5 ms·

There are more bugs. Wrong password page will reveal facebook user associated with an email..

by jankotek 10y ago

TheGrumpyBrit 10y ago
So will just searching for the email while you're logged in. I believe that's expected behaviour.
gondo 10y ago
typing an email address into facebook search will reveal facebook user. that is not a secret
- zulln 10y ago
  I doubt it will happen if the user has chosen to hide their email?
csydas 10y ago
Facebook's Wrong Password page has a bunch of weird behavior that, as a lay person, I disagree with. Entering an old password into Facebook will tell you as such [1]. I can't really think of a practical attack for this towards facebook, but I'm really weary of any system that reveals information about passwords, even though I somewhat feel I'm being overly paranoid. Password recycling just seems to be too prevalent to allow me to ignore this, even though it seems impractical to me. I guess I just don't like that it reveals password information. Enough failed logins automatically sends a temporary login pin to the email on file. Again, I feel that in a practical sense this isn't a big issue since if you can get access to the email that has the login pin you also likely have access to the victim's machine that is already logged in, but it still feels like a weird practice to automatically generate temporary credentials without being asked. [1] - http://i.imgur.com/J7YTJqY.png http://i.imgur.com/J7YTJqY.png
- tedunangst 10y ago
  Confirmation of old password isn't such a big deal. If you are concerned that a password was shared with another site and not changed, the attacker has an easier test: use the password at the other site. On the other hand, major utility boost for users. "I KNOW this is my password!" Actually, it was your password before you changed it. "Oh right." I know I do this quite frequently. Enter password. (Wrong.) Guess I have to change it. Reset. (New password must be different than existing password.) My "new" password is the one I changed it to last time, before forgetting.
  - philipodonnell 10y ago
    This happens to me with arcane password requirements that only tell you the requirements after you reset it. try various passwords -> "Invalid password" -> send reset password email -> click email -> "passwords require a special character AND a number AND an unprintable character" -> me: ooooh, its that one -> enter it -> "password already used" -> enter another password I'll definitely forget next time. There are websites I need so occasionally that I'm sure that I have never logged in without resetting my password.
amenghra 10y ago
Try doing it before/after clearing your cookies. The password reset page's behavior depends on Facebook matching your browser/ip/other signals.

There are more bugs. Wrong password page will reveal facebook user associated with an email..

TheGrumpyBrit 10y ago

So will just searching for the email while you're logged in. I believe that's expected behaviour.

gondo 10y ago

typing an email address into facebook search will reveal facebook user. that is not a secret

zulln 10y ago
I doubt it will happen if the user has chosen to hide their email?

csydas 10y ago

Facebook's Wrong Password page has a bunch of weird behavior that, as a lay person, I disagree with. Entering an old password into Facebook will tell you as such [1]. I can't really think of a practical attack for this towards facebook, but I'm really weary of any system that reveals information about passwords, even though I somewhat feel I'm being overly paranoid. Password recycling just seems to be too prevalent to allow me to ignore this, even though it seems impractical to me. I guess I just don't like that it reveals password information. Enough failed logins automatically sends a temporary login pin to the email on file. Again, I feel that in a practical sense this isn't a big issue since if you can get access to the email that has the login pin you also likely have access to the victim's machine that is already logged in, but it still feels like a weird practice to automatically generate temporary credentials without being asked. [1] - http://i.imgur.com/J7YTJqY.png http://i.imgur.com/J7YTJqY.png

tedunangst 10y ago
Confirmation of old password isn't such a big deal. If you are concerned that a password was shared with another site and not changed, the attacker has an easier test: use the password at the other site. On the other hand, major utility boost for users. "I KNOW this is my password!" Actually, it was your password before you changed it. "Oh right." I know I do this quite frequently. Enter password. (Wrong.) Guess I have to change it. Reset. (New password must be different than existing password.) My "new" password is the one I changed it to last time, before forgetting.
- philipodonnell 10y ago
  This happens to me with arcane password requirements that only tell you the requirements after you reset it. try various passwords -> "Invalid password" -> send reset password email -> click email -> "passwords require a special character AND a number AND an unprintable character" -> me: ooooh, its that one -> enter it -> "password already used" -> enter another password I'll definitely forget next time. There are websites I need so occasionally that I'm sure that I have never logged in without resetting my password.

amenghra 10y ago

Try doing it before/after clearing your cookies. The password reset page's behavior depends on Facebook matching your browser/ip/other signals.