Facebook secret email (Don't miss!!!)

[Google]

http://www.youtube.com/watch?v=sIxpzDQ70lI

*Note that this video was exclusive for Beyond-Security.Org; Other than that, no comments.

[7alewi]

I like this!

[H@SSàN]

ma fhemt shi

[7alewi]

omg I just tried it, it worked!! Thanks!!!

[Abruzzy]

Amazing Man !!
It's Working !!

PS: You also mentioned that by obtaining the email we can upload photos and videos ... how can we do that !?

[Kingroudy]

edgard, overall, your excellent, but in this thread, you just posted something below average. i noticed the email thing while browsing from my mobile but didn't give a damn about it.

[Google]

Originally Posted by Kingroudy

edgard, overall, your excellent, but in this thread, you just posted something below average. i noticed the email thing while browsing from my mobile but didn't give a damn about it.

Don't you see the security risk imposed by this?!
This unmasked email is equivalent to the password in this case and it is easy to manage to get it or trick a user to give it to you so obviously, the security risk vector increased.
The only thing that is needed is to find a relation between the Facebook id and this email. I know this is a hard task, but if done by someone, it will mean that someday you might see all the people on Facebook putting the same status (1), it will be a mass attack!

(1) My name.

[xcoder]

Youtube has the same utility, you can send your video to Youtube and it will be posted automatically. You can reset it too as far as i recall.

It's a nice feature in my opinion and it has a specific hashing system or random unique results.

I use similar hashing system on one of my websites.

something like this:

$hash = '2j14p'; // Static hash
$hash = md5($user_id . $hash); // Combine and encrypt
$hash = substr($hash,0,5); // Take the first 5 characters
$email = 'mobile_' . $user_id . '_' . $hash . '@website.com'; // construct email address

When sending emails, the system validates the user_id + static hash, encrypt them, take the first 5 characters and match it with the last part of the email.

The email address is not created on the system, all non found emails or emails having a certain format are forwarded to "updatestatus@website.com" let's say.

The system grabs those emails, validate their info and if all is true, take the title or body and set it as the user's status.

I can't really assume that's what facebook and youtube are using, but I'm pretty sure it's not something simple or easy to break.

[Abruzzy]

Originally Posted by xcoder

I can't really assume that's what facebook and youtube are using, but I'm pretty sure it's not easy to break.

Nothing is Impossible !!
Yalla gd luck mate !!

[Google]

@xcoder, yeah sure it is not easy at all, and they might be using time stamp functions which helps in generating highly random output.
But anyway, nothing is 100% secure. Keep in mind that the email output is some known words + numbers which means that the word part is based on a certain dictionary... khalas boukra lamma 2ekteshefa b2elkon kif