3 ms·
You mean they extracted your primary full access token, not the generated restricted oauth token?
by GoblinSlayer 6y ago
You mean they extracted your primary full access token, not the generated restricted oauth token?
- NiekvdMaas 6y agoYes, pretty sure. It wasn't an oauth screen but the actual FB login screen.
- londons_explore 6y agoIf your app has a webview in it, on both iOS and Android, you have full access to run script inside that webview and take/set cookies for any domain. You can easily take the auth cookie. Some Google auth cookies can only be used on the same tls session that created them[1]. That means the TLS session resumption information (which can be tied to hardware platform features like the TPM) is required to make use of a stolen auth cookie. Unfortunately while that approach has big security benefits, it's pretty anti-user-privacy. [1]: https://nakedsecurity.sophos.com/2018/10/25/could-tls-session-resumption-be-another-super-cookie/ https://nakedsecurity.sophos.com/2018/10/25/could-tls-sessio...