Facebook Bug Could Give Spammers Names, Photos

angry tapir writes with this excerpt from an IDG report: "Facebook is scrambling to fix a bug in its website that could be misused by spammers to harvest user names and photographs. It turns out that if someone enters the e-mail address of a Facebook user along with the wrong password, Facebook returns a special 'Please re-enter your password' page, which includes the Facebook photo and full name of the person associated with the address. A spammer with an e-mail list could write a script that enters the e-mail addresses into Facebook and then logs the real names. This could help make a phishing attack more realistic."

Comments

*Smack Face*

[Monkeedude1212]

Seriously? Who is freaking writing these web pages? It would have been easier to NOT include photo's and names than to build it in there!

Re:*Smack Face*

[odies]

I think the summary and story is looking at wrong aspect about it too. Spammers, whatever. You're just one in a million. This is a lot more serious about people that just know your email, but are in more personal contact with you than some spammers. Website owners, forum administrator, people you meet on the internet.. Those who know your email but don't really know your real identity. That's a lot more serious privacy violation.

Re:*Smack Face*

[Anonymous Coward]

Seriously? Who is freaking writing these web pages?

Probably an ex-Slashcode developer.

Re:*Smack Face*

[Anonymous Coward]

Maybe they just did it for the challenge. ;)

Re:*Smack Face*

[blai]

no -____-
Peter and I didn't work for Slashcode.

Re:*Smack Face*

[mcgrew]

It would have been easier to NOT include photo's and names than to build it in there!

Dude, please learn when to use an apostrophe. We have lots of non-native English speakers here, and they may assume that your use of language is educated, seeing as how this is a nerd site and all.

Moderators, please mod me down, I'm offtopic. Thx.

Re:*Smack Face*

[ilo.v]

Who is freaking writing these web pages? It would have been easier to NOT include photo's and names

I'm not defending their choices, but there is a legitimate reason why they would do this. Some users mistype their username, not their password. This results in a "failed login" screen. If there is no photo (or name) they may assume they have mistyped their password, and keep trying it over and over. Throwing up the picture associated with that account helps the user figure out that the reason they can't log in is because they are mistyping their username, not their password.

Re:*Smack Face*

[Pteraspidomorphi]

Maybe he's a non-native speaker himself ;)

Re:*Smack Face*

[Monkeedude1212]

It is a bad habit I have. I'll write a sentence, then I'll read it over, and decide to change the structure entirely, then re-read it a bit to make sure it makes sense, then put it up there without looking too much at grammar.

So if I had said something like "The photo's location" but then decided the location part is irrelevant and I could just work it around to just say "the photos" then I do so, but its all cut copy paste delete so the apostrophe reamins in place. Makes errors and I apologize.

I also tend to form a lot of run on sentences or use too many commas, like that first sentence up there. I left it as is so you can see my general though pattern. Normally I would go back and work my sentences into something with a little more sensible flow and pace. I have found that I abuse a hyphen quite frequently - as if putting it there makes it seem like a quick pause without needing to use a comma, which is terrible I know.

Re:*Smack Face*

[Monkeedude1212]

I see your point, and it is an excellent one. However, I think I would have prefered it being some kind of bug that suggests the page you are being redirected to when failing to login goes to a default page which then loads certain contols (like other facebook pages), and that it naturally shows the info when you are logged in. As opposed to a logical error that someone thought this would be a good idea and didn't consider the consequences of privacy involved with it. Not that I'm surprised with the current administration of the site or anything - nor that my preference of privacy issues being technical errors over design flaws makes any difference whatsoever.

Re:*Smack Face*

[Abstrackt]

I do some of my banking with ING and they let you select a combination of a picture and phrase that's unique to you, why couldn't Facebook implement the same? All they would need is a stock of pictures for people to choose from and a text field. If you don't see your selected picture and your selected text you'd know you tried logging into the wrong account.

Re:*Smack Face*

[SmlFreshwaterBuffalo]

I wouldn't call that a legitimate reason since that implies, well, legitimacy. Instead, it's simply a possible explanation for how they arrived at their poor choice.

A more secure solution to the problem you pose would be to clear the user name on the "failed login" screen in addition to the password, regardless of which is incorrect. And if anyone wants to argue that having to retype both would be inconvenient, I'll preemptively counter by saying security should not be sacrificed for the sake of convenience.

Re:*Smack Face*

[Anonymous Coward]

Oh, shut up. Mistakes happen, especially while drafting. Blame /. for not allowing posts to be edited, not the poster.

Re:*Smack Face*

[yenne]

I just tried it. Looks to me like Facebook has a problem with users who enter the wrong e-mail address and can't figure out why their logon isn't working. Hence, the "Not you? Click here." option beside the picture.

It's entirely possible that the idiocy behind the interface design is in an ongoing stupidity arms race with the consumers on the other end.

Re:*Smack Face*

[Anonymous Coward]

Yeah, there is a legitimate reason to highlight which of the two fields were incorrect: convenience. However, there is an equally legitimate reason to highlight none of them: security. And the latter practice has been the standard practice for the last 10 years. The reason this seems incredulous is because the weakness exists in the largest website on the planet. Even a 14y/o novice PHP webdeveloper can spot this exploit ahead of time.

