<story><title>More than 1MM Facebook accounts exposed </title><url>https://www.google.com/search?q=bcode%3D&amp;oq=bcode%3D&amp;sugexp=chrome,mod=0&amp;sourceid=chrome&amp;ie=UTF-8#q=inurl:bcode%3D%5B*%5D%2Bn_m%3D%5B*%5D+site:facebook.com&amp;hl=en&amp;safe=off&amp;prmd=imvns&amp;filter=0&amp;bav=on.2,or.r_gc.r_pw.r_cp.r_qf.&amp;fp=8c0bb27d33614e56&amp;bpcl=37189454&amp;biw=1560&amp;bih=698</url></story><parent_chain><item><author>lazyjones</author><text>The URLs don&apos;t need to be posted online. Some browsers (Chrome, possibly Firefox with Safe Browsing mode, very likely any browser with a Google Toolbar installed) send visited URLs to Google and they will be indexed. I don&apos;t know if this is officially documented by Google, but several people have reported seeing this while testing new/beta websites that weren&apos;t published or linked anywhere.</text></item><item><author>mkjones</author><text>My name is Matt Jones, and I work on the Facbook security team that looked into this tonight. We only send these URLs to the email address of the account owner for their ease of use and never make them publicly available. Even then we put protection in place to reduce the likelihood that anyone else could click through to the account.&lt;p&gt;For a search engine to come across these links, the content of the emails would need to have been posted online (e.g. via throwaway email sites, as someone pointed out - or people whose email addresses go to email lists with online archives).&lt;p&gt;As jpadvo surmised, the nonces expire after a period of time.  They also only work for certain users, and even then we run additional security checks to make sure it looks like the account owner who&apos;s logging in. Regardless, due to some of these links being disclosed, we&apos;ve turned the feature off until we can better ensure its security for users whose email contents are publicly visible.  We are also securing the accounts of anyone who recently logged in through this flow.&lt;p&gt;In the future if you run into something that looks like a security problem with Facebook, feel free to disclose it responsibly through our whitehat program: &lt;a href=&quot;https://www.facebook.com/whitehat&quot; rel=&quot;nofollow&quot;&gt;https://www.facebook.com/whitehat&lt;/a&gt;.  That way, in addition to making some money, you can avoid a bunch of script kiddies exploiting whatever the issue is that you&apos;ve found.</text></item></parent_chain><comment><author>Matt_Cutts</author><text>Hi there, allow me to correct this misconception. I&apos;ve debunked that idea often enough that I wrote a blog post about this four years ago: &lt;a href=&quot;http://www.mattcutts.com/blog/toolbar-indexing-debunk-post/&quot; rel=&quot;nofollow&quot;&gt;http://www.mattcutts.com/blog/toolbar-indexing-debunk-post/&lt;/a&gt; I wrote an earlier debunk post in 2006 too: &lt;a href=&quot;http://www.mattcutts.com/blog/debunking-toolbar-doesnt-lead-to-page-being-indexed/&quot; rel=&quot;nofollow&quot;&gt;http://www.mattcutts.com/blog/debunking-toolbar-doesnt-lead-...&lt;/a&gt;&lt;p&gt;I noticed a new twist in your post though: you&apos;re saying that because of Safe Browsing (which checks for e.g. malware as users surf the web), those urls are sent to Google. The way that Chrome and Firefox actually do Safe Browsing is that they download an encrypted blob which allows the browser to do a lookup for dangerous urls on the client side--not by sending any urls to Google. I believe that if there&apos;s a match in the client-side encrypted table, only then does the browser send the now-suspect url to Google for checking.&lt;p&gt;Here&apos;s more info: &lt;a href=&quot;https://developers.google.com/safe-browsing/&quot; rel=&quot;nofollow&quot;&gt;https://developers.google.com/safe-browsing/&lt;/a&gt; I believe the correct mental model of the Safe Browsing API in browsers is &quot;Download a hash table of believed-to-be-dangerous urls. As you surf, check against that local hash table. If you find a match/collision, then the user might be about to land on a bad url, so check for more info at that point.&quot;&lt;p&gt;Hope that helps. Further down in the discussion, someone posted this helpful link with more explanation: &lt;a href=&quot;http://blog.alexyakunin.com/2010/03/nice-bloom-filter-application.html&quot; rel=&quot;nofollow&quot;&gt;http://blog.alexyakunin.com/2010/03/nice-bloom-filter-applic...&lt;/a&gt;</text></comment>
