4 ms·

All your Facebook Access Tokens are belong to us

24 points by mikeevans 13y ago

patmcguire 13y ago
Can anyone get to the article?
- mikeevans 13y ago
  Overview which links to the original post can be found here: http://threatpost.com/facebook-android-flaws-enable-any-app-to-get-users-access-tokens/102724 http://threatpost.com/facebook-android-flaws-enable-any-app-...
- hfreire 13y ago
  Nope.
- thefreeman 13y ago
  worked for me. tldr: Facebook apps were leaking the access token via the android log cat which is accessible from any app installed on your device.
  - CaveTech 13y ago
    AFAIK this has been a problem for well over 2 years now.
  - JosephRedfern 13y ago
    AFAIK since Android 4.1 the READ_LOGS permission (needed for an app to be able to access logcat output) can no longer be granted to a 3rd party application... of course, there are going to be lots of devices out there running Android < 4.1.
- jt2190 13y ago
  Is this it? http://webcache.googleusercontent.com/search?q=cache:F0k-GBbxbrgJ:attack-secure.com/2013/10/all-your-facebook-access-tokens-are-belong-to-us/+&cd=1&hl=en&ct=clnk&gl=us http://webcache.googleusercontent.com/search?q=cache:F0k-GBb...
zaidf 13y ago
We condemn anyone that stores passwords as plaintext. Time to treat access tokens as nothing less than a password.
- davidkuridza 13y ago
  How would you store access tokens on a device, using two-way encryption or do you have something else in mind?
  - zaidf 13y ago
    Two way encryption, yep.
    - colinhowe 13y ago
      but then for any reasonable application to be able to use them they'll need to store the unencryption key anyway..
      - tedunangst 13y ago
        Obviously you wouldn't store the encryption key in plaintext...
        paulgb 13y ago
        It's encrypted keys all the way down.
        Zancarius 13y ago
        That's easy! We could use two-way encryption to encrypt the encryption key.
      - snarfy 13y ago
        What's wrong with 'correct horse battery staple'?
thehme 13y ago
Can't read blog post: Error 520 Ray ID: c513da5e9750697 Web server is returning an unknown error https://support.cloudflare.com/hc/en-us/articles/200171936-Error-520 https://support.cloudflare.com/hc/en-us/articles/200171936-E... humm...
- mohaab 13y ago
  fixed now.

24 points by mikeevans 13y ago

patmcguire 13y ago

Can anyone get to the article?

mikeevans 13y ago
Overview which links to the original post can be found here: http://threatpost.com/facebook-android-flaws-enable-any-app-to-get-users-access-tokens/102724 http://threatpost.com/facebook-android-flaws-enable-any-app-...
hfreire 13y ago
Nope.
thefreeman 13y ago
worked for me. tldr: Facebook apps were leaking the access token via the android log cat which is accessible from any app installed on your device.
- CaveTech 13y ago
  AFAIK this has been a problem for well over 2 years now.
- JosephRedfern 13y ago
  AFAIK since Android 4.1 the READ_LOGS permission (needed for an app to be able to access logcat output) can no longer be granted to a 3rd party application... of course, there are going to be lots of devices out there running Android < 4.1.
jt2190 13y ago
Is this it? http://webcache.googleusercontent.com/search?q=cache:F0k-GBbxbrgJ:attack-secure.com/2013/10/all-your-facebook-access-tokens-are-belong-to-us/+&cd=1&hl=en&ct=clnk&gl=us http://webcache.googleusercontent.com/search?q=cache:F0k-GBb...

zaidf 13y ago

We condemn anyone that stores passwords as plaintext. Time to treat access tokens as nothing less than a password.

davidkuridza 13y ago
How would you store access tokens on a device, using two-way encryption or do you have something else in mind?
- zaidf 13y ago
  Two way encryption, yep.
  - colinhowe 13y ago
    but then for any reasonable application to be able to use them they'll need to store the unencryption key anyway..
    - tedunangst 13y ago
      Obviously you wouldn't store the encryption key in plaintext...
      - paulgb 13y ago
        It's encrypted keys all the way down.
      - Zancarius 13y ago
        That's easy! We could use two-way encryption to encrypt the encryption key.
    - snarfy 13y ago
      What's wrong with 'correct horse battery staple'?

thehme 13y ago

Can't read blog post: Error 520 Ray ID: c513da5e9750697 Web server is returning an unknown error https://support.cloudflare.com/hc/en-us/articles/200171936-Error-520 https://support.cloudflare.com/hc/en-us/articles/200171936-E... humm...

mohaab 13y ago
fixed now.