4 ms·
Has anyone checked to see if any Facebook access tokens were saved unencrypted in the database? They mention that users who logged in with Facebook instead of u
by jtokoph 11y ago
Has anyone checked to see if any Facebook access tokens were saved unencrypted in the database? They mention that users who logged in with Facebook instead of username/password would be completely safe, but if access tokens were leaked, then many users could have their Facebook data mined.
- iLoch 11y agoAll they have to do is expire their secret key and all the access tokens will be invalidated.
- florianletsch 11y agoAre Facebook access tokens vulnerable to such an attack? If I remember correctly, at least Google tokens wouldn't be: The application receives a token from Google. With that token, a new session token is created. This session token expires and can only be renewed with the application token and the correct redirect URL. If Facebook uses a similar scheme, tokens would be useless without the running application renewing session tokens.
- methodover 11y agoNothing like that happens with Facebook, if I recall correctly. Once you have an access token you're good to go until it expires.