Facebook bans KDE application, deletes user photos • Hacker News Board

Re: Facebook bans KDE application, deletes user photos

#41

Post by ignifero » Tue, Jun 28, 2011, 2:35 PM UTC

saurik wrote: post #5

From the error, it actually sounds like the application had an API key distributed inside of it... which means that anyone, anywhere, could pretend to be the application.. and could use its credentials to upload anything they want. Yeah, right here: fbtalker.cpp: m_apiKey = "bf430ad869b88aba5c0c17ea6707022b"; fbtalker.cpp: m_secretKey = "0434307e70dd12c414cc6d0928f132d8"; To be honest, as much as I hate Facebook's de…

It's also against facebook's developer policies to share the secret key.

  You must not give your secret key to another party, unless  that party is an agent acting on your behalf as an operator of your application. You are responsible for all activities that occur under your account identifiers.

Re: Facebook bans KDE application, deletes user photos

#42

Post by nl » Tue, Jun 28, 2011, 3:51 PM UTC

fleitz wrote: post #16

teej wrote: post #9

Earlier quoted context omitted.

They have a special desktop API that solves this exact issue. EDIT: they used to, at least. They now want devs to use the web OAuth flow by adding an embedded web view to your desktop app. http://developers.facebook.com/docs/authentication/

How does using the OAuth flow on a desktop app solve any of these issues? If you have the app binary, you have the secret key. It's simply a matter of attaching a debugger and waiting for the URL handler to be called. Even the trick auth flow on iphone where it opens the Facebook app has the same vulnerability.

If you have the app binary, you have the secret key.

No, you have the access token. There's a big difference.

It's simply a matter of attaching a debugger and waiting for the URL handler to be called. Even the trick auth flow on iphone where it opens the Facebook app has the same vulnerability.

Yep, you can do that. But then all you know how to authorize the app to act on your (the logged on user) behalf. You can write another application that pretends to be that app, but since it acts on your behalf I'm not sure that's a big risk.

In the case of this KDE program, not only do you know how to make the app act on your behalf - but (as the OP noted) - it is probably possible to make the application act on behalf of any other user that has authorized this application id. That's a pretty bad problem.

It sucks for the legitimate users who uploaded the pics using it, but who knows what else got uploaded to other people's accounts using this program? I suspect that's the reason why Facebook didn't just bad the app, but had to delete pics as well.

Re: Facebook bans KDE application, deletes user photos

#43

Post by nl » Tue, Jun 28, 2011, 3:54 PM UTC

wladimir wrote: post #2

Banning the application could be justifiable (don't know the details), but removing everyones user photos just because they were uploaded with a certain tool, wow, that's messed up. I simply don't have words for it.

It's likely that the tool (or - more precisely - the app id & secret) let people upload pictures into other people's accounts. Facebook couldn't let that stand.

Re: Facebook bans KDE application, deletes user photos

#44

Post by barumrho » Tue, Jun 28, 2011, 3:58 PM UTC

saurik wrote: post #35

barumrho wrote: post #34

Earlier quoted context omitted.

Only if you setup a server and create your own API to talk to Facebook's API. As far as I know, a lot of iPhone apps are shipped with App key and secret key. (For example, an open source project for sharing requires you to put your app's secret key: http://getsharekit.com/ )

I seriously don't understand why people keep saying "everyone does it", as if that makes it secure or even allowed by Facebook. Facebook's documentation clearly states you should not do that, one developer here even said it was against Facebook's terms of service, and Facebook's documented mechanisms for allowing desktop applications to access their service does not involve doing so. Regardless, if you read the docum…

After taking a look into Facebook's API, I concluded that you are right, although some details are missing.

With the process you described, it would be really easy for apps to simply use another app's id. So, it seems that Facebook has implemented additional measures to prevent this. (e.g. using bundle ID and iTunes app store ID for iPhone apps)

Also, Facebook published iOS SDK that required secret key, but has since updated it to remove that requirement.

Re: Facebook bans KDE application, deletes user photos

#45

Post by r00fus » Tue, Jun 28, 2011, 4:24 PM UTC

nl wrote: post #43

wladimir wrote: post #2

Banning the application could be justifiable (don't know the details), but removing everyones user photos just because they were uploaded with a certain tool, wow, that's messed up. I simply don't have words for it.

It's likely that the tool (or - more precisely - the app id & secret) let people upload pictures into other people's accounts. Facebook couldn't let that stand.

Just deleting photos without a proper explanation of why you did so leaves a very bad taste in the mouth.

I can see why people would be bitter... FB just deleted their photos because their upload method was "wrong".

If they said there was no possible way to examine the situation, or that they would restore your photos if you waded through an indemnification click-through, then OK, I can understand.

But just deleting the photos with no warning or even notification?