In almost any web app you'd write this up as "Sev: Low", "Impact: Information Leakage".
But this isn't any web app; it's the most popular complex web app in the world. It seems like there's zero likelihood Facebook doesn't (a) know about this and (b) want Facebook to work this way. Presumably, it helps people like my mom.
It was always a bad idea to associate your secret anonymous email address that you use to send ransom letters with your Facebook account.
There are a lot of tradeoffs one makes with dealing with nontechnical customers which geeks might hate. Geeks do not have to worry about the "Facebook login" fiasco, but if you sell to my customers, are Paypal, etc, then login issues are a core business requirement. Note that site abandonment among users unable to log in is ridiculously high (I should track this...) and every time that happens Facebook loses revenue, shareholder value, and network effects.
The author states it might be useful in guessing valid company email
addresses. Isn't it easier to create a CSV/Outlook compatible file
containing hundreds of generated addresses, and then ask Facebook to
find new friends for you. Plus, that will allow you to check many more
adresses before Facebook senses something silly and disables the login
form - which would happen if you use the login-form method.
Heck, this is perfectly possible with LinkedIn and twitter as well. I
don't understand what the fuss is.
The author states that this does not check a user's privacy settings, but as another participant in the thread points out[1], importing an address book to look for new contacts respects privacy settings (i.e. a 'new contact' will only show up if their privacy settings allow their profile to show up in search results).
Since GMail released their small revision the other day that put a more "GMail-like" GUI on the Contacts section, I've been sorting and completing my list of contacts. I had 5 ambiguous e-mail addresses left that I couldn't pinpoint who they belonged to. After reading this article I decided to give this Facebook feature/vulnerability a try. 4 out of 5 previously anonymous e-mails are now verified with their first, last name, and photo (it turns out I know all 4 in person so in all likelihood the results are correct). Not too shabby, and a little bit scary.
RapLeaf offers a service where you give it an email address and it returns the Facebook, Twitter and other social media accounts associated with it.
Now, I'm not saying they are using this vector, but then they must be using something like this because how else could they offer the service. (This also means there might be other vectors to achieve this end result).
To me, this also makes me pleased that I use a unique email address against my email domain for each site I use.
I'm not so sure why this even matters. If you search for someone based on their email address within Facebook, it comes up with their name and photo as well. In my case, it's a feature. But true there is no point to it giving this information on the wrong password screen, but if someone wants this information they can still get it using Facebook.
Maybe Google should worry about this too...I usually type unfamiliar email addresses into Google and end up with far more than just a name and a picture.
Well the problem with this vulnerability is that many spammers have millions of email addresses, only a fraction of them with the full name. With this Facebook issue they will get tens or hundreds of thousands of names connected, and will further resell this database.
This seems like quite an asset to me, because spam mails with the real name will have a much higher engagement.
I always use my real name when I send email, so email coming to me with my name on it is unremarkable and does not give me any reason to think it's "safe."
nice find. The followup is correct; slight mispellings are corrected, allowing further guesses.
This coupled with the fbnames release earlier makes me think it's only a matter of time before someone crawls and "open sources" all accessible personal data from facebook.
The same can be done for Gmail (and probably Google Apps) users through GDocs. Just share a document to an email address, and GDocs will show you their name.
But that ends up sending an email to the account you extend the sharing request to. It might raise a red flag to some people.
This 'vulnerability' doesn't contact the victim, so it can be done in combination with, like the report said, a phishing scheme to gain the real names of the users of an email list.
I'm not saying that this is some massive privacy issue. It opens up a vector to make other attacks, specifically email based attacks, seem more legitimate, which is a bad thing.
There is an option to not send an email. And it's not a request - once you share it, the recipient doesn't need to accept. The users can see them in their GDocs list though. But if you quickly unshare them and they're not currently viewing their list, they'll be unaware of it.
I didn't think that it was an option, but I did check. You are right. Of the three checkbox options, notifying the recipient of a share invitation is the only one checked by default.
Either way, my main point stands. This isn't a major privacy issue. Though, I've always been taught that when developing an authentication mechanism, one should not distinguish between a bad password or bad email address/user name in the error message provided to the user. Specifically the latter, since a "Invalid password supplied for John Doe" gives confirmation that the username provided is valid, and a bruteforce or dictionary attack on the name will probably successful.
Not sure if that's only on Facebook US servers or it's been disabled already, but from here in NZ there's no such info leakage, you get a very boring error page.
The only thing you can discover is whether the email address you entered is a valid Facebook login or not - you get a different error response for an email address that's not a valid Facebook login.
But this isn't any web app; it's the most popular complex web app in the world. It seems like there's zero likelihood Facebook doesn't (a) know about this and (b) want Facebook to work this way. Presumably, it helps people like my mom.
It was always a bad idea to associate your secret anonymous email address that you use to send ransom letters with your Facebook account.