Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

More than 1MM Facebook accounts exposed

google.com

Post reply on HN
Print view View original

81–90 of 181 posts

Re: More than 1MM Facebook accounts exposed

#81

Post by mkjones »

wesley wrote: post #78
lazyjones wrote: post #77

Earlier quoted context omitted.

The URLs don't need to be posted online. Some browsers (Chrome, possibly Firefox with Safe Browsing mode, very likely any browser with a Google Toolbar installed) send visited URLs to Google and they will be indexed. I don't know if this is officially documented by Google, but several people have reported seeing this while testing new/beta websites that weren't published or linked anywhere.

Wouldn't a proper robots.txt rule fix this?

A robots.txt file disallowing crawling on the sites that display the contents of user email would help fix this.

However, as some of the discussion below points out, I don't believe that disallowing crawling of these URLs in our robots.txt would keep them from the index if a search engine finds reference to them elsewhere; I think it simply keeps them from being crawled.

Re: More than 1MM Facebook accounts exposed

#82

Post by pgl »

mkjones wrote: post #73

My name is Matt Jones, and I work on the Facbook security team that looked into this tonight. We only send these URLs to the email address of the account owner for their ease of use and never make them publicly available. Even then we put protection in place to reduce the likelihood that anyone else could click through to the account. For a search engine to come across these links, the content of the emails would nee…

Sorry, but, where does it mention anything about making money for reporting security vulnerabilities on https://www.facebook.com/whitehat?

Re: More than 1MM Facebook accounts exposed

#83

Post by chucknthem »

pgl wrote: post #82
mkjones wrote: post #73

My name is Matt Jones, and I work on the Facbook security team that looked into this tonight. We only send these URLs to the email address of the account owner for their ease of use and never make them publicly available. Even then we put protection in place to reduce the likelihood that anyone else could click through to the account. For a search engine to come across these links, the content of the emails would nee…

Sorry, but, where does it mention anything about making money for reporting security vulnerabilities on https://www.facebook.com/whitehat ?

https://www.facebook.com/whitehat/bounty/

Re: More than 1MM Facebook accounts exposed

#84

Post by mkjones »

pgl wrote: post #82
mkjones wrote: post #73

My name is Matt Jones, and I work on the Facbook security team that looked into this tonight. We only send these URLs to the email address of the account owner for their ease of use and never make them publicly available. Even then we put protection in place to reduce the likelihood that anyone else could click through to the account. For a search engine to come across these links, the content of the emails would nee…

Sorry, but, where does it mention anything about making money for reporting security vulnerabilities on https://www.facebook.com/whitehat ?

Yep as chucknthem points out, try clicking the "bounty" on the left side: https://www.facebook.com/whitehat/bounty/. Sorry I didn't make that clearer!

Re: More than 1MM Facebook accounts exposed

#85

Post by credo »

mkjones wrote: post #73

My name is Matt Jones, and I work on the Facbook security team that looked into this tonight. We only send these URLs to the email address of the account owner for their ease of use and never make them publicly available. Even then we put protection in place to reduce the likelihood that anyone else could click through to the account. For a search engine to come across these links, the content of the emails would nee…

You mention that the nonces expire after a period of time.

If you don't plan on cutting the feature for ever, perhaps you could consider an alternative approach of limiting the validity of the URLs to the first visit and also removing the email-id (and other PII data) of the user from the URL.

Re: More than 1MM Facebook accounts exposed

#86

Post by credo »

lazyjones wrote: post #77
mkjones wrote: post #73

My name is Matt Jones, and I work on the Facbook security team that looked into this tonight. We only send these URLs to the email address of the account owner for their ease of use and never make them publicly available. Even then we put protection in place to reduce the likelihood that anyone else could click through to the account. For a search engine to come across these links, the content of the emails would nee…

The URLs don't need to be posted online. Some browsers (Chrome, possibly Firefox with Safe Browsing mode, very likely any browser with a Google Toolbar installed) send visited URLs to Google and they will be indexed. I don't know if this is officially documented by Google, but several people have reported seeing this while testing new/beta websites that weren't published or linked anywhere.

(Regardless of whether one has a Facebook account or not) If your theory is correct, this seems like a good reason to not use Chrome or any browser with a Google Toolbar :)

Re: More than 1MM Facebook accounts exposed

#88

Post by nico-roddz »

mkjones wrote: post #73

My name is Matt Jones, and I work on the Facbook security team that looked into this tonight. We only send these URLs to the email address of the account owner for their ease of use and never make them publicly available. Even then we put protection in place to reduce the likelihood that anyone else could click through to the account. For a search engine to come across these links, the content of the emails would nee…

Thanks Matt,

My only concern is my account security (not money).

I found this issue with almost no technical knowledge, so the crazy thing is:

How many back doors should be over there ready to be exploited by spammers?

BTW, a big "report security issue" button on https://www.facebook.com/help/ would certainly help next time.

Thanks again,

Nico

Re: More than 1MM Facebook accounts exposed

#90

Post by smcl »

sabret00the wrote: post #76

What is the MM quantifier?

I think it's just meant to mean "million" but it's used a lot in the VC/startup community in valuations ("CompanyX receives $10MM in angel funding" etc). I think it has come from finance originally, but either way I think it's unnecessary.
Post reply on HN