<story><title>More than 1MM Facebook accounts exposed </title><url>https://www.google.com/search?q=bcode%3D&amp;oq=bcode%3D&amp;sugexp=chrome,mod=0&amp;sourceid=chrome&amp;ie=UTF-8#q=inurl:bcode%3D%5B*%5D%2Bn_m%3D%5B*%5D+site:facebook.com&amp;hl=en&amp;safe=off&amp;prmd=imvns&amp;filter=0&amp;bav=on.2,or.r_gc.r_pw.r_cp.r_qf.&amp;fp=8c0bb27d33614e56&amp;bpcl=37189454&amp;biw=1560&amp;bih=698</url></story><parent_chain><item><author>lazyjones</author><text>The URLs don&apos;t need to be posted online. Some browsers (Chrome, possibly Firefox with Safe Browsing mode, very likely any browser with a Google Toolbar installed) send visited URLs to Google and they will be indexed. I don&apos;t know if this is officially documented by Google, but several people have reported seeing this while testing new/beta websites that weren&apos;t published or linked anywhere.</text></item><item><author>mkjones</author><text>My name is Matt Jones, and I work on the Facbook security team that looked into this tonight. We only send these URLs to the email address of the account owner for their ease of use and never make them publicly available. Even then we put protection in place to reduce the likelihood that anyone else could click through to the account.&lt;p&gt;For a search engine to come across these links, the content of the emails would need to have been posted online (e.g. via throwaway email sites, as someone pointed out - or people whose email addresses go to email lists with online archives).&lt;p&gt;As jpadvo surmised, the nonces expire after a period of time.  They also only work for certain users, and even then we run additional security checks to make sure it looks like the account owner who&apos;s logging in. Regardless, due to some of these links being disclosed, we&apos;ve turned the feature off until we can better ensure its security for users whose email contents are publicly visible.  We are also securing the accounts of anyone who recently logged in through this flow.&lt;p&gt;In the future if you run into something that looks like a security problem with Facebook, feel free to disclose it responsibly through our whitehat program: &lt;a href=&quot;https://www.facebook.com/whitehat&quot; rel=&quot;nofollow&quot;&gt;https://www.facebook.com/whitehat&lt;/a&gt;.  That way, in addition to making some money, you can avoid a bunch of script kiddies exploiting whatever the issue is that you&apos;ve found.</text></item></parent_chain><comment><author>franze</author><text>an old meme, and my usual recommendation: just test it: create a page that i not linked from anywhere. visit it with the browsers mentioned above. watch the logfiles. wait for it. nope, no googlebot request. it is unbelievable easy to test, i have done so on various occasions in the past, so there is no need for you to spread a &quot;several people have reported&quot; rumor. just ... test ... it.&lt;p&gt;as for the old stories, that google does this kind of thing: people, especially SEOs or people who think they know SEO, always blame google. oh, my beta.site has been indexed, it must be because of ... google is evil.&lt;p&gt;most of the times i have seen cases where googlebot found a not published yet site it was because of (just some examples, not a complete list) i.e.:&lt;p&gt;* turned on error reporting (most of the PHP sites)
 * the URLs were already used in some javascript
 * server side analytics software, open to the public
 * apaches shows file/order structure 
 * indexable logfiles
 * people linked to the site
 * somebody tweeted about it
 * site was covered on techcrunch (yes, really) 
 * all visited URLs in the network were tracked by a firewall, the firewall published a log on an internal server, the internal server was reachable from the outside
 * internal wiki is indexable
 * intranet is indexable
 * concept paper is indexable&lt;p&gt;testing your hypothesis &quot;chrome/google toolbar/... push URLs into the googlebot discovery queue, which leads to googlebot visits&quot; is easily testable. no need to spread rumors. setup for testing this: make an html-page (30 seconds max, basically ssh to your server, create a file, write some html), tail &amp;#38; grep logfiles (30 sec max), wait (forever)</text></comment>