Re:*Smack Face*

[paulbiz]

I have a "good" gmail address (my full name@gmail.com) and I constantly get e-mail from other people signing up for things who apparently don't know their own e-mail address. I've received passwords and various other sensitive data. Sprint was sending me receipts for someone's very large corporate purchases, I kept replying and forwarding them to sprint's customer care and they basically told me they can't do anything about it and to just delete them and not worry about it.

It's also amazing how many sites will not let you unsubscribe without providing some kind of personal info. Seriously? They let you sign up with the wrong address without confirming it, but I can't unsubscribe unless I know the last 4 digits of the guy's SSN?

Re:*Smack Face*

[Pharmboy]

I have a "good" gmail address (my full name@gmail.com) and I constantly get e-mail from other people signing up for things who apparently don't know their own e-mail address.

Glad to know I am not the only one. My yahoo email address, which I have used since the mid 90s when they started offering email (back when 9 characters was the maximum name size....) gets the same thing, legitimate "thanks for signing up" from legit companies, where some idiot didn't know their own email address. Ironically, my email address is a real oddball one, so how they would use it is beyond me.

Re:*Smack Face*

[yenne]

I constantly get e-mail from other people signing up for things who apparently don't know their own e-mail address.

My e-mail address is also my full name with a "dot net" at the end, and I have chronic issues with customer service reps who don't know how to type anything other than "dot com".

That is pretty ridiculous about not being able to unsubscribe, though.

Re:*Smack Face*

[Anonymous Coward]

..., I'll preemptively counter by saying security should not be sacrificed for the sake of convenience.

Because U.S airports after 9/11 are totally secure. [//TODO: Quote something about liberty/security here.]

Re:*Smack Face*

[Dhalka226]

I had the same problem happen, with some extremely sensitive data coming in.

In addition to somewhat mundane things like airline confirmations, hotel confirmations, etc, there were several letters about legal problems. The person they were trying to reach is apparently the head of an investment group and under investigation by the SEC. I also once received an email containing a bank account number with routing number. Usually it was sent to his (proper) business address and CC'd to my address, which I assume they thought was a personal address for him. When correspondence from lawyers starting coming in I decided it was well past time to start emailing these people and telling them to oh my god please stop. That's a can of worms I just wanted no part of whatsoever.

I did do a quick Google search for the guy; same last name, different first name (same first initial, the combination of which is my email address). Really a problem that shouldn't have happened, especially not that many times from that many different sources.

Re:*Smack Face*

[SmlFreshwaterBuffalo]

I can't tell if you're agreeing or disagreeing with me, since website security and the dog & pony shows performed at U.S. airports are not even remotely related.

Re:*Smack Face*

[Anonymous Coward]

One of my email addresses is "first name last initial@gmail.com". Among things, I've received correspondence from grandparents and relatives that I don't have, signups for online games from some kid, emails from the friends of some other kid, registration for the Playstation Network, private emails intended for some guy in upper management in some company I can't immediately recall, and an invitation and password to the signup site for the last Webby awards ceremony. Luckily I'm a nice guy and try to correct people after they've mistakenly emailed me.

Re:*Smack Face*

[RabbitWho]

I think they tried to copy the "active neopet" login security feature on Neopets.

Re:*Smack Face*

[Anonymous Coward]

indeed, it's not a bug but a purposely designed feature.
just because a feature is stupid doesn't make it a bug.
or else 90% of fb would be bugs.

Re:*Smack Face*

[neonmonk]

The photo is location? What?

Seriously, learn when to use apostrophes.

Re:*Smack Face*

[ekhben]

That's only 10,000 combinations. Brute force script it. Don't bother testing for success, just blast 10,000 HTTP requests at them.

Re:*Smack Face*

[Piranhaa]

Last year I had someone at the the Sierra Club having their mail being forwarded to me. The guy's name was identical to mine.
I replied to it saying I must be getting their emails, but I guess it wasn't important.

I got confidential email after confidential email. Even emails that "Sally was not impressed with the way you guys left the kitchen today". So I had some fun replying to some of their emails.

It took them a few months before anyone finally fixed it - or the guy finally realized that his email wasn't (firstname)(lastname)@gmail.com

Re:*Smack Face*

[FlyMysticalDJ]

This really makes me wonder why the scammers out there aren't signing up for tons of generic name sounding e-mails, hoping to get people's misplaced mail. Of course, for all I know, they already do.

Re:*Smack Face*

[Khyber]

Posts *CAN* be edited.

It's called 'preview' and 'continue editing.'

While I may not be one to use it that often, I do use it now and then, and I am quite aware of it. Those unaware of it have a very narrow focus and might wish to be checked for tunnel vision.

Re:*Smack Face*

[Khyber]

This is why I do not use my name as part of my e-mail address.

This cuts down on that problem considerably.

Re:*Smack Face*

[Khyber]

If only one would combine the LOIC with a brute-force script. DDoS + password stealing all in one.

Bet 4chan would shit themselves over that. While AES256 may take the universe suffering from total entropy before it got cracked, I bet with a good logistical separation and delegation of sections to attempt they could crack it.

