3 ms·
I don't think I understand the first one. The flaw is that you can force someone to login to Facebook as someone they're not? It looks like you're saying that
by SnacksOnAPlane 13y ago
I don't think I understand the first one. The flaw is that you can force someone to login to Facebook as someone they're not? It looks like you're saying that you can pass a custom username and password to the FB connect button and it'll log in as that user.
- homakov 13y agoNot to the button but to create a dummy form. Simple csrf. Relogin leads to identity fixation
- porges 13y agoIt's the other way around. You force someone to log onto another site as your Facebook account, so you can then access all their content on the other site. The security being breached is on the other site, not Facebook (perhaps why they are less concerned about it).
- homakov 13y agoYeah, it's breached on the website but it's fb who's in charge.