6 ms·

Damn, the amount of user trust they just burned by closing that with "as designed, won't fix" is staggering.

jschmitz28 8y ago
Yeah, I read through the post and (assuming I'm parsing it right) can't figure out why this hasn't caused a massive shitstorm already. Are they actually arguing that it's not a security bug because it's necessary for them to implement a 'one click sign in through Google' feature?
- mirimir 8y ago
  Basically, yes.
  - harpiaharpyja 8y ago
    That's insane.
- varenc 8y ago
  Likejacking Facebook likes has been around for 8+ years, leaks a similar amount of information, and there’s no big shitstorm. Not sure what the big difference between YOLO and FB’s like button are?
  - bobross 8y ago
    To me Likejacking is more like harvesting organic likes. And YOLO leaks email address which is PII.
  - jschmitz28 8y ago
    I was wondering whether this is actually the same as like jacking. Is the ‘leak’ in that case the ability for the Facebook page/post owner to be able to then look you up in the list of ‘likes’? If so, I think Facebook privacy settings may allow users to not leak their emails or pictures in this case. Also, I think it’s more widespread given that ‘Google identity’ covers a large number of Google products, and signing into one signs into all. With Facebook any time I log in nowadays I open incognito, check messages, log out, whereas with Google I generally stay logged in, mostly because I want gmail and my cross device browsing history to work.
  - qaq 8y ago
    Do you get user's email from FB’s like button? (edit typo)
laurent123456 8y ago
Yet they silently blocked his website from using this API thus acknowledging it's actually an issue.
- mirimir 8y ago
  Well, that did protect users from his site, at least :)
- eganist 8y ago
  Sounds like a fix. By the terms of the VRP it sounds like the reporter is owed a payout.
  - kerng 8y ago
    Bounty deserved, yes. Fixed? No, they only blocked his address, anyone else can still grab your info on their sites.
    - lallysingh 8y ago
      Looks like it's blocked for everyone now
      - Buge 8y ago
        It's blocked for people who aren't on the whitelist.
        kerng 8y ago
        That is interesting, do you have more info? I'd imagine the whitelist being quite enormous!
        Buge 8y ago
        I don't have any information besides what I've seen posted the comments here. For example this: https://twitter.com/sirdarckcat/status/994867632355577862 https://twitter.com/sirdarckcat/status/994867632355577862
ComodoHacker 8y ago
They're burning developers and potential employees trust in the first place. This "we don't know how to fix it ==> not a bug" attitude is what's staggering.
- harpiaharpyja 8y ago
  To me it shows a gross indifference to being dishonest even when speaking in an official capacity. I want to say that I hope this is isolated and not a systemic part of their company culture but at this point I can't help but be cynical after this.
jacquesm 8y ago
This keeps happening over and over again. I remarked the other day that the most feared words when reporting a serious bug are 'won't fix'. It is super annoying. If the feature can't be made to work safely then drop the feature.

Yeah, I read through the post and (assuming I'm parsing it right) can't figure out why this hasn't caused a massive shitstorm already. Are they actually arguing that it's not a security bug because it's necessary for them to implement a 'one click sign in through Google' feature?

mirimir 8y ago
Basically, yes.
- harpiaharpyja 8y ago
  That's insane.
varenc 8y ago
Likejacking Facebook likes has been around for 8+ years, leaks a similar amount of information, and there’s no big shitstorm. Not sure what the big difference between YOLO and FB’s like button are?
- bobross 8y ago
  To me Likejacking is more like harvesting organic likes. And YOLO leaks email address which is PII.
- jschmitz28 8y ago
  I was wondering whether this is actually the same as like jacking. Is the ‘leak’ in that case the ability for the Facebook page/post owner to be able to then look you up in the list of ‘likes’? If so, I think Facebook privacy settings may allow users to not leak their emails or pictures in this case. Also, I think it’s more widespread given that ‘Google identity’ covers a large number of Google products, and signing into one signs into all. With Facebook any time I log in nowadays I open incognito, check messages, log out, whereas with Google I generally stay logged in, mostly because I want gmail and my cross device browsing history to work.
- qaq 8y ago
  Do you get user's email from FB’s like button? (edit typo)

laurent123456 8y ago

Yet they silently blocked his website from using this API thus acknowledging it's actually an issue.

mirimir 8y ago
Well, that did protect users from his site, at least :)
eganist 8y ago
Sounds like a fix. By the terms of the VRP it sounds like the reporter is owed a payout.
- kerng 8y ago
  Bounty deserved, yes. Fixed? No, they only blocked his address, anyone else can still grab your info on their sites.
  - lallysingh 8y ago
    Looks like it's blocked for everyone now
    - Buge 8y ago
      It's blocked for people who aren't on the whitelist.
      - kerng 8y ago
        That is interesting, do you have more info? I'd imagine the whitelist being quite enormous!
        Buge 8y ago
        I don't have any information besides what I've seen posted the comments here. For example this: https://twitter.com/sirdarckcat/status/994867632355577862 https://twitter.com/sirdarckcat/status/994867632355577862

ComodoHacker 8y ago

They're burning developers and potential employees trust in the first place. This "we don't know how to fix it ==> not a bug" attitude is what's staggering.

harpiaharpyja 8y ago
To me it shows a gross indifference to being dishonest even when speaking in an official capacity. I want to say that I hope this is isolated and not a systemic part of their company culture but at this point I can't help but be cynical after this.

jacquesm 8y ago

This keeps happening over and over again. I remarked the other day that the most feared words when reporting a serious bug are 'won't fix'. It is super annoying. If the feature can't be made to work safely then drop the feature.