Facebook detects if you are logged in Gmail
webapps.stackexchange.com
Facebook detects if you are logged in Gmail
1–10 of 98 posts
Re: Facebook detects if you are logged in Gmail
#2That's pretty neat, I wish they'd publish on how they did this so others could use it. Sounds like another great way to remove friction for the user, always a great thing.
Re: Facebook detects if you are logged in Gmail
#3I think they should have used that information differently. Given they know that you are already logged into your gmail, any visitor to your machine will therefore know how to reset the password to his advantage.
Instead, they should have make a block, so that you are forced to logout of your gmail and login to your gmail to enhance security.
Re: Facebook detects if you are logged in Gmail
#4When I tried the same thing, it popped up a OpenID dialog the first time, and I confirmed it by seeing facebook.com on https://accounts.google.com/b/0/IssuedAuthSubTokens Revoking the facebook token causes Facebook to prompt again.
Subsequent attempts make the auth dialog flash briefly without displaying any content and still present the "You can change your password immediately because you are logged into your email account on this browser" message.
Re: Facebook detects if you are logged in Gmail
#5That's pretty neat, I wish they'd publish on how they did this so others could use it. Sounds like another great way to remove friction for the user, always a great thing.
[deleted]
Re: Facebook detects if you are logged in Gmail
#6It's not very hard to do. The trick is to know a resource that only the user can access and then trigger an HTTP request to it.
For instance if you have website a and say the user profile "mitsuhiko" can only be edited when you are logged in as "mitsuhiko" on http://a.example.com/profile/edit/mitsuhiko you could use this code to see if the logged in user is "mitsuhiko":
So if you know what you are probing for: easy.
// Edit: Yes, this is most likely not what Facebook is doing if that's their only method of security. However see my reply to the first comment here about the security aspect for a possible way to solve this problem.
Re: Facebook detects if you