Two-factor no longer works? #445
Comments
jaymzh
changed the title
|
Oh - so it looks like you can make it work, if, before you put in the 2fac code, you go to the site, then click the "did you log in", click yes, then click "save browser", THEN go back to pidgin and put in the code it works, at least for normal fb. |
|
OH! And it works for Workplace too [but the alert comes up on non-workplace]. I'll leave this open for others to find and I'll comment on the workplace thread. |
|
Aaaand, no that stopped working. :( |
jaymzh
changed the title
|
@dequis - as of now there's no Facebook or Workplace if you use 2fac (which ... I hope most people do). Pretty please for christmas all I want is a chat client? :) :) |
|
Can't repro :/ |
|
I should have sent you a debug log, I suck. Doing so now. |
|
So I sent you pidgin debug logs, but just for fun I also tried bitlbee: |
|
I looked around, seems that there's a new auth path like this:
I drafted an implementation of this with a python script, but the server doesn't like something about it, says |
|
FWIW my dirty request signing script (python2) import cgi
from urllib import urlencode
import hashlib
FB_API_KEY = '256002347743983'
FB_API_SECRET = '374e60f8b9bb6b8cbb30f78030438895'
def fb_sig(data):
params = ''.join(['%s=%s' % x for x in sorted(data.items())])
data['sig'] = hashlib.md5(params + FB_API_SECRET).hexdigest()
return data
data = {}
data['api_key'] = FB_API_KEY
data['format'] = 'json'
data['method'] = 'auth.login'
data['email'] =... '...'
data['password'] = '...'
#data['credentials_type'] = 'two_factor'
#data['error_detail_type'] = 'button_with_disabled'
#data['first_factor'] = '...'
#data['twofactor_code'] = '...'
#data['password'] = data['twofactor_code']
print("curl 'https://b-api.facebook.com/method/auth.login' -v --data-binary '" + urlencode(fb_sig(data)) + "'")Replace the If you somehow manage to get it working, set the hidden setting |
|
OK, I'm trying to play with this, but what is |
|
The error message of the first login attempt has a |
|
Ah I see now, I missed that. So I tried that, and I tried both overriding |
|
BTW, for anyone else playing along at home, I modified the script slightly to make it a bit easier to use: You can run it once with no argument, and then the second time pass in the first_factor as arg1 and the SMS code as the second arg, like: |
|
Continuing to mess with this I made the script just do the requests for you and prompt you for the bits it needs: |
|
Hey @dequis what's the easiest way to see what the official apps do? I can try debugging, but since it's all SSL, I'm not sure the easiest way to see what's going on.. |
|
Yeah I just need to rebuild my MITM setup, see:
For values of "soon" of "one week" which is over now. I'll look into this and other things this weekend, because apparently someone broke other parts of fb, sync sequences are sometimes gone and receiving messages goes on a different queue. Also the TLS 1.3 thing because why not. FWIW I documented the stuff I did with earlier versions at https://wiki.dequis.org/notes/facebook/ - but it's been long enough that I bet the cert pinning methods changed again. |
|
OK cool, thanks. If I get time to set that stuff up, I'll poke at it, but I'm guessing you'll get to the bottom of this faster than I will. |
|
I didn't have a big enough block of time this weekend to try to setup the whole MITM setup unfortunately. Did you get a chance to look? |
|
Nope, I only had enough time to sort the other issues (and one of them was just because someone else came up with the fix which was just bumping a version in the user agent lol). On the bright side I am no longer technically-homeless! |
|
Having a place to live is definitely more important than fixing my bugs! I'm glad you have a place to live :) |
|
Thought I'd follow up here and see if you had made any progress. As always, happy to donate to you (or your favorite charity) to help the cause. |
|
Hi! Sorry, nothing. My next two weekends are already fully booked and evenings ceased to exist. Also thanks for the offer (i genuinely appreciate it) but it wouldn't really buy me more time. |
|
I just tried again (in case they reverted whatever thing they were rolling out), and neither normal Facebook nor workplace work with 2fac, so I (and probably others) still have no ability to use purple-facebook at all. |
|
This did not work for me when I filed the Issue, but it does work now! It even works on Workplace! |
|
nice. works for me now, too. previously app passwords did not work. |
