TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Links sent privately through Facebook Messenger can be read by anyone

369 pointsby softvaralmost 9 years ago

20 comments

IkmoIkmoalmost 9 years ago
Facebook&#x27;s response seems inadequate. Because let&#x27;s be frank here:<p>1) There are obvious security concerns thinkable. For example, plenty of websites (google docs, dropbox etc) offer an &#x27;anyone with this link can view document&#x27; option. Which is generally safe, given these randomly generated links usually contain &gt; 100 bits of entropy. Access to the link is access to the document, and so the link is a PW.<p>2) This link can be publicly accessed, despite having only been published in an ostensibly private FB conversation. Facebook has now admitted that the contents of a private conversation can partially be public. That&#x27;s ridiculous. Not just because it&#x27;s not safe, there are more things that aren&#x27;t safe (e.g. sending risque images on Snapchat). But mainly because it&#x27;s against expectations. Snapchat told me on my first day of usage, in the app, that my friends can save my snaps and that I should keep this in mind, and while many users of Snapchat use it recklessly, I would guess that most are aware of the risks. Users carry much of the burden of responsibility now. But there&#x27;s no such awareness of the risks of partial contents of a private facebook conversation not being publicly accessible, nobody is aware of this.<p>3) The response seems wholly unnecessary. It seems to me relatively trivial to require a security token to see this data, much like the rest of the chat itself.<p>Now I&#x27;m not particularly alarmed by the issue itself, it&#x27;s one of those &#x27;safety in numbers&#x27; kinds of things. A hacker would likely be more effective setting up a phishing website and buying an email database, than to collect links and then review them for sensitive data. But the response of FB feels inadequate and unnecessary to me.
评论 #11879751 未加载
评论 #11880742 未加载
评论 #11879966 未加载
edwhitesellalmost 9 years ago
This is one of the reasons many corporations have rules about only using internal messaging applications. Or, block external messaging apps. In environments I&#x27;ve managed, I&#x27;ve always enforced the rule: Anything confidential sent via a messaging app is no longer confidential.<p>Skype, Facebook &amp; G+&#x2F;GTalk have all &quot;followed&quot; URLs sent via their applications for at least a few years (that I have noticed). Anti-virus applications installed on computers have done it with URLs in email applications and such too.<p>One of the large A&#x2F;V vendors (Trend or McAfee, I don&#x27;t recall which) had a browser plugin that would follow all of your browsing activity. I used to be amused tailing logfiles to see a hit from a browser, then one of their corporate IPs with a &quot;crawler&quot;-like UA come along a few seconds later.<p><i></i>EDIT last line for clarity.
评论 #11878244 未加载
评论 #11893696 未加载
donatjalmost 9 years ago
After hearing about people arrested for the content of their private chats on Facebook I basically act under the assumption that everything I do on Facebook is public.
评论 #11876540 未加载
mpegalmost 9 years ago
FB also considers &quot;won&#x27;t fix&quot; a bug I found a while ago that allows anyone to send anyone else on FB a spoofed email that comes from @facebook.com, without knowing their email address ¯\_(ツ)_&#x2F;¯.
评论 #11876724 未加载
评论 #11875735 未加载
评论 #11876702 未加载
thomasfoster96almost 9 years ago
This probably isn&#x27;t a popular opinion, but I fail to see how this is a problem with Facebook.<p>The Google Docs URL is public whether or not you send it through Facebook. It&#x27;s only secret until someone guesses the link (Edit: maybe not mathematically in the case of Google Docs, but many other services use &#x27;unlisted&#x27; URLs without having a long token to guess) - something they can do without the URL even going through Messenger.<p>If you&#x27;re sharing passwords or confidential information via a public URL with no authentication and hoping nobody finds the address, you&#x27;re asking for trouble. I don&#x27;t blame Facebook for not doing anything about it.
评论 #11877670 未加载
评论 #11877637 未加载
评论 #11877666 未加载
评论 #11878031 未加载
samanthashoafalmost 9 years ago
<a href="https:&#x2F;&#x2F;m.facebook.com&#x2F;composer&#x2F;mbasic&#x2F;?csid=2d645076-9e83-4e08-8b4b-d34978d631d5&amp;cwevent=add_privacy&amp;av=100001516340790&amp;view_overview&amp;privacyx=286958161406148&amp;_rdr" rel="nofollow">https:&#x2F;&#x2F;m.facebook.com&#x2F;composer&#x2F;mbasic&#x2F;?csid=2d645076-9e83-4...</a> I was sent this link but upon opening it I&#x27;m redirected to a page that says I am not permitted to view such. Can anyone explain to me why I was sent this and what it could potentially mean?
tuna-pianoalmost 9 years ago
It&#x27;s infuriating to me as a user that certain aspects of a private 1-1 conversation are made public for a &quot;feature&quot; as trivial as a link preview, especially when it seems the fix would be as simple as having a larger, random identifier.<p>Does anyone know what will happen when Facebook Messenger is encrypted end to end?
elifalmost 9 years ago
This is only a lapse in security if you&#x27;re relying upon URL obfuscation for security to begin with. It is only actionable if you can MITM or otherwise easedrop and find the graph ID.<p>Title rating: unreasonably alarmist
评论 #11879540 未加载
评论 #11878727 未加载
评论 #11879339 未加载
zevebalmost 9 years ago
Were they using 256-bit random identifiers then this wouldn&#x27;t be a problem. In that case, the IDs would serve as capabilities to the resources.
评论 #11879614 未加载
dahartalmost 9 years ago
Does Facebook&#x27;s response not having capitalization also worry anyone else more than the security hole? ;)
评论 #11877477 未加载
irl_zebraalmost 9 years ago
I&#x27;ve been using the destructible.io for temp links. It was posted here not too long ago, useful and if anyone else tries to access it, it deletes itself <a href="https:&#x2F;&#x2F;destructible.io" rel="nofollow">https:&#x2F;&#x2F;destructible.io</a>
aab0almost 9 years ago
This reminds me of the similar thing in Microsoft Office recently: it automatically shortened all links in documents, even private ones, with a URL shortener service. URL shortener services are, by design, easy to brute force enumerate. Cue popcorn...
评论 #11880136 未加载
dlitzalmost 9 years ago
Related to this, the W3C maintains a best-practices document about private (&quot;capability&quot;) URLs:<p><a href="https:&#x2F;&#x2F;www.w3.org&#x2F;TR&#x2F;capability-urls&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.w3.org&#x2F;TR&#x2F;capability-urls&#x2F;</a>
mauriciocalmost 9 years ago
What about WhatsApp? It fetches a page&#x27;s title as soon as you type in a URL. I assume the fetching happens on the client, but does the URL (or the title itself) get uploaded somewhere?
评论 #11879490 未加载
niftichalmost 9 years ago
Also see previous for more discussion: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=11868077" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=11868077</a>
rhaps0dyalmost 9 years ago
The first thing I did was share this particular link on Facebook :)<p>Precisely because of what the article says.
owlyalmost 9 years ago
Please. Delete. Your. Accounts. What are you waiting for? Challenge: Start a decentralized FB clone. Evangelize.
excaliburalmost 9 years ago
Is it bad that the thing I most want to do with this story is share a link to it on Facebook?
stefek99almost 9 years ago
Why asking friend to share a link? Isn&#x27;t it easier to log in using secondary account...
bemmualmost 9 years ago
How would you know the Graph ID number if someone doesn&#x27;t explicitly tell it to you?
评论 #11877269 未加载