Post by yawaramin » Sat, Oct 26, 2019, 5:36 PM UTC

rohug wrote: post #65

javagram wrote: post #36

This will keep happening until they enable e2e. I’ve had Facebook block several links sent in private message groups, to completely legal and safe sites (Messenger prints out an obscure API error and refuses to send the content). They have done this for a long time.

Worth noting WhatsApp also provides link previews now. Although it is supposedly e2e communication, the link previews are likely generated by reaching out to a similar facebook unfurl service. They can then have a single map of phone num -> links rendered between fb and whatsapp.

WhatsApp fetches a link preview on the sender's device before the message is encrypted, and packages it up with the message before sending. Depending on how exactly they implement the fetch, they may or may not know what links you sent.

Re: Facebook crawls links in PDFs you send in Messenger

#70

Post by djohnston » Sat, Oct 26, 2019, 5:36 PM UTC

And if they didn't the headline would read: "Facebook fails to stop malicious and illegal content from being shared on their Network! Should they be shut down?!"