HN Explorer

Live Chat with anyone on Facebook (even non friends)

62 points by weakwire ↗ HN
Messed around a bit and i found something really interesting. You can chat live with anyone at facebook even people you are not connected.

You can even see when the other party is typing and read your message.

First find his facebook id. You can do it at http://findmyfacebookid.com/ or any other service.

http://www.facebook.com/othelis ---> id= 699313289

Open you browser's console at facebook and type

Chat.openTab(id) eg. Chat.openTab(699313289)

You can live chat with strangers and non friends now and get notified when they read your message!

36 comments

[ 2.4 ms ] story [ 116 ms ] thread
HugoDias
Holy crap, it really works
weakwire
yeap!
HugoDias
But don't work like it should. The chat only appears to the addressee if he opens a chat box to chat with you ..
weakwire
In my case it opens instantly..
webosb
works for me. it requires a valid id.
samwillis
Interesting...

Chat with Mark Zuckerberg:

  javascript:Chat.openTab(4)
joezhou
haha, pls do it and report back
why-el
This is not surprising because Facebook treats chat and messages as the same. They both end up in the same thread. So as you can send a message to anybody, you can "chat" with anybody. Whatever you wrote will be received in their inbox as a regular message.

I am not sure what happens with people who choose not to receive messages from the public though.

nickbarnwell
This is no different than navigating to that person's page and clicking on the 'Message' button. It's not a vulnerability.
weakwire
You can see when is typing or if he/she read your message
codecurve
After you send a message, you can select open in chat from the actions drop down.
tomasien
Noooo Chat and Messaging are the same thing, and you've always been able to message strangers. Just go to their profile and hit "message".
weakwire
can you see when they receive the message and when there are typing? Also it appears on the main chat window?
kidh0
Facebook id number 1, 2 and 3 do not exists.
tantalor
Probably some protected super-user accounts.
msoad
Because Mark deleted them after he made sure his POSTs are working
DanielBMarkham
Ouch.

I can't help but think that somewhere at Facebook there's a huge fire-drill going on right now.

Justsignedup
Yeah it's called "oh look, a HN article, whatever ignore it, we'll fix it next year, and nobody will give a shit"
objclxt
I am wondering why the OP decided to post it here, rather than try and get a bug bounty (edit: assuming it's a genuine issue, seems like maybe it isn't). It would probably be worth a fair amount...certainly a few thousand at least. Facebook are normally pretty happy for you to disclose after they fix it, so you can still get the PR...
DanielBMarkham
After I commented, I flagged the post. I'm not comfortable with this being on HN. FB should have a chance to fix it.

On the plus side, the entire thing may just be a misunderstanding. Other commenters are pointing out that it doesn't really live message them if you're not friends, just regular messages them -- which you could do anyway. It's just the UI appears that you are live messaging.

We'll see. But you're right -- very odd to post that here with a reward being easily available.

weakwire
Confirming it's the default behavior. After some googling this call is known on the internet. It's just a shortcut to the original(quite hidden) behavior. Check comments below with "FacebookChatRoulette". It's interesting how easy and automated can be to send a msg to anyone. So that raises some concerns. Definetly not a bug ..
adkatrit
Facebook IM Roulette

Chat.openTab(Math.floor(Math.random() * 100000000))

[deleted]
(comment deleted)
msoad
I have two Facebook accounts that are complete strangers to each other.

When I sent a message from one to the other one, message didn't pop up. It was in "Others" section of my account inbox.

So it's basically a normal message that you can send to anyone now. Even Zuck

spleeder
I think it has already been fixed. It's not working for me anymore. Too bad, I was having fun.
Peroni
Go to the users page and click 'message'. It's the exact same thing.
Mithorium
This isn't news. Chat and messaging are one and the same. You can message anyone, and you can migrate conversations arbitrarily between the chat and message UI, or even both at the same time. If you message someone who you don't have good reason to message, facebook will classify it as spam and send it to their "other" box.
anirban24in
ZukerBerg would be getting more money for getting hits for this bullshit too....why would he want to debug it???