Just simply brute-forcing it would take eternity. Use a little statistics and logistics, and some proper task delegation, I'd be willing to bet that a brute-force could be accomplished within a couple of decades. Sure it would be pure luck, but a little micromanagement here would actually help with the odds.

Re:*Smack Face*

[billcopc]

I don't see what the big fuss is... it's your name. If someone has your email address, they probably have some sense of who you are. If you don't trust them with your real name, then at the very least have some forethought and give them a throwaway email address.

Me, I'm Bill Lambert. My email address is billco@fnarg.com . Says so on my whois records. Big fucking whoop. That's what spamassassin is for.

Re:*Smack Face*

[vlueboy]

Website owners, forum administrator, people you meet on the internet.. Those who know your email but don't really know your real identity.

Yet another reason to hide your email on forums' public profiles.

If FB fails to change anything, then more power to me for avoiding it. I can't believe this past two years: google improved forum indexing to the point that too much crap obscures legit searches ... spammers have also gotten real good at stealing, curating my personal data and cloning it in a way to contribute to the above "crapflood." Phone books cannot even dream of the power of the spammers for aggregating data to piece together exactly who I am and who I work for and with, even if I have no linkedIn account --think cogmap and pipl.com and so on.

I've slowly been obfuscating inactive web accounts before even MORE data miners get them free. At least ten years ago you had to pay to find out as much.

Re:*Smack Face*

[sodul]

Actually it depends on what your name is. If your name is John Smith, then yes using your name for a somewhat unique identifier is a bad idea. In my case I have a 4 letters last name and it is very 'rare' (probably less than 100 people with that last name).

Re:*Smack Face*

[Anonymous Coward]

My email address is name+randomdigit@popularprovider.com. I give my email address out correctly to everyone, but I wonder how much email meant for me goes to name@popularprovider.com by the sender thinking, I remember his name and provider, that must be his address.
Not yet thought about name.surname ...

Re:*Smack Face*

[Kijori]

No, it's a genitive - the location of the photo.

Re:*Smack Face*

[gsslay]

I get this too. My name is not that common, unfortunately the idiots making the mistake are the same ones again and again. I'm now at the point that I can guess which idiot, as I know enough about their interests from what websites they sign up to.

It's just as bad when they tell their friends or colleagues the wrong email address. It took me a year to convince a certain military outfit that I was not part of their unit and to stop sending me orders about next week's operations. God knows what was happening to the guy who was supposed to be getting them.

I used to forward them on to the correct email address, or reply to the sender. Now I don't bother, automated filter, straight in the trash.

Of course, the websites that sign people up to things without any email confirmation are just as guilty.

Re:*Smack Face*

[JasterBobaMereel]

Because a surprisingly large number of internet users are blind or have poor eyesight, and your system would exclude them from facebook ....Just like they are excluded from ING's website ...

Re:*Smack Face*

[Chysn]

It's no so much the name as a picture, I think. People are accustomed to seeing their Facebook pictures only (or at least primarily) in Facebook, and a phishing attack that involves that picture would be a lot more convincing.

Re:*Smack Face*

[Anonymous Coward]

Well of course, because I remember being told when I made my first e-mail address not to use my real name because the head of some investment group might have the same last name and first initial as me. Which is why I haven't used my real name to this day.

Re:*Smack Face*

[hesaigo999ca]

Not only that, but I take it if someone like me were to use facebook without adding pictures, but just to stay in touch, i guess you would not get much other then my online name (which is never the real name) and an empty picture box.

Re:*Smack Face*

[asdf7890]

Legitimate reason: yes. Good reason: no. Commonly accepted best-practice is not to let the user know which part is wrong. Reporting that the username is fine but the password isn't makes brute-force login attempts a more practical form of attack especially where you are expecting daft users with poor password choices - and facebook themselves expects their users to be too daft to properly choose and look after their usernames/passwords hence the "enter your email address and password here and we'll look at your contacts for you!" area that is present on sign-up and occasionally lied about on wall updates (I have a couple of fake accounts that I use to check how I look to others, and fb has claimed more than once that one of those accounts "has tried the friend finder" when I know full well this has not happened).

Re:*Smack Face*

[mcgrew]

No, "the photo's location" is correct. It's a possessive (the other time you use an apostrophe).

George's dog is brown, George's cat is white, George's location is unknown. The photo's contrast is bad, the photo's focus is bad, the photo's location is in the trash. If it were more than one photo it would be "the photos' locations".

Re:*Smack Face*

[Anonymous Coward]

Hell, someone set up a paypal account and gave my email address. Then they set up an ebay store. Every time someone tried to buy an item from the store, I got several emails from the buyer, ebay, and paypal. Paypal wasn't interested in helping me (in fact outright lied to me for several hours of phone calls when I did finally manage to get hold of someone). It took over a month to resolve, and I think what finally made the difference was the nice email I sent to each customer, explaining how the person they are trying to buy from is such an idiot she can't even get her own email address correct and I would not be selling them anything, which I cc'ed to her correct email address.

Re:*Smack Face*

[netsharc]

I wonder how the AJAX-crazy Facebook would work for the poor-sighted anyway... I have a hunch: not very good.