Hi. Have you solved this problem yet? please help me |
Ooops, fixed. Thanks! |
|
I put some work into the script to make it a bit easier for people not familiar with python or dicts or other stuff. It will spit out errors in some common cases instead of crashing. It's also now in py3. Here's a script, that when you run it, looks like this: You need to edit the script to add your email and a UUID (which you can get by running https://gist.github.com/jaymzh/3ed8817cf8c20222ca09ce33a544b695 |
|
Question about this process that I didn't see an obvious answer to: if one does:
you can see that there already exists some data that looks like it's trying to use in the script: or at the very least, is returned by the python script above:
(the only one not in the response is "cid") Should we be making sure to update those lines from the response into accounts.xml as well, or just TOKEN? Also, would it make sense, if it's available, to just use the 'did' from accounts.xml in the python script? just thinking out loud here... |
|
So, the short answer is: as long as the token is set, it doesn't seem to matter much. And to be clear, this script is just a short-term stop gap until @grimmy get is PR up that implements this natively, otherwise I'd be trying to make it parse-and-edit the accounts.xml, but I didn't care that much for something that I hope dies in a week or two. All that said, those are all good questions. I actually used mid as my device_id, but I'm not sure. I imagine, looking at the flow you're supposed to pass in a device_id, and then use the machine_id you get back when you auth, but I don't actually know |
|
Yeah, sorry I'm super busy the next few days and not sure when I'll be able to finish this, but I'm hoping I'll have it done next week. |
actually you must use 'did' (device_id) mentioned in the accounts.xml instead of an random uuid, this is how worked on me |
|
Tip: the |
|
This is how I logged in successfully (a more detailed version for those who are begginers with pidgin):
|
|
Suddenly unable to use 2fa again, using the script above. Don't have enough skills to burp this and figure out what's changed, only that it's not working anymore for me. |
|
@akhepcat it broke for me as well in the past 24h, but I have managed to get my bitlbee-facebook account back online by simply generating another token. |
|
On my side, I keep getting 401 invalid username or password even tho I'm pretty sure I did everything right ! |
|
@Azizb750 's instructions with the script worked perfectly for me. |
|
It's possible to extract the relevant IDs from bitlbee's This is a tremendous quality of life improvement. Thanks a lot! |
|
Ahhhh. Yes, the scripts are working just fine. I was being too quick, and dismissing the "Did you just attempt to sign in" pop-up, which of course stops the SMS code send. Oops. Ignoring that pop-up and waiting for the SMS made the flow work just fine. Can't believe i didn't try that sooner. |
|
Hi. I have tried several times to get this to work again. It was working before, but suddenly stopped working for some time ago. Tried to follow Azizb750's instructions, but still no luck. But I need to quit Pidgin before editing the accounts.xml file, if not it seems like the token gets overwritten by the blank/default one. When I start Pidgin after entering the token, I always get "An unknown error occurred (1)". Any idea? |
|
I've been banging my head against this one all night. Was about to give up until I got it to work. For reference, Im using Debian Stretch and Bitlbee via Bitlbee's debian repository. Got to the point where I rewrote the pidgin token generation script script for bitlbee (bitlbee-purple uses a different location for accounts.xml and apparently doesn't properly know how to write to it, it's a known bug). https://bugs.bitlbee.org/ticket/1327 I prefer the Glowing Bear frontend for weechat relay over Pidgin /w GTK2/3 or Finch /w tmux/screen. I had to do some system kludges because bitlbee encrypts passwords in its configuration and it doesn't let anyone beyond root and the bitlbee service user account touch the config. I'm able to handle the former by just prompting for the password using getpass.getpass instead of reading it from xml, but the latter has to be done from bitlbee and a shell. I also modified the xml to json conversion to account for the differences in the bitlbee configuration versus libpurple. Here's my procedure before running the script: In bitlbee The final save command will populate /var/lib/bitlbee/USERNAME.xml with the uid/gid/mid/cid. The UID will always be zero, but that's OK since it will update on the first JSON resquest/response and stay the same after that, along with the DID. The MID should change however during the process. Command Line as non-privileged user Run the script Initial Output The script dies before it can load the first request's response data. Some quick googling tells me I need to use decode('utf-8'), so I modified the two instances in the script from:
to After those changes, on the next attempt, we finally have something! We get prompted for the 2FA code (note: I wore out my welcome on SMS 2FA debugging, but as other people pointed out codes from your authenticator app work fine). After entering it we get another error, but we also get the Access Token! I ran the following in bitlbee afterward And it connects! Simply set your options and setup your control channel. To open the control channel on connect, you have to join the control channel, find it in the channel list, and set auto_join on the channel id to true. The final save command will automatically revert your changes to permissions on /var/lib/bitlbee and /var/lib/bitlbee/USERNAME.xml Looking at the behavior of the script and the JSON requests, I think what is happening is that on the first JSON request, the Facebook API is generating a new DID on its end using uuidgen or something similar and expects the same UUID for the next JSON request/response. I noticed when I finally connected and saved my bitlbee config that the DID stayed the same after the initial response and after bitlbee connected and the config was saved. You still get the KeyError, but you should still get the Access Token since it's in a try/execpt block and the UUID-format DID does not appear to change. I have uploaded my modified script for bitlbee users to a gist for reference: https://gist.github.com/Tatsujin/953551fe38d8e38aac43b423998d3deb I hope you find this useful. If you are using the pidgin script, you might want to try making the decode changes I suggested for the json_loads. Good luck! |
|
Thanks, @Tatsujin - i've upated my script to include the utf-8 parsing as well. https://raw.githubusercontent.com/akhepcat/Miscellaneous/master/pidgin-fb-login-2fa.py |
|
Thanks akhepcat for creating this script. I tried it, but got the following error: Traceback (most recent call last): |
Ah, try removing the ".decode('utf-8')" from that line. It worked here on my test, but maybe it's failing in some cases, and may not really be needed. |
|
Hi and thanks for the quick reply. Tried to remove the decode part, and then I get the token. But also the following error after entering the code: FB Account DID not present in error_data: equal to accounts.xml did Tried to add the token to accounts.xml manually, but still get the "An unknown error occurred (1)" when I tries to connect. This is probably not something wrong with the script, but something else. Tried to delete and set up the Facebook account again in Pidgin, but same issue. I get a security notice in Facebook when I try to connect, but I click "Yes, it was me" and "Save browser". But still no luck when try to connect. |
Try the latest version, that should all be fixed now. |
Hi |
|
That happens, I think, when it's trying to sync your history and it's too big. Go to edit account, advanced, uncheck "show unread messages". The connect, it should work. Once that's done, you can re-check that box and it should work. |
Hi. Thanks for the reply
|
|
I ported @jaymzh 's script to python3 and uploaded as a gist here: https://gist.github.com/kflu/1e7c358989b0556e99a919face1ca2f7 Changes:
USAGE: FBEMAIL=<YOUR_EMAIL> python3 fb_get_token.pyIf you have 2FA, it will ask for the 2FA code after you type in password.
|
|
BTW, I stopped using my script and used @akhepcat 's fork of my script, it's nicer in that it pulls the password automatically from the file and such. |
|
Up to date script to get token: https://github.com/kofany/get-fb-token/blob/main/fb-token.py |
I reported this in the Workplace bug, but it looks like this is now happening on non-workplace. Two-factor no longer works either in app-password mode, nor in login-approval-code mode.
If you use an app password, you just get permission denied (tried with both "username" and "email" as username).
If you use normal password, Pidgin will tell you about the approval code, you then put it in, and it tries to connect for a minute or so, and then eventually you get
invalid username or password (401).The text was updated successfully, but these errors were encountered: