Another FaceCrack (facebook) fail!

[ZeroHour]

I just attempted to log into facebook and entered my password incorrectly.

It appears now if you do this and enter a valid email address of a user they will tell you that on the failed login page as well as the name of the person and their avatar (I assume the privacy will stop them though)

Spambots could then havest valid email addresses and actually use your real name in the spam.

 

Oh dear, the most basic of security rules, dont tell the user which part is incorrect, just tell them the combination is invalid....

Edited July 29, 2010 by ZeroHour

[vikpaw]

Facecrap? You mean you don't use FriendFace ?

It has solitaire you know, not to mention all those girls from the seventh floor.

[webman]

Not good.

 

I recently discovered that a public API to another popular social networking site allows access to post contents and photos of users with private profiles. Although the API is publicly accessible, it hasn't been officially announced.

[featured_spectre]

thats actually quite disgraceful!