5 ms·

Because years of anti-phishing training has taught us that typing their FB password in the wrong place gives out complete control of our FB account. So the onl

Because years of anti-phishing training has taught us that typing their FB password in the wrong place gives out complete control of our FB account. So the only safe thing is abstinence. Don't type your FB password anywhere but when logging in directly to https://facebook.com https://facebook.com As you say, the whole point of OAuth is that you can safely use your FB account to log in to this other site. But -- to take this metaphor even further -- each time I encounter one of those things I always feel like a teenager being pressured into sex and being told "don't worry, this is safe, I promise, I love you." And I simply just don't know. I'm confident I could recognize that www.facebook.com.scottba.io isn't Facebook, and I could probably train my parents on how to recognize that. But there has been extremely little user education on just what a "safe OAuth" site looks like. It's now putting an asterisk on all the old rules.

jrochkind1 12y ago
Theoretically, if you are using OAuth facebook login, then on the page you are prompted for a Facebook login, you should be seeing facebook.com in your browser location bar, with the trusted https "green bar". But I realize this kind of anti-phishing checking is beyond most users, and "Just don't enter your facebook password anywhere but when you are logging into facebook" probably IS a good heuristic for them. I also don't know if some facebook oauth login paths use some kind of fancy ajax window-in-a-window so you _don't_ actually see facebook.com in your address bar -- which would make it pretty impossible for users to know if they're being phished or not.
- scrollaway 12y ago
  > I also don't know if some facebook oauth login paths use some kind of fancy ajax window-in-a-window so you _don't_ actually see facebook.com in your address bar This can never happen, because of the situation you highlighted. Most browsers do not let you do that anymore.
  - danielweber 12y ago
    The site could be faking the chrome so it looks like a separate pop-up, when it's actually just a div. Most of us would smell something wrong because it wouldn't be quite right but you could get reasonably close for non-developers. I went looking for sites using facebook logins and found this one just as the first unlucky example: http://www.nydailynews.com/login http://www.nydailynews.com/login Once you know the browser and OS, it wouldn't be too hard to get something mostly like that pop-up into a div.
- deleted 12y ago
  [deleted]
netcan 12y ago
It's not just anti-phishing, IMO. Even if they realize there is a consensual relationship going on between newsite.com & facebook, people don't know what's going on. Does this give newsite.com the ability to see my friends? Spam them? Does this give facebook access to my newsite.com stuff? Is 'sign in with google" like that time linkedin had access my gmail and spammed everyone? I think that's a grayer area than phising and something more people have actually been bitten by.
- HelloNurse 12y ago
  Not very often, let's say 20% of the time, I decide that the signing in some site to comment on a blog or create a quasi-account using Facebook is unlikely to be a privacy problem: I'm willing to give site X my main email address, even to receive newsletters and commercial offers. At this point, Facebook asks me to share my friends list (often much more) with site X: the only rational response is scrambling for the "close tab" button in the browser and writing off site X as untrustworthy jerks, because they dared to ask for unneeded personal information.

jrochkind1 12y ago

Theoretically, if you are using OAuth facebook login, then on the page you are prompted for a Facebook login, you should be seeing facebook.com in your browser location bar, with the trusted https "green bar". But I realize this kind of anti-phishing checking is beyond most users, and "Just don't enter your facebook password anywhere but when you are logging into facebook" probably IS a good heuristic for them. I also don't know if some facebook oauth login paths use some kind of fancy ajax window-in-a-window so you _don't_ actually see facebook.com in your address bar -- which would make it pretty impossible for users to know if they're being phished or not.

scrollaway 12y ago
> I also don't know if some facebook oauth login paths use some kind of fancy ajax window-in-a-window so you _don't_ actually see facebook.com in your address bar This can never happen, because of the situation you highlighted. Most browsers do not let you do that anymore.
- danielweber 12y ago
  The site could be faking the chrome so it looks like a separate pop-up, when it's actually just a div. Most of us would smell something wrong because it wouldn't be quite right but you could get reasonably close for non-developers. I went looking for sites using facebook logins and found this one just as the first unlucky example: http://www.nydailynews.com/login http://www.nydailynews.com/login Once you know the browser and OS, it wouldn't be too hard to get something mostly like that pop-up into a div.
deleted 12y ago
[deleted]

netcan 12y ago

It's not just anti-phishing, IMO. Even if they realize there is a consensual relationship going on between newsite.com & facebook, people don't know what's going on. Does this give newsite.com the ability to see my friends? Spam them? Does this give facebook access to my newsite.com stuff? Is 'sign in with google" like that time linkedin had access my gmail and spammed everyone? I think that's a grayer area than phising and something more people have actually been bitten by.

HelloNurse 12y ago
Not very often, let's say 20% of the time, I decide that the signing in some site to comment on a blog or create a quasi-account using Facebook is unlikely to be a privacy problem: I'm willing to give site X my main email address, even to receive newsletters and commercial offers. At this point, Facebook asks me to share my friends list (often much more) with site X: the only rational response is scrambling for the "close tab" button in the browser and writing off site X as untrustworthy jerks, because they dared to ask for unneeded personal information.