And imagine the TTS-engine:
"Moron McDumbass needs an UZI for a Mafia Wars raid.
Moron McDumbass needs bullets for a Mafia Wars raid.
Moron McDumbass needs a getaway car for a Mafia Wars raid."

Re:*Smack Face*

[Anonymous Coward]

RTFA. names and photos. and Im willing to bet there are other exploits that allow much more data to be scraped.

Scraping Facebook for this type of information is prohibited, she added.

and yet facebook allowing companies to do it is okay...

facebook username: aantsy@yahoo.com
password: abcabcabc

now please, screw up my [fake] facebook account for me.

Not a Bug

[FrozenTousen]

It's a feature. Say you get amnesia and all you remember is your email address. Now, thanks to Facebook, you have a means of finding out your name, and what you look like!

Re:Not a Bug

[Anonymous Coward]

It's a very serious bug. Spammers aren't _supposed_ to be able to scrape that information without paying facebook for it.

Re:Not a Bug

[by (1706743)]

It's a feature. Say you get amnesia and all you remember is your email address. Now, thanks to Facebook, you have a means of finding out your name, and what you look like!

Imagine how much simpler the plot for The Bourne Identity would have been.

Re:Not a Bug

[Anonymous Coward]

Imagine how much simpler the plot for The Bourne Identity would have been.

I don't think so. He would have to have his email tattooed on the back of his neck and then spend 2 hours trying to read it.

Re:Not a Bug

[Anonymous Coward]

Really? I thought they were just giving out samples.

Re:Not a Bug

[Anonymous Coward]

Now, thanks to Facebook, you have a means of finding out your name, and what you look like!

You know, there's this invention called the mirror that lets you check what you look like.

Unless you're an amnesiac vampire of course.

Not The Only Problem

[Revotron]

Fixing this alone means nothing. If you search for someone on Facebook it will show you a name and a profile picture. Sure, it requires a facebook account, but that's not too hard to create for somebody with 4,000,000 email addresses.

Re:Not The Only Problem

[yincrash]

A user can prevent the profile picture from showing, and you can't search by email address (that I know of). However, this bypasses the profile picture privacy option.

Re:Not The Only Problem

[e065c8515d206cb0e190]

You can search by email address. And last time I checked the only way to not show your profile picture to the world was to not have one at all.

Re:Not The Only Problem

[TheGratefulNet]

I have no FB account (never will, either!) yet I can do a google cache search AND get 'goodies' on FB users that way.

so, that's yet another hole that needs to be patched.

Re:Not The Only Problem

[creat3d]

You can set your profile not to be searchable by email address.

Re:Not The Only Problem

[natehoy]

This means a lot if you have set your profile to be non-searchable and set your name and/or profile picture to be "visible to friends only".

POTS analogy: This is like going to the effort of getting an "unlisted number", where you aren't supposed to be listed in the phone book and your address is not supposed to be divulged to anyone, then finding out that anyone who happens upon your number and dials it gets a recording that includes your name and address.

Having said that, everything you enter in Facebook should be considered viewable by everyone on the planet. Facebook doesn't exactly have a long and reliable history of protecting the identity of the people who use it. They'd sell you for a nickel. They'd probably send someone to strangle your cat if they thought your angst-ridden posts would generate a few thousand more page views. It's not exactly like this should come as a surprise to anyone, especially those of us who actually use it.

So, as someone mentioned above - this is a very, very serious bug to Facebook. This information should NEVER be given out to anyone... who isn't paying for it.

Re:Not The Only Problem

[prostoalex]

Only if 'Search for me on Facebook' is set to 'Everyone'
http://www.facebook.com/settings/?tab=privacy&section=basic

Re:Not The Only Problem

[Anonymous Coward]

How exactly?

Facebook's configuration is so convoluted. Everything is spread around on different pages and stuff, so annoying. It's very hard to find any particular privacy or profile setting.

Re:Not The Only Problem

[Anonymous Coward]

Another problem is that with Facebook Connect, this also causes concerns for people like me who (unwisely, in hindsight) use our Facebook account to login to other sites. I only use it at Brazen Careerist, but I'm sure other people use it at many more sites, as a sort of OpenID. With each additional site we use Facebook Connect at, it becomes a harder decision to just completely ditch Facebook due to its security/privacy issues because of the other sites where we would have to start over.

Re:Not The Only Problem

[Anonymous Coward]

Just tried... it found me by email no matter what setting I chose. I had to register a new gmail account, switch to that email, and delete the old one. Only then did it stop finding me.

Re:Not The Only Problem

[bannable]

Actually, if you check out the Full Disclosure thread on this you'll that this is the problem. Facebook isn't checking *any* privacy settings during failed login attempts, so it doesn't matter what settings you use.

Re:Not The Only Problem

[Anonymous Coward]

The Niggers are gonna be patching your hole. You sister looks good too. I think i'm gonna make her back that ass up. We gonna take you 2 for a ride yelling "Fuck yo nigga bitch! Fuck yo nigga bitch!". Big Tyrone just got out of the joint too and he's gonna want some dessert. We gonna roll up around 7. Bring your tears.

