5 ms·

This isn't really hacking Facebook... they're hacking the Moods app, which is made by HotOrNot.

• deleted 19y ago
  [deleted]
• BrandonM 19y ago
  Right, but many applications have access to information in your profile (at least, that's what it says every time you add an application). Couldn't such vulnerabilities feasibly lead to more serious problems in Facebook itself?
  • brianr 19y ago
    You're right, it might be possible to get an insecure application to give you API-accessible information about some other user (e.g., the application contains a page that spits out your entire profile on the screen, and you pass in your target's userid). That information is guarded by a user-specific session key, so the app would have to store each user's session key on the server (or have already cached the response) for it to work. A really insecure application could probably be coerced into making other API calls as well, like sending notifications or uploading photos. I guess in that case Facebook might want to look in to providing some vulnerability testing tools to developers, or maybe running tests for them to find vulnerabilities. It's definitely a hard problem.