3 ms·

It's not very hard to do. The trick is to know a resource that only the user can access and then trigger an HTTP request to it. For instance if you have websi

It's not very hard to do. The trick is to know a resource that only the user can access and then trigger an HTTP request to it. For instance if you have website a and say the user profile "mitsuhiko" can only be edited when you are logged in as "mitsuhiko" on http://a.example.com/profile/edit/mitsuhiko http://a.example.com/profile/edit/mitsuhiko you could use this code to see if the logged in user is "mitsuhiko": <script type="text/javascript" src="http://a.example.com/profile/edit/mitsuhiko" onload="user_is_logged_in()" onerror="user_is_logged_out()" async="async"></script> Why does this work? Because onload is fired if the resource answers with 200 OK, not if it's a valid script. onerror is called for any other error code. So if you know what you are probing for: easy. // Edit: Yes, this is most likely not what Facebook is doing if that's their only method of security. However see my reply to the first comment here about the security aspect for a possible way to solve this problem.

antimatter15 15y ago
Except something like this would be easily spoofable, ie. you could set your hosts file to make all a.example.com links return HTTP 200's, or open firebug to call user_is_logged_in() and you could reset passwords without any email. Also, for something like that you should use <img> instead so it's less of an XSS risk.
- the_mitsuhiko 15y ago
  > Except something like this would be easily spoofable, ie. you could set your hosts file to make all a.example.com links return HTTP 200's, or open firebug to call user_is_logged_in() and you could reset passwords without any email. Yes. But depending on how gmail works it could me made reliable and secure. For instance if you can share images with gmail users you could generate a unique image for that user, do the same thing with an <img> tag, access the image data with JavaScript, send it back to the server and compare if the contents are the one you shared. I do not have a gmail account so I don't know if this is possible, it it seems like it would be possible for Google+ from briefly looking at it.
  - antimatter15 15y ago
    But with all that, you would need cooperation by both Google and Facebook for the feature and it would be just as complex as simply using OAuth.
    - the_mitsuhiko 15y ago
      It would work on any service that allows you to share an image with one individual user.
      - antimatter15 15y ago
        The service would need to send out the Cross Origin Resource Sharing headers in order for the image to be accessible via <canvas> and the service also needs a means for the querying server to test if a certain image is indeed the one associated with the user. And if it was an image generated by Facebook, then Facebook must have access to the account beforehand, and there's no benefit to using this system over OAuth.
        the_mitsuhiko 15y ago
        > The service would need to send out the Cross Origin Resource Sharing headers in order for the image to be accessible via <canvas> and the service also needs a means for the querying server to test if a certain image is indeed the one associated with the user. // EDIT: ignore what was here, you're right.
      - bnr 15y ago
        tried email?
  - deleted 15y ago
    [deleted]
    - the_mitsuhiko 15y ago
      Only facebook knows the image it generated. Since that image is only shared with that one mail address you won't be able to spoof it unless you control that mail address.
aiham 15y ago
You should post that as an answer to the question.
- ks 15y ago
  I doubt FB uses that method. As explained in other threads it is too insecure.
ks 15y ago
That's not a secure method. Because it's browser based it can be faked with a proxy or simply modifying the local hostname file and map the domain to a server you control.
patrickaljord 15y ago
This could guess that you are connected to your gmail but not to what gmail account, so this method would be pretty random.
mike-cardwell 15y ago
I wrote quite a popular blog post on how to check if a user to your site is logged in to GMail, Facebook, Twitter and Digg: https://grepular.com/Abusing_HTTP_Status_Codes_to_Expose_Private_Information https://grepular.com/Abusing_HTTP_Status_Codes_to_Expose_Pri... GMail doesn't seem to be working any more though. But the concept is still useful to learn.

antimatter15 15y ago

Except something like this would be easily spoofable, ie. you could set your hosts file to make all a.example.com links return HTTP 200's, or open firebug to call user_is_logged_in() and you could reset passwords without any email. Also, for something like that you should use <img> instead so it's less of an XSS risk.

the_mitsuhiko 15y ago
> Except something like this would be easily spoofable, ie. you could set your hosts file to make all a.example.com links return HTTP 200's, or open firebug to call user_is_logged_in() and you could reset passwords without any email. Yes. But depending on how gmail works it could me made reliable and secure. For instance if you can share images with gmail users you could generate a unique image for that user, do the same thing with an <img> tag, access the image data with JavaScript, send it back to the server and compare if the contents are the one you shared. I do not have a gmail account so I don't know if this is possible, it it seems like it would be possible for Google+ from briefly looking at it.
- antimatter15 15y ago
  But with all that, you would need cooperation by both Google and Facebook for the feature and it would be just as complex as simply using OAuth.
  - the_mitsuhiko 15y ago
    It would work on any service that allows you to share an image with one individual user.
    - antimatter15 15y ago
      The service would need to send out the Cross Origin Resource Sharing headers in order for the image to be accessible via <canvas> and the service also needs a means for the querying server to test if a certain image is indeed the one associated with the user. And if it was an image generated by Facebook, then Facebook must have access to the account beforehand, and there's no benefit to using this system over OAuth.
      - the_mitsuhiko 15y ago
        > The service would need to send out the Cross Origin Resource Sharing headers in order for the image to be accessible via <canvas> and the service also needs a means for the querying server to test if a certain image is indeed the one associated with the user. // EDIT: ignore what was here, you're right.
    - bnr 15y ago
      tried email?
- deleted 15y ago
  [deleted]
  - the_mitsuhiko 15y ago
    Only facebook knows the image it generated. Since that image is only shared with that one mail address you won't be able to spoof it unless you control that mail address.

aiham 15y ago

You should post that as an answer to the question.

ks 15y ago
I doubt FB uses that method. As explained in other threads it is too insecure.

ks 15y ago

That's not a secure method. Because it's browser based it can be faked with a proxy or simply modifying the local hostname file and map the domain to a server you control.

patrickaljord 15y ago

This could guess that you are connected to your gmail but not to what gmail account, so this method would be pretty random.

mike-cardwell 15y ago

I wrote quite a popular blog post on how to check if a user to your site is logged in to GMail, Facebook, Twitter and Digg: https://grepular.com/Abusing_HTTP_Status_Codes_to_Expose_Private_Information https://grepular.com/Abusing_HTTP_Status_Codes_to_Expose_Pri... GMail doesn't seem to be working any more though. But the concept is still useful to learn.