Re:Not The Only Problem

[Actually, I do RTFA]

Account->Privacy Settings->Basic Directory Info

I agree, it is annoying.. It took me 30 minutes to find (the first time). I think it's been cleaned up since then.

Re:Not The Only Problem

[creat3d]

It seems to take a lot of time (from hours to days) before such changes take full effect... Changing some account settings will sometimes be instantaneous, other times it'll take forever. But it does eventually take effect.

Wow

[mark72005]

Just when you thought all the obvious exploits and privacy problems had to be gone by now, they go off and amaze us again.

Get ready for another irreducibly complex tier of privacy settings, i'm sure.

Re:Wow

[xMilkmanDanx]

actually I'd say it's more symptomatic of the blacklist mentality. you get better security/data control if you have to whitelist access.

From TFA

[wideBlueSkies]

>>Scraping Facebook for this type of information is prohibited, she added.

Oh, yes. That'll stop em'. Stern warnings always do.

Re:From TFA

[Monkeedude1212]

Strongly worded public letters deter most bots.

Re:From TFA

[interkin3tic]

They should probably throw in a logical paradox to make their heads explode or short circuit. Like "It's forbidden to use this picture and name for evil purposes, because people want privacy, even though they put it all up there suggesting they don't want privacy... think about that."

There's only one problem...

"Santa-bot: Nice try. But my head was built with paradox-absorbing crumple-zones"

Re:From TFA

[Pollardito]

I've seen multiple comments by Facebook to the media that make it sound like customer privacy is something that can be put back in a box after a breach has taken it out. I'm not sure if they actually believe that they can compel the scrapers to delete all copies of the data, or if they are just posturing.

Need an adult

[dan_sdot]

Ok, we need an adult to start running this company please. Seriously, this Zuckerberg guy is so far out of his league it is laughable.

Re:Need an adult

[bkgood]

Ageist much? Do you really think that a CEO like Zuckerberg wrote, demanded or even approved something as simple as a "spice up the login error page" project?

Anyway, the guy is 26. He can buy booze, fight for his country and successfully run a multi-million dollar company. Most of slashdot, even adult slashdot, cannot claim all three.

Finally, I really don't know what all the commotion is about, I just logged out of Facebook and tried logging back in with my email address and a bad password; I got the standard "bad email or password" error.

Re:Need an adult

[company suckup]

I seriously do not get this ungodly zeal for hiring 20-somethings to run the IT world. Time for the Sesame Street crowd to step aside for those who could construct a website that was actually user-friendly.

Re:Need an adult

[Matt Perry]

I know! He's just making money for the company hand over fist. Obviously he doesn't know anything about running a company.

</sarcasm>

Re:Need an adult

[Anonymous Coward]

Why don't you start your own hugely popular website? Oh yeah, because you can't

Could?

[Anonymous Coward]

"Could" be misused? How about "has" and "is"?

Not a bug but design flaw

[Anonymous Coward]

And how hard could that possible be to fix? Comment some code.. end of story.

Re:Not a bug but design flaw

[Anonymous Coward]

But that doesn't give slashdotters an opportunity to rage, or even an opportunity for some PR about evil haxxors finding pictures of children!

Answer: some 22yo kid on a powertrip

[e065c8515d206cb0e190]

Here comes Mark.

Correction

[pseudorand]

> that could be misused by spammers to harvest user names and photographs. ...that has been widely used by spammers, collection agencies, the government, terrorists, aliens (from outer space and otherwise), foreign governments and the like to harvest user names, photographs and e-mails for years.

There. Fixed that for you.

Scrambling, my ass...

[bugs2squash]

The site should go down for maintenance until they fix the issue, and only then brought back online.

Re:Scrambling, my ass...

[Anonymous Coward]

The site should go down for maintenance until they fix the issue, and only then brought back online.

Good idea. I'm all for bringing it down. Think of how much more productive households, college campuses, and the workplace will be for networks not already blocking facebook access. The increase in productivity would cause a spike in the world economy and take us out of the recession :-)

Re:Scrambling, my ass...

[cosm]

The site should go down for maintenance until they fix the issue, and only then brought back online.

Good idea. I'm all for bringing it down. Think of how much more productive households, college campuses, and the workplace will be for networks not already blocking /. access. The increase in productivity would cause a spike in the world economy and take us out of the recession :-)

FTFY

This flaw is no longer available

[SplatMan_DK]

This flaw is no longer available on Facebook logon pages.

In fact it was removed before this story made it to the /. front page.

It was removed approx. 11 hours after the first public articles about it.

- Jesper

Re:This flaw is no longer available

[duplicate-nickname]

+1...if I could.

Again Slashdot delivers slow, out-of-date news.

Re:This flaw is no longer available

[C_Kode]

In this case, I consider it a good thing.

Re:This flaw is no longer available

[Anonymous Coward]

Really? I just went to Facebook, put in my email address and a bad password in, and I see "Login as: [My full name] [my email] Not you? click here". My picture is a blank picture, but it always is because I have all pictures turned off publicly. So, if they've removed the flaw, they've either not deployed it to all their servers yet (possible), or they really did a bad job of removing it.

