MyToken

Not sure if all notice, but when accessing profiles, many times those that are not on your friends list a "MyToke=XXXXXXXXXXXXXXXXXXXXXXX" appears after the friend ID. This is used to see whether a person could access a profile or not. My belief is that this token is based off of your user ID in what seems to be a hexidecimal coding, that seems to have a bitrate shift, so as the same code cannot exist in second or longer.
If someone out there has the time, experience and up to the challenge to help crack the code, I would love help out.

DS

I just wanted to point out the similarity of md5 sums and this token. I built a tracker in php to log my friends hits on myspace for some reason I decided to lay cookies of random numbers that were md5'ed as unique id's. After studying the hits on my tracker I noticed that if I hyphenated the md5s they were the exact length with similar characteristics.

random md5:
c8e26959-c2b2-7e12-ba43-2a560c611f7e

myToken:
e2fecd29-6d05-4452-a761-8f8596cec3eb

If this is an md5 there is probably no way to decode it as it is a non-decipherable hash. The only way to decipher is to have the value md5 it and check if they match, kind of like a brute force of dictionary attack.

well I'm pretty new to this whole thing, but based upon how other sites work this is my hypothesis:

your myToken is randomly generated prior to attempting to access a page or area that requires certain priviliges to be granted to you. each token is unique, and quite possibly time-dependent, and may refer back to a myspace database to double check additional info like IP addresses and login cookies, before it grants the appropriate token holder access to something.

ie: Jane's profile is private, but Tom is on her friends list. Tom clicks on Jane's profile and a token unique to Tom is randomly generated and stored somewhere deep within myspace. Myspace then begins to take Tom to Jane's page, but uses his unique token as a method of verifying that the visitor to Jane's profile is indeed Tom.

If I didn't think the tokens were referenced to some database I would believe that there was some possibility of hi-jacking other people's tokens and using them to gain access to stuff your locked out of. But I'm pretty sure it's referenced, not to mention each token is completely random, and if one were to refresh their page and then click on a token-dependent link again I'd wager that the first token would be rendered invalid and a completely new one would be generated.

But that's just a noob's 2 cents. :p 

the mytoken is formated exactly the same as a guid or "Globally Unique Identifier"
look in your registry (windows) and you will see hundreds if not thousands

The are even so famous they get their own wiki page
http://en.wikipedia.org/wiki/Globally_Unique_Identifier

If perhaps you explored how these are generated you may come up with an algorithm to reverse engineer them but it would depend on what they used to seed the generator in the first place

On a pc they are usually seeded by the id of one of the network cards (if one exists) these id's are guid's themselves

If the generator is seeded by say a combination of the users id and the time you may find a hack, but I doubt it, I personaly dont have half a lifetime spare to come up with the answer, considering I have already wasted the first half of my lifetime.

more likely they are just random and stored in a database as a single use item. thus once used or a timeout occurs they are thrown away.

well thats how I'd do it anyway

virtually unhackable

Coshed

If you go here this might be of some help.

http://developers.sun.com/prodtech/appserver/reference/techart/keymgmt.html

man, i would so help as well. but these things are randomly generated with each new page, right? and there are other randomly generated things in the source code as well, eg closer to the bottom around the onlinenow code there's another, unrelated, refreshed-with-each-click 16~ character code. annnnnnnnnnnnnnnd if you're logged in, it knows who you are, and if you're not logged in, you can't view private profiles anyway.

i'd love to see the code for the user object.