I would immediately be skeptical if Firefox didn't have my info already entered into the login box. Good on this guy for being aware though, I'm sure many people wouldn't look at the URL at all.

Pardon me for asking, but what "damage" can someone getting into your facebook cause? I ask only as a rare facebook user.

@SittingOnTheColbert_GitEmSteveDave: Probably spamming your poor friends and family with goat pr0n.

@SittingOnTheColbert_GitEmSteveDave: Its a long shot, but could be a haven for identity theft. I know lots of people that have their home addresses and phone numbers posted for their friends.

@SittingOnTheColbert_GitEmSteveDave: Well they access all your info if you have it on there, which can include addresses, phone numbers, email addresses etc. A lot of people can use that as security answers so the phishers proabbly use it to try and access credit card/bank info. They have access to all your friends info and can spread like wildfile if they send the same email to every one of your friends. Pretty scary stuff.

Reminds me, I need to remove Facebook info as I don't trust it anymore.

A lot of people use the same passwords on many sites. I also think you can store lots of personally identifiable data on Facebook.

They have an email and password. The former is sorta useful, the latter is really useful as a lot of people recycle their passwords. (I'm guilty of, but only for minor stuff like forums where the damage isn't that severe.) Plus they can peruse your profile and status updates and garner all sorts of personal information: name, birthdate, probably your address (at least city, which makes white pages searches so much easier).

For example, somebody might have mentioned they went to X school with a friend, or cracked jokes about their high school mascot. School names or mascots are frequently password reset questions.

All sorts of stuff can be garnered from getting into somebody's account.

So the address is
[h1.ripway.com]
Facebok? heh.

Hosted by ripway.com, I wonder if an abuse email would do any good.

@CaptainKidd: Whoopsie, I didn't mean to make that url live. Sorry.

There was a story a while back of people contacting your friends or setting their status on facebook as "need help, stranded in [insert country here]"

Some of your more gullible friends would come to your rescue, at which point the scammer makes up some story about needing cash because they were robbed while traveling, etc.

There were a few stories about this not that long ago.

@PittDragon:

one thing they will try doing is emailing all your friends and telling them that you are stranded in a foreign country and need them to wire you money to get out.

@dreamsneverend: More than I do?!

@PittDragon: @spoco: Finally, a good reason for me not having friends!

@CaptainKidd: How about we all flag it as a Phishing site?

I got it too a couple days ago. I spent awhile reading it and trying to figure out it if was real until I realize, "Facebook doesn't have this email address." Then I deleted it. But it made its way to my Gmail inbox.

@SittingOnTheColbert_GitEmSteveDave: It doesn't seem like much, but they would gain access to your account and start spamming your friends and do other nefarious acts. Not only that, but they could then begin trying things like banks and whatnot using your stolen information because, unfortunately, most people use the same passwords for everything. Its seems like not much could be gained from this type of phishing, but it can snowball rapidly.

@YoSoyHe-Man!!_GitEmSteveDave: They would also have your email and password, a lot of people use one password for everything. With the email and password, if you only use that email, you could get into their email and find out bank info, credit card info, reset their passwords online...all sorts of fun stuff.

Never click links in email
Never click links in email
Never click links in email
Never click links in email
Never click links in email
(go to first line & repeat)

I just disabled any junk being emailed to me from FaceBook. Last thing I want is my inbox being bombarded with so and so has tagged you, so and so wants to add you etc. I can see all that stuff when I log in.

Yeah I get these kinds of things all the time from "Paypal" and have for many years. So I never click links in emails, I just go to the url and log in normally. The funny thing is I used to be so vigilant about sending the spoof emails to the spoof@paypal email address, until I realized that it did nothing and helped no one, as paypal does not care about you.

@pdj79: @snowburnt: Well, like everyone else should, I just submitted it as a phising/forgery site through firefox.

@CaptainKidd: I decided to enact my own little version of internet justice and spam his repository with fake addresses and passwords.

I sent an abuse e-mail over to help@ripway.com, and referred them to Consumerist and the offending link. We'll see how long it takes to get removed.

@coan_net: I read that to the tune of Bart and Homer's "You don't win friends with salad! You don't win friends with salad!"

Any time I get an email from myspace, facebook, forum or actually any site in general that says I've got a message from someone, I just simply go to the actualy page (in this case Facebook.com) and my stuff is already filled out (username pass), so it's not that hard to do. At least I know I'm at the actual site and not getting a phishing site. The way they get people is a combination of laziness and stupidity. They're too lazy to type the url, or even bookmark a site (facebook) and because they're too dumb to tell it's fake get scammed.