Re:This flaw is no longer available

[Anonymous Coward]

Wrong. The first public article was on seclists.org at which point the flaw still alive and kicking.

Re:This flaw is no longer available

[Anonymous Coward]

It must have been a short lived bug because the first time I noticed they displayed the name/photo for me on a mistyped password, I tried someone else's account and it did not display their info.

Re:This flaw is no longer available

[rudy_wayne]

This flaw is no longer available on Facebook logon pages.

In fact it was removed before this story made it to the /. front page.

It was removed approx. 11 hours after the first public articles about it.

- Jesper

Sorry Jesper, but you are wrong. I just tried it and the problem HAS NOT been fixed as of 4:47pm EST today.

Re:This flaw is no longer available

[blackraven14250]

Interesting point, considering he's talking about the flaw being fixed 11 hours after the first articles.

Re:This flaw is no longer available

[Anonymous Coward]

clear your cookies and stuff, the bug is gone now

Re:This flaw is no longer available

[Kelson]

Try clearing your cookies in between (or just use a different browser), or test it with someone else's email address. It only shows your name and photo if you were previously logged on with the same account.

I'm not sure how wise that is, but it's certainly an improvement over any random person being able to extract the information (assuming, of course, that your name and photo aren't already publicly associated with that email address via other channels).

Re:This flaw is no longer available

[Farmer Tim]

Slashdot: recent history for nerds, stuff that once mattered.

Re:This flaw is no longer available

[guyminuslife]

I am currently reading a novel called "Rollback." In the story, Earth received a message from alien life forms on a distant planet in 2010. One of the main characters, a SETI researcher, doesn't find out about it until after the news has been leaked publicly. Her husband breaks it to her: "It's all over the Internet, including Slashdot!" And my reaction was, "What? Slashdot already has it on the frontpage? She must really be the last person to find out!"

Re:This flaw is no longer available

[amicusNYCL]

Just tried right before this post with a browser I don't use Facebook on, with a couple email addresses for users from a forum that I admin. It most definitely showed real names for the people, although not pictures. Could be that none of them have pictures. It took 3 failed logins and then a captcha before it showed the name.

Re:This flaw is no longer available

[prostoalex]

What happened when you tried someone else's e-mail address?

Re:This flaw is no longer available

[Anonymous Coward]

Yep, if I try it with my regular account then I see my name and photo, but with a different account I get no extra information

Re:This flaw is no longer available

[Khyber]

Why? Given the shit concerning this site, one would think it would have been better for this knowledge to get out even faster so people would know to drop that site like a hot lava rock.

Optomist...

[ViViDboarder]

I noticed this the other day, but I was kind of hoping it only brought that up because I had a cookie and had logged in before... Guess not.

Scraping

[wideBlueSkies]

Jeez... you can write a perl script to do the scraping in about 15 minutes.

Besides the fix for the insecure functions on the page, I certainly hope they are doing IP blocking....

But what a bunch of PR jumbo... the problem is the result of a bug?? I'd disagree. I've seen the login error page. The function of showing the image and repeating the email address is by design . A horribly insecure design in the context of Facebook's privacy settings setup. But it was a design decision, not a bug.

At least that's how I see it.

Re:Scraping

[RAMMS EIN]

``But it was a design decision, not a bug.''

Also, not telling whether they got the username correct or wrong is security 101.

This is yet another case of Facebook having done the wrong thing for their users' privacy, and correcting things only to lessen the negative publicity. It's not an accident.

The word AND is not in short supply

[Anonymous Coward]

"Facebook Bug Could Give Spammers Names, Photos"

Names, Photos?

A comma was traditionally used in printing headlines in place of "and" because the litho did not usually have an ampersand character with which to save space.

There is no excuse for this misuse of the comma in the 21st century.

Re:The word AND is not in short supply

[Anonymous Coward]

So what. All languages change over time smartass.

Lemme guess, you do not have a TV in your house, you drive a Prius, you're a vegan, and your main computer is an Apple... either that or you have the assburgers in your brain. Amiright?

Re:The word AND is not in short supply

[PhxBlue]

How do you figure it's misuse? It was used in that headline to separate two items on a list. Since there are still a few print-edition papers here and there, it still makes sense to use commas in place of "and" for headlines.

Re:This flaw is STILL available

[Anonymous Coward]

I just tested it. Logged out, logged back in with the wrong password.

Guess what? It shows my name. I've turned off sharing my profile picture but the main article is talking about it scraping names for realistic spam. That is still available.

Where are you getting your information again?

Re:That's nothing.

[not already in use]

I noticed lots of people take pictures of mirrors, too.

Re:This flaw is STILL available

[Anonymous Coward]

I just tested it. Logged out, logged back in with the wrong password.

Guess what? It shows my name. I've turned off sharing my profile picture but the main article is talking about it scraping names for realistic spam. That is still available.

Where are you getting your information again?

Maybe it relies on a cookie or something, and it only shows that to you because you've been logged in before. I just tried a friend's email address and wrong password, and it didn't show me any information about him. He has never been logged into Facebook on this machine.

*does not affect deactivated accounts

[Rooked_One]

I deactivated my account log ago, and just checked - it doesn't say a word about who I am. Not sure if anyone else has tried this to actually see if it works.

