4 ms·
(OP here) While you are absolutely right, I want to highlight that this was done in a quite sophisticated way. It's actually the real login page of Facebook in
by NiekvdMaas 6y ago
(OP here)
While you are absolutely right, I want to highlight that this was done in a quite sophisticated way. It's actually the real login page of Facebook in a webview. I have 2FA on all my accounts including FB, so it looked very legit. Once you have logged in, they seem to grep the token and close the webview.
- GoblinSlayer 6y agoYou mean they extracted your primary full access token, not the generated restricted oauth token?
- NiekvdMaas 6y agoYes, pretty sure. It wasn't an oauth screen but the actual FB login screen.
- londons_explore 6y agoIf your app has a webview in it, on both iOS and Android, you have full access to run script inside that webview and take/set cookies for any domain. You can easily take the auth cookie. Some Google auth cookies can only be used on the same tls session that created them[1]. That means the TLS session resumption information (which can be tied to hardware platform features like the TPM) is required to make use of a stolen auth cookie. Unfortunately while that approach has big security benefits, it's pretty anti-user-privacy. [1]: https://nakedsecurity.sophos.com/2018/10/25/could-tls-session-resumption-be-another-super-cookie/ https://nakedsecurity.sophos.com/2018/10/25/could-tls-sessio...