@nforcer:

Mee too also even :)

i enjoy sending in lots (sometimes hundreds when i am bored) of fake info to phishing sites.

@SittingOnTheColbert_GitEmSteveDave: Identity theft.

ther eare some poker applications that people have earned millions in chips. These scammers get your password and then take all your chips and then sell them to people desperate to play.

It's pretty disgusting.

@Brian Temke: Better hope it doesn't read cookies off your computer when you do that.

[h1.ripway.com]

I already changed the first guy's facebook and e-mail password (he used the same for both) and sent it to his secondary e-mail. He has a security question set up too so he can reset his password.

@easy2panic: that is:
[h1.ripway.com]

@SittingOnTheColbert_GitEmSteveDave: i recall reading a news story about someone whose facebook got hacked and the hacker asked all his facebook friends for financial help, said he was stranded on vacation, and had money wired to a different location. so a couple of days later all his friends were asking him 'are you ok? what happened' and they were out thousands of bucks

[www.techcrunch.com]

@CaptainKidd: What's funny is on the fake hosting site, if you click on any of the links on the bottom right or the facebook logo in the upper left corner, it takes you to the real facebook website.

@easy2panic: The logging page is actually named "phishing.php" ... well, at least they're honest.

@The Marionette: That is what I do too. For me, the email is just notification that I have something new on my page.

@easy2panic: Looks like people are having fun with this:

"charset_test=€,´,€,´,æ°´,Ð",Ð"
locale=en_US
email=you're
pass=an asshole
pass_placeholder=Password

charset_test=€,´,€,´,æ°´,Ð",Ð"
locale=en_US
email=nice
pass=try
pass_placeholder=Password

charset_test=€,´,€,´,æ°´,Ð",Ð"
locale=en_US
email=spam
pass=spam
pass_placeholder=Password

charset_test=€,´,€,´,æ°´,Ð",Ð"
locale=en_US
email=cheater
pass=asswipe
pass_placeholder=Password
"

If you just hit the login button without entering any info, it actually records the default values in his so cleverly named "passwords.txt" file.

I wonder how big I can make that file by just hitting that button over and over until my lunch hour is over

@Jean-Baptiste Emmanuel TinyBug: I wonder how well it's protected from injections.
Must ... resist ... at work ...

@CaptainKidd: Yah, I could have more fun if I weren't at work - I gave up after a minute or so

@kd420: I think the "You've been tagged in a photo" phishing method blind-sides a lot of otherwise Web-savvy Facebookers. ("OMG! I gotta see this photo of myself, whatever the cost!")

For more on Facebook phishing scams and how to avoid/report them, check out the Facebook Phishing Scam Awareness group: [www.facebook.com] (Notice the link is a legitimate Facebook URL.)

@YoSoyHe-Man!!_GitEmSteveDave:

They can update your interests saying you're a card-carrying member of NAMBLA. I guarantee you that if you're looking for a job your prospects will instantly dry up as well as any female attention you were formerly getting.

Good job guys, it looks like we broke it!

"This user account has exceeded their daily bandwidth limit."

@catastrophegirl: Wow. Just wow. Luckily all my "friends" on my facebook know they can #1 check on me w/my webcams, and #2, wouldn't lend/send any money if I was in trouble, they'd send it to the people I'm in trouble w/to keep me.

@Citizen Kang: I have for a number of years operated under two identities online. Luckily, until I'm employed, there almost NO chance an employer will find this identities facebook page.

@SittingOnTheColbert_GitEmSteveDave:

Kayser Soze!?!?!!

One thing about facebook passwords... are they exposed? My understanding was that they were ****'d out?

@madanthony:
Hey Thanks for the Idea!
On a more serious note, what would consumerist say is a good age for a facebook account?

@Brian Temke: I usually fill in the names, street names, etc. with derogatory comments about the phisher's mother.

I've been getting two or three of these a week for a couple months now. Some even share the name of my friends. I opened one once since the email heading shares Facebooks, read the address and deleted them. I've been ignoring/emptying my inbox whenever I see a Facebook email myself.

@dreamsneverend: Well, technically, it's only spam if one doesn't want friends' goat porn.
And who doesn't feel a jolt of excitement when viewing unsolicited, faun-haunched, satyr-rutting action in all its nakkid group-gymnastics glory?

Are you with me? Guys? ...Guys?!

@Citizen Kang: I guess, "But honey, that's fake: I am a card-carrying member of NAMGLA!" wouldn't help matters much.