Return vs. Fresh Login

[Kelson]

Maybe it relies on a cookie or something, and it only shows that to you because you've been logged in before.

That does seem to be the case. I just tested it on two browsers, one of which I don't use with Facebook.

On the browser that I don't use with Facebook, the "Please enter your password" screen did not include a name or picture.

On the browser that I do use with Facebook, and had just logged out seconds before, my name and photo did appear. However, if I entered someone else's address, the name and photo did not appear. Just for kicks, I tried two email addresses, one of which I know does have an account and one of which I know doesn't. Facebook *did* tell me which one was not associated with an account.

A spammer isn't going to have your cookies, so they won't get your name and photo. But they can confirm whether you have a Facebook account or not.

Re:Return vs. Fresh Login

[AnAdventurer]

Best line EVER: A spammer isn't going to have your cookies

Re:Return vs. Fresh Login

[Anonymous Coward]

Holy sh!t, Kelson! You may have just stumbled upon the next big exploit...

If some spyware guys mined your cookie cache, grabbed all the TwitFaceSpace cookies, and sent them back to homebase, then they'd be able to do just what has been suggested, since they'd have the cookies needed. Daaammmnnn...

Who said cookies were harmless?

Which is why...

[Anonymous Coward]

Which is why you never use your real name on a non-pay website. Ever.

FB

[Anonymous Coward]

People on Facebook live in a bubble if they believe they have any privacy. This website has a crude and clever way to keep track of who's deleting you on the site.

Predicted long ago

[betterunixthanunix]

My security engineering text (Anderson, 2nd edition) predicted that social networking websites would become security liabilities because of the amount of personal information they store about their members. That book was published in 2007.

"We were warned?"

Re:Predicted long ago

[Archangel Michael]

"Long ago" being any length of time greater than about 3 years???

Re:Predicted long ago

[betterunixthanunix]

Considering how long these websites have been overwhelmingly popular, to the point of actually becoming security liabilities?

can also just search for email address.

[joostje]

Not just the "re-enter password" page. If you enter an email address in the normal facebook search box, facebook will show you the name of the account that uses that email address (though not the photo, if it is blocked).

Rolling out might take time?

[SplatMan_DK]

Sorry Jesper, but you are wrong. I just tried it and the problem HAS NOT been fixed as of 4:47pm EST today.

Fair enough, you tested it and found the flaw alive and kicking.

Did you flush your browser cache before testing? And did you ensure that you are not getting the page from a proxy server someweher between you and the FB server?

If you are still getting the flaw (as I can see a number of other users are also reporting) my guess is that:

1.) They are getting cached results from somewhere
2.) Facebook has fixed the flaw, but propagating it to their 32.000 servers (literally dude) takes a little time.

Obviously I tested it myself before making the first comment ;-) and I am unable to get any information listed. I have tried with 5 accounts belonging to friends and family (and I picked the e-mails they use for their FB accounts) without getting any interesting information. I would (obviously) not post something like my first comment on a /. front page article without testing it first ...

Now, FB should still get hammered for being so damn stupid, but on the servers that I get results from the flaw is gone.

- Jesper

Re:This flaw is STILL available

[Anonymous Coward]

Do it again with a different email (a user you know of)... Its because of your cookies. Come on now....!

Re:That's nothing.

[Anonymous Coward]

I don't like most babies a whole lot either, and I detest after-birth pictures, but you are overreacting by quite a bit. Your whinings are as annoying as the exuberant adulations of a newfound parent.

Works for me

[gringer]

I don't have a facebook account, but I tried a few random emails (pretty much name@gmail.com), and came up with a full name and photo (although more commonly just the full name).

1. enter email address with 'mashed keys' as password
2. enter email address with 'mashed keys' as password 2 more times at 'incorrect login' screen
3. enter captcha
4. if email address represents a real user, their name (and photo, if it exists) shows up

It knew who I was

[Anonymous Coward]

I noticed this a couple of weeks ago. The weird thing is, instead of using the email address associated with facebook, I typed one of my other email addresses in by mistake when trying to log in and it knew who I was even though that particular email address had never been used with facebook ever. It even used the shortened form of my name that I use with that email address instead of the longer form I use with facebook. Where did it get that information? Fortunately it didn't have a picture of me associated with the other email address.

Re:It knew who I was

[forgot_my_nick]

Almost certainly some brain dead acquaintance of yours knows both your email addresses, had them in their email address book under your name and allowed Facebook to rifle through it when they signed up.

Re:That's nothing.

[Anonymous Coward]

we should scrape the profile pictures for those not taken in mirrors, then sell their email addresses to mirror manufacturers

Internet security

[LoudMusic]

Q: Is your personal data safe?

A: [in form of a question] Is it in anyway a part of the internet, including being on your own computer in your own home, which is connected to the internet? If yes, then no.

Hell, even if I don't have a Facebook account and someone takes a pictures of me and uploads it to Facebook and tags it with my name then the internet knows what I look like. Privacy is a joke.

On the other hand, perhaps there's a market in creating false identities for people as a false data internet flood. As a business they would sign up for popular social networks with your name and upload a variety of pictures claiming to be you, with routine updates about things you're not actually doing. They could use their client list to 'friend' each other and build a nice false society. If someone on the internet ever posted true or factual information or pictures about you it would be considered less reliable due to the voluminous FUD being provided by the company hired to provide false information, and therefor discarded.

Not news

[YoshiDan]

I noticed this 'feature' a long time ago when I entered my password wrong. I was a bit concerned at the time and I did think "what sort of idiot thinks of an idea like this"... At least they're fixing it.

What is the bug again?

[Alien1024]

From TFA:

"We have technical systems in place to prevent people's names and photos from showing to unrelated users upon login, but a recently introduced bug temporarily prevented these from working as intended," a company spokeswoman said in an e-mail message. "We are already working on a fix and expect to remedy the situation shortly."

If by "upon login" they mean when a wrong password is entered, I don't understand what the bug is, since the "Is that you?" screen is the intended behavior, not a buggy one. By the way, it only happens if the email address matches the account which was last logged in on the browser, and it forgets it if you wipe the cookies (maybe the "bug" is already fixed?). But even if that page was shown for any email, that's not the only or even the easiest way to get the name and picture matching an email; that's as easy as searching users by email.

Of course it's easy to build a phishing site that replicates the "wrong password" screen, but anyone who falls for such a phishing attempt has worse problems on the internet.

Another nail in the coffin

[tywjohn]

Just one more reason to ditch facebook. It is addictive but I'm glad I left it months ago now. Never looked back.

Mark Zuckerburg Doesn't Really Care

[CodeBuster]

Facebook doesn't care about users' privacy. Mark Zuckerburg has already said as much and his opinions on privacy are well known and oft repeated points of public controversy. It follows then that he doesn't much care for security either. In fact, it is likely that Mark is more concerned about competitors and would be rivals getting their hands on "his" data and beating him to the advertising punch than he is about the potential consequences for his users. This episode really shouldn't surprise anyone here on Slashdot because it fits neatly within the careless corporate culture of Facebook and their wanton disrespect for users or, as Zuckerberg has called them in the past, "dumbasses".

Goof night and good luck

[Anonymous Coward]

Isn't this why we have services like gmail, hotmail, yahoo, etc that provides an essenitally limitless supply of disposable email addresses. Both my business and my personal email contain my full name, but now why in the hell would I use that information to register for a site like facebook? Everyone is up in arms and getting pissed off at facebook for allowing these bugs and exploits, but if people didn't willfully provide this information and demand an instant notification when uncle bob pokes aunt sue or little amy had an abortion, these companies wouldn't have their personal information. These morons are the instrument of their own demise. And if all else fails punch a monkey win an ipod.

This just in

[Anonymous Coward]

If you put shit on the internet, people can and will find it.

It's not a bug, it's a feature

[js_sebastian]

Fixing this alone means nothing. If you search for someone on Facebook it will show you a name and a profile picture. Sure, it requires a facebook account, but that's not too hard to create for somebody with 4,000,000 email addresses.

People from our lab have a paper coming up at RAID this year pretty much on the same issue, exploited at a large scale (trying millions of email addresses): http://iseclab.org/papers/raid2010.pdf. Read it if you want to get an idea of how much impact such an attack can have. As a spammer, if I know the full name and list of friends (public information on facebook) associated with an email address in my spam targets list, I can do some very sneaky, targeted spam pretending to come from one of your friends...
The important point is that this is not a bug. It's an undesirable side effect of the friend finding feature that is very useful to some users and that facebook certainly has no intention of removing. As a consequence of this paper, they apparently implemented a rate limiting in the number of email address queries one can do... better than nothing, but there are no full solutions.

Want to be found?

[jumpmanlives]

Don't use real names on FB. Online friends will know you by your handle. You can choose your friends and be in control. Basing accounts on email addresses is a good idea but link your FB account to an email that doesn't contain your real name too. :Ð

Re:Want to be found?

[John Hasler]

> Don't use real names on FB.

I think it may be a good idea the create an FB account in your real name, but it should be a dummy account, existing just to block "pranksters" from using it.

Info Scraping is Part of Their Business Model

[Anonymous Coward]

All you need to do to get private information out of Facebook is to create a game with family friendly graphics that will hook in all sorts of players, scrape in the player's and their friends information to get demographic stats and email addresses and presto! wait for your databases to start filling up. For a fee Facebook will allow anyone to develop a “Farmville” or “Mafia Wars” that will annoy your friends and steal their information.

not a bug

[Jherico]

That's not a 'bug'. Its an incredibly bad design decision.

Subramanian

[Anonymous Coward]

Check out http://t.wits.sg/2010/08/14/attack-of-the-facebook-harvesters/. Somebody has managed to do the same through the Facebook APIs. They even exposed Mark Zuckerberg's, Sheryl Sandberg's emails too. This is getting really dangerous.

This "bug" is also present in another place

[Anonymous Coward]

It is the facebook APIs. They too expose this and spammers could write a script to use that. A sample of which is done at http://t.wits.sg/2010/08/14/attack-of-the-facebook-harvesters/. There the author gets the email addresses of Facebook employees. THis is really getting scarier