4 ms·
So here is a question: my girlfriend only uses FB on her laptop, and always logs out when she's done. I usually make fun of her for doing this. But does this
by IvyMike 8y ago
So here is a question: my girlfriend only uses FB on her laptop, and always logs out when she's done. I usually make fun of her for doing this.
But does this mean most of the time that there was no active access token and she is mostly safe? (Excluding the windows of time where she was actively using FB) Do I have to take back all of my teasing?
- modeless 8y agoI doubt it. The "View As" feature does not require the target to be currently logged in to Facebook AFAIK.
- IvyMike 8y agoThis is an interesting point. Right now, I can't reconcile the "we canceled active sessions thus logging people out" as a fix with the fact that "View As" was the attack vector.
- rstupek 8y agoIt's likely the fix required the kill active sessions which cause new keys to be generated on sign in
- leddt 8y agoI'm guessing they invalidated all access tokens for accounts that have been used as "View As" targets since the issue was introduced. They also disabled "View As" which is the actual fix for the time being.
- kidsnow 8y agoOnly if the act of logging out explicitly invalidates the token on the server side
- dylan604 8y agoThis is something I would suspect doesn't actually happen. FB wants to track all of the user's browsing habits, so maybe they just make the actual FB UI look logged out? Security-wise, it would seem to be more complicated by their desire to never let a user be logged out, and looks like it's complicated enough it is biting them in the backside. Oops?!
- dasil003 8y agoIt’s not really that complicated, you have auth tokens and you have tracking tokens, and you wouldn’t want to mix them anyway because you also want to be able to correlate multiple accounts logged in from the same browser over time.
- dlubarov 8y agoPossibly -- if the attacker accessed session IDs, they could potentially hijack the sessions of logged-in users. If you log out, most servers will destroy the session data on their backend, so there's no session that can be hijacked.
- olkid 8y agoLogging out when finished with an online service is good practice. You should do it too. (and don't make fun of her) :-)
- pks016 8y agoMe too. I always log in in incognito mode,check messages and notifications and log out.