4 ms·
Security flaws in Facebook's Instant Personalization program
- greenlblue 16y agoFacebook believes in its own view of the world a bit too much. Somebody should tell those guys to get a sense of humor and stop making the world so "open".
- rblion 16y agoIf they did, zuckerborg's dystopian vision of the future would crumble... http://youropenbook.org/?q=cell+number&gender=female http://youropenbook.org/?q=cell+number&gender=female
- tptacek 16y agoThe meat of his point is simple, and pretty hard to avoid: when Facebook allows Yelp to render content trusted and secured by Facebook, Yelp assumes the same obligations to get web appsec right that Facebook does. An XSS in personalized Yelp is now, to some extent, an XSS in Facebook. This is a concept called "transitive trust" and it is as old as the hills.
- Enlightenment 16y agoOMG...Facebook isn't secure <grin>
- vinhboy 16y agoHad my first run in with instant personalization on rotten tomatoes today. It was really trippy to see myself get automatically ID by RT. Why is this necessary? I have never worried about facebook privacy, but this just crossed the line. I am going to turn it off, and see what happens.
- iuguy 16y agoAs tptacek says, this is a transitive trust issue. The problem is that Facebook doesn't seem to care about the security of your data (facebook considers your data to belong to them) and is unlikely to enforce security requirements on sites it partners with. If they ever open this up for general use, I hope sites like http://youropenbook.org/ http://youropenbook.org/ sign up. I can certainly see this being abused on a massive scale.