<story><title>More than 1MM Facebook accounts exposed </title><url>https://www.google.com/search?q=bcode%3D&amp;oq=bcode%3D&amp;sugexp=chrome,mod=0&amp;sourceid=chrome&amp;ie=UTF-8#q=inurl:bcode%3D%5B*%5D%2Bn_m%3D%5B*%5D+site:facebook.com&amp;hl=en&amp;safe=off&amp;prmd=imvns&amp;filter=0&amp;bav=on.2,or.r_gc.r_pw.r_cp.r_qf.&amp;fp=8c0bb27d33614e56&amp;bpcl=37189454&amp;biw=1560&amp;bih=698</url></story><parent_chain><item><author>mkjones</author><text>My name is Matt Jones, and I work on the Facbook security team that looked into this tonight. We only send these URLs to the email address of the account owner for their ease of use and never make them publicly available. Even then we put protection in place to reduce the likelihood that anyone else could click through to the account.&lt;p&gt;For a search engine to come across these links, the content of the emails would need to have been posted online (e.g. via throwaway email sites, as someone pointed out - or people whose email addresses go to email lists with online archives).&lt;p&gt;As jpadvo surmised, the nonces expire after a period of time.  They also only work for certain users, and even then we run additional security checks to make sure it looks like the account owner who&apos;s logging in. Regardless, due to some of these links being disclosed, we&apos;ve turned the feature off until we can better ensure its security for users whose email contents are publicly visible.  We are also securing the accounts of anyone who recently logged in through this flow.&lt;p&gt;In the future if you run into something that looks like a security problem with Facebook, feel free to disclose it responsibly through our whitehat program: &lt;a href=&quot;https://www.facebook.com/whitehat&quot; rel=&quot;nofollow&quot;&gt;https://www.facebook.com/whitehat&lt;/a&gt;.  That way, in addition to making some money, you can avoid a bunch of script kiddies exploiting whatever the issue is that you&apos;ve found.</text></item></parent_chain><comment><author>blauwbilgorgel</author><text>Since this is already out there as a known issue, and concerns Google too, check out:&lt;p&gt;&lt;a href=&quot;https://www.google.com/search?q=%22wants+to+be+friends+on+Facebook%22+%22If+you+don%27t+want+to+receive+these+emails+from+Facebook+in+the+future%22&quot; rel=&quot;nofollow&quot;&gt;https://www.google.com/search?q=%22wants+to+be+friends+on+Fa...&lt;/a&gt;&lt;p&gt;And you&apos;ll find at the time of writing 250.000 more results where the &quot;wants to be friends&quot; email with the auto-login link is posted on blogs. Many of these blogs are also hacked, in that they redirect you to Russian dating sites if you visit the homepage.&lt;p&gt;An example of such a blog with password reset email is:
&lt;a href=&quot;http://papajimummyji.blogspot.com/&quot; rel=&quot;nofollow&quot;&gt;http://papajimummyji.blogspot.com/&lt;/a&gt;&lt;p&gt;An example of a spam-redirecting blog is:
&lt;a href=&quot;http://demiansyahhh.blogspot.com/&quot; rel=&quot;nofollow&quot;&gt;http://demiansyahhh.blogspot.com/&lt;/a&gt; (possibly unsafe)&lt;p&gt;For some more Facebook reset emails see:&lt;p&gt;&lt;a href=&quot;https://www.google.com/search?q=%22You+recently+asked+to+reset+your+Facebook+password.%22+%22this+message+was+sent+to%22&quot; rel=&quot;nofollow&quot;&gt;https://www.google.com/search?q=%22You+recently+asked+to+res...&lt;/a&gt;&lt;p&gt;EDIT: Twitter emails are also exposed:
&lt;a href=&quot;https://www.google.com/search?q=%22Forgot+your+Twitter+password%3F+Get+instructions+on+how+to+reset+it.%22+site%3Ablogspot.com&quot; rel=&quot;nofollow&quot;&gt;https://www.google.com/search?q=%22Forgot+your+Twitter+passw...&lt;/a&gt;&lt;p&gt;Youtube emails:
&lt;a href=&quot;https://www.google.com/search?q=%22YouTube+sends+email+summaries+like+these+so+you+can+keep+up+with+your+channel+subscriptions.%22+site%3Ablogspot.com&quot; rel=&quot;nofollow&quot;&gt;https://www.google.com/search?q=%22YouTube+sends+email+summa...&lt;/a&gt;&lt;p&gt;Twoo emails:
&lt;a href=&quot;https://www.google.nl/search?q=%22Massive+Media+NV%2C+Emile+Braunplein+18%2C+9000+Ghent%2C+Belgium+BE0834322338%22+site%3Ablogspot.com&quot; rel=&quot;nofollow&quot;&gt;https://www.google.nl/search?q=%22Massive+Media+NV%2C+Emile+...&lt;/a&gt;&lt;p&gt;And likely more web services.</text></comment>
<story><title>More than 1MM Facebook accounts exposed </title><url>https://www.google.com/search?q=bcode%3D&amp;oq=bcode%3D&amp;sugexp=chrome,mod=0&amp;sourceid=chrome&amp;ie=UTF-8#q=inurl:bcode%3D%5B*%5D%2Bn_m%3D%5B*%5D+site:facebook.com&amp;hl=en&amp;safe=off&amp;prmd=imvns&amp;filter=0&amp;bav=on.2,or.r_gc.r_pw.r_cp.r_qf.&amp;fp=8c0bb27d33614e56&amp;bpcl=37189454&amp;biw=1560&amp;bih=698</url></story><parent_chain><item><author>mkjones</author><text>My name is Matt Jones, and I work on the Facbook security team that looked into this tonight. We only send these URLs to the email address of the account owner for their ease of use and never make them publicly available. Even then we put protection in place to reduce the likelihood that anyone else could click through to the account.&lt;p&gt;For a search engine to come across these links, the content of the emails would need to have been posted online (e.g. via throwaway email sites, as someone pointed out - or people whose email addresses go to email lists with online archives).&lt;p&gt;As jpadvo surmised, the nonces expire after a period of time.  They also only work for certain users, and even then we run additional security checks to make sure it looks like the account owner who&apos;s logging in. Regardless, due to some of these links being disclosed, we&apos;ve turned the feature off until we can better ensure its security for users whose email contents are publicly visible.  We are also securing the accounts of anyone who recently logged in through this flow.&lt;p&gt;In the future if you run into something that looks like a security problem with Facebook, feel free to disclose it responsibly through our whitehat program: &lt;a href=&quot;https://www.facebook.com/whitehat&quot; rel=&quot;nofollow&quot;&gt;https://www.facebook.com/whitehat&lt;/a&gt;.  That way, in addition to making some money, you can avoid a bunch of script kiddies exploiting whatever the issue is that you&apos;ve found.</text></item></parent_chain><comment><author>lazyjones</author><text>The URLs don&apos;t need to be posted online. Some browsers (Chrome, possibly Firefox with Safe Browsing mode, very likely any browser with a Google Toolbar installed) send visited URLs to Google and they will be indexed. I don&apos;t know if this is officially documented by Google, but several people have reported seeing this while testing new/beta websites that weren&apos;t published or linked anywhere.</text></comment>