Forgive my ignorance here - but how did the fake email manage to have been signe...

noonat · on July 15, 2011

The article says that the scammer sent a _screenshot_ of the email (so the email was just photoshopped, and not actually signed by facebook.com).

Shenglong · on July 15, 2011

My fault - thanks for the clarification.

sankara · on July 15, 2011

Actually you don't even need photoshop. Firebug would do.

RyanKearney · on July 15, 2011

So will Chrome's built in developer tools. No bloated browser or third party tools required.

calloc · on July 15, 2011

If you have access to their new facebook mail stuff, is it sent from an @facebook.com email address?

ceejayoz · on July 16, 2011

Yes, which is another bit of evidence that this is a fake - Facebook employees use @fb.com as their e-mails.

edwardy20 · on July 15, 2011

It's actually quite easy to fake an email address because SMTP doesn't authenticate the sender. For example, I can send someone (exampleperson@example.com) an email that appears to be from 'admin@facebook.com' with one line of php code:

<?php mail('exampleperson@example.com', 'Example Subject', 'Example Message', 'From: admin@facebook.com' ); ?>

markelliot · on July 15, 2011

That explains spoofing of the originating address; to generate a signed email surely you would need a set of certificates.

edwardy20 · on July 15, 2011

Oops I missed that. noonat's solution seems more likely then.