They do, and have for some time (although I can't vouch for the particular algorithm used). fb_dtsg is the usual parameter name. Unfortunately, an XSS vulnerabi

They do, and have for some time (although I can't vouch for the particular algorithm used). fb_dtsg is the usual parameter name. Unfortunately, an XSS vulnerability by its very nature allows an attacker to subvert those protections.