3 ms·
Facebook's response seems inadequate. Because let's be frank here: 1) There are obvious security concerns thinkable. For example, plenty of websites (google do
by IkmoIkmo 10y ago
Facebook's response seems inadequate. Because let's be frank here:
1) There are obvious security concerns thinkable. For example, plenty of websites (google docs, dropbox etc) offer an 'anyone with this link can view document' option. Which is generally safe, given these randomly generated links usually contain > 100 bits of entropy. Access to the link is access to the document, and so the link is a PW.
2) This link can be publicly accessed, despite having only been published in an ostensibly private FB conversation. Facebook has now admitted that the contents of a private conversation can partially be public. That's ridiculous. Not just because it's not safe, there are more things that aren't safe (e.g. sending risque images on Snapchat). But mainly because it's against expectations. Snapchat told me on my first day of usage, in the app, that my friends can save my snaps and that I should keep this in mind, and while many users of Snapchat use it recklessly, I would guess that most are aware of the risks. Users carry much of the burden of responsibility now. But there's no such awareness of the risks of partial contents of a private facebook conversation not being publicly accessible, nobody is aware of this.
3) The response seems wholly unnecessary. It seems to me relatively trivial to require a security token to see this data, much like the rest of the chat itself.
Now I'm not particularly alarmed by the issue itself, it's one of those 'safety in numbers' kinds of things. A hacker would likely be more effective setting up a phishing website and buying an email database, than to collect links and then review them for sensitive data. But the response of FB feels inadequate and unnecessary to me.
- tuna-piano 10y agoCouldn't an attacker simply run a script (from multiple source IPs) to get a large number of FB Messenger URLs - then parse the results for specific things - dropbox links, google docs links and other services that are secured through a long URL? I would guess there are examples of services that would be high value to attackers and are secured through the URL... although I can't think of any in particular.
- deleted 10y ago[deleted]
- morley 10y agoAccording to the article, you need the resource ID of the link to query it in the API. The resource ID seems difficult to get; you basically need to be viewing the conversation (and thus the link) to get the ID. While I agree it's _possible_ to stumble onto sensitive information by downloading resource IDs, that seems too unwieldy to present a serious risk to any particular user. (It's the same amount of risk as, for example, trying to guess the URL of someone's hypothetical photo on the CDN.) Unless there's a way to get a list of resource IDs given someone's username, I'm inclined to think that this is a pretty minor security risk in the larger scheme of things, though it is scary to type a resource ID into their API tester and see a sensitive link come out.
- kevinchen 10y agoSo near the end of the article, author actually shows that it's easy to write a scraper that finds other URLs by enumerating their IDs.
- dragonwriter 10y ago> For example, plenty of websites (google docs, dropbox etc) offer an 'anyone with this link can view document' option. Which is generally safe, given these randomly generated links usually contain > 100 bits of entropy. Access to the link is access to the document, and so the link is a PW. This isn't really particular safe even if its unguessable, its more the internet equivalent of a casual privacy lock.