9 ms·
How does Facebook disable Developer Tools?
- plorkyeran 13y agoI'm sort of surprised that the developer tools have only recently become an attack vector (via social engineering). I'm not sure what can even really be done about it without seriously inconveniencing developers. Maybe making them disabled by default with an extra option to enable them would be enough to deter all but the most gullible of users?
- ihsw 13y agoWhy not a separate package altogether? That way the Chrome team can focus on Chrome, and the Developer Tools team can focus on producing a high-quality website debugger.
- reconbot 13y agoBecause the "hackability" of the web is important. The ability to view source, play in the console, modify the dom, etc is amazing. Locking it down or providing a larger barrier to entry (eg, download this extra thing) provides dubious benefit and hides what makes the web great. I speak from someone who teaches ruby and javascript. Javascript is in every browser and the console is a wonderful place to start. When I teach ruby (on Mac's) I have to start with, "well ok, now download xcode". It's really easy for someone to give up before getting everything working.
- samplonius 13y agoSo downloading a 100KB extension for a browser which you use for downloading stuff all the time is a "huge barrier"? Wow, talk about a 1st world problem. And "when I teach ruby", "well ok, now download xcode"... ok, Xcode is a 2.5GB download, but it is a one click download and install via App Store. And really? Xcode for Ruby? Are you really doing that?
- thedufer 13y agoI write JavaScript all day and the first step is to download XCode. I don't know if this is his reason, but installing XCode is the best way to get all the developer tools installed (clang, for example).
- djur 13y agoXcode is necessary because Apple distributes an operating system without a C compiler, and standard Ruby development requires a C compiler. Why Apple distributes an incomplete operating system by default, and why they distribute their development environment as one monolithic chunk as opposed to a set of packages, is anyone's guess.
- United857 13y agoLast I checked, Windows also doesn't ship with a C compiler by default. Even some Linux distros don't have it in the default install.
- djur 13y agoWindows is also an incomplete operating system as sold, as are those Linux distros. For a long time Windows was outright defective because there was no compiler available without paying hundreds of additional dollars to Microsoft, but they do have a free toolchain now.
- mweibel 13y agoWell i guess because 80% of mac users will never need a compiler. Also instead of downloading the whole xcode you can download the xcode cli tools.
- grey-area 13y agostandard Ruby development requires a C compiler Mac OS X comes with Ruby already installed, and afaik you don't need a C compiler to learn standard ruby, you'd only need it for certain gems (which want to build native extensions).
- gleenn 13y agoYou can download the command line tools package from apple instead to get the compiler which is only a couple hundred megs instead of the 5 gig bloat that is xcode. Definitely saves a lot of hassle.
- ploxiln 13y agoIf scammers can get people to open the developer console and paste code, they can get them to install the "developer tools extension" and then open the console and paste code. Add all the warnings you want, the scammer will say "see what facebook doesn't want you to see!!!". This has been called the "dancing monkeys problem". People can really be manipulated into doing anything in order to see the dancing monkeys (even if they couldn't be convinced to do those things for constructive purposes). IMHO you just can't save people from themselves, might as well stop trying and making my life harder.
- davidgerard 13y agohttps://en.wikipedia.org/wiki/Dancing_pigs https://en.wikipedia.org/wiki/Dancing_pigs Never seen it called "dancing monkeys" - got a cite?
- danellis 13y ago'Citation'. 'Cite' is the verb.
- davidgerard 13y agoYou'd think I was writing Wikipedia jargon after a Wikipedia URL or something.
- UnFleshedOne 13y agoI heard it as "dancing bunnies". I think more people will go for dancing bunnies, than pigs or monkeys -- bunnies are cuter! I wonder if scammers do A/B testing...
- TeMPOraL 13y agoWe can put bareers here forever that will deter more and more developers and curious yet-to-be hackers from playing with the web, while scammers will just use simple social tricks to make gullible people jump through any obstacle we put. Here, to be honest, I vote for natural selection. Fight the scammers, and let the gullible be scammed until the society develops an immune response. It happens all the times, and I think that at least a part of the solution for Internet scam is to accelerate immune response development as much as possible.
- Bahamut 13y agoI would imagine that that would only be activated with a full deployment of FB, so developers wouldn't have to worry about it.
- lelf 13y ago> Maybe making them disabled by default with an extra option to enable them would be enough to deter all but the most gullible of users? Safari does this
- joe_hoyle 13y agoHow is this exploit not possible by just telling someone to paste javascript:alert(document.cookie) etc into their address bar?
- Strom 13y agoBecause pasting doesn't work. Most browsers (like Chrome, IE) just remove the javascript: prefix from your pasted text, and some browsers (like Firefox) don't allow you to execute standard javascript from the address bar.
- gkhnarik 13y agoI agree. Chrome doesn't allow you do paste it, you have to type it. I believe they disable it soon too.
- yen223 13y agoSee the link in the accepted answer. If you try to paste in "javascript: blahblahblah", Chrome is smart enough to remove the "javascript: " part. What the attackers do instead is to tell the victim to type "j", then ctrl+v the rest "avascript: blahblahblah". Just tried it in Chrome, it goes through.
- SomeoneWeird 13y agoClever.
- nbm 13y agoHave you tried doing that recently? Doesn't work on Firefox and Chrome, not for some time.
- deleted 13y ago[deleted]
- azernik 13y ago
- yen223 13y agoThere's an interesting link in the accepted answer about how the social engineering hack, that necessitated the disabling of Developer Tools in the first place, was executed in the first place: https://www.facebook.com/photo.php?v=956977232793 https://www.facebook.com/photo.php?v=956977232793
- magicalist 13y agoI don't think Developer Tools are going to be able to allow overriding like this for long, or we're going to be seeing a lot of this on sites soon, just like the widespread right-click "disabling" of yesteryear.
- brey 13y agoI don't think it's as simple as that - there's a lot more damage you can do by copy-pasting arbitrary code obtained via a social engineering vector into the dev console, than right-clicking to save an asset. I'd consider this a genuine security issue, and wouldn't be surprised if the dev console at least got moved behind a lot more 'here be dragons' warnings. or hide it behind a turing-test-for-engineers ... 'solve the following code test to enable the dev console' ;)
- Already__Taken 13y agoSomething something security by obscurity something something.
- ZoFreX 13y agoThis isn't anything to do with security by obscurity. This is like putting a cover over the launch missiles button.
- magicalist 13y agoOh, I don't mean for the purposes of security, but sites thinking that they're protecting their content in some way by dropping in a future jquery plugin or whatever that disables the console, and suddenly the hackability and usability of the web becomes much less. Another place where you see this sort of thing: banks that try to prevent password managers from filling in your credentials (also I've seen a few recently that try to prevent you from pasting in your password). There is a tradeoff there too: like this Facebook trick helping save some users, bank tricks probably help some users from accidentally saving their bank credentials on some public or shared computer, but it makes it really annoying (or not possible short of opening devtools and setting the input box's value manually) for those of us that want a unique and more-or-less random password for each site we visit.
- deleted 13y ago[deleted]
- gibybo 13y agoThe accepted answer teases that this is not enough: Object.defineProperty(console, '_commandLineAPI', { get : function() { throw 'Nooo!' } }) But why isn't it enough?
- tshadwell 13y agoBecause it is possible to get around with just code: http://escape.alf.nu/20 http://escape.alf.nu/20 (which I have done, under another username)
- gibybo 13y agoSo how do you get around it? Or, I suppose more importantly, what else do you have to do to prevent people from getting around it?
- girvo 13y agoIt seems he's routing calls to print the code into console.log and eval-ing that string, which is quite interesting.
- gibybo 13y agoEh? Who is "he"? What do you mean routing calls?
- ewoodrich 13y agoIn the snippet posted by tshadwell. The code outputs a string into the console via console.log(), then executes the snippet from the console via eval(). Presumably to avoid to avoid Facebook's protections against console copy\paste execution. Edit: I'm wrong. Need some sleep.
- gibybo 13y agotshadwell did not post a code snippet he wrote. He posted a link to a site that demonstrates the sandbox that Facebook uses (I believe the Facebook engineer that wrote the Facebook implementation also owns escape.alf.nu). This code does not break out of the sandbox, it creates it.
- ibarrajo 13y agoThis is an analysis of the code that facebook is trying to prevent from being pasted into the console http://pastebin.com/0JXCVxXg http://pastebin.com/0JXCVxXg
- agumonkey 13y agoI thought it was obfuscated variable names, but it's a turkish word https://en.wiktionary.org/wiki/arkada%C5%9Flar https://en.wiktionary.org/wiki/arkada%C5%9Flar (follower)
- egeozcan 13y agoIt means "friends". There are some functions named "get messages", "get friends", "get a random friend" and "post comment" too. Weird.
- agumonkey 13y agoNot yeah I dont know why I thought this was about twitter so I only wrote follower (close semantics, and wiktionary listed both). So it's an i10n CRUD controller :)
- Fasebook 13y agoThis is a pretty good reason to never trust Chrome again.
- nyrina 13y agoI wouldn't trust any computer, then. It's the same as taking a bunch of code you have no idea how works, and paste it into CMD, then wondering why you just deleted C:/
- Sharlin 13y agoI would indeed not trust any OS that allows you to erase the root filesystem without at least asking for the superuser password :)
- qwerta 13y agoFunny that Windows does not even allow Administrator to do it. Ubuntu on other side asks only for user password (sudo) :-)
- jakobsen 13y ago>Ubuntu on other side asks only for user password It's the user password of an admin user. What other password can it possibly ask for? a global su password?
- talkingquickly 13y agoExactly, how many developers can honestly say they've never copy pasted commands into the terminal without being 100% sure what they were doing?
- codygman 13y agoHesitantly, I will claim that I can say this because I cannot remember every pasting a command in I did not take the time to understand.
- zachrose 13y agoHow is this "browser vulnerability" different from a bookmarklet?
- hrjet 13y agoOr a browser extension.
- blueskin_ 13y agoDoesn't happen for me in Firefox - I can make alerts etc using the console.
- jokoon 13y agoI hate the web I hate the web
- phaer 13y agoWouldn't it be just as simple for an attacker to persuade a victim to paste a string starting with "javascript:" into the URL bar?
- Cyykratahk 13y agoBoth FireFox and Chrome have been preventing that since around 2011; the pasted url is stripped of the "javascript:" part. But now the malicious instructions tell users to press "j" before pasting the url (which is missing the "j" at the start), which prevents the browsers from detecting and stripping the protocol, thus allowing the script execution.
- darkbot 13y agoFacebook is violating the user's right to their own software.
- ceejayoz 13y agoFacebook is protecting the vast majority of users and making developers click a checkbox to undo that protection. There are plenty of things to get outraged about, but I'd argue this isn't one of them.
- krrishd 13y agohttp://Facebook.com/selfxss http://Facebook.com/selfxss is all it really takes.
- WithTeeth 13y agoI think the burden lies on the browsers to warn average users of the danger of pasting javascript code. Perhaps a popup confirmation the first time you paste `javascript:...` in the address bar with a "Never ask again," and a warning that "Here be danger" when you open the dev console that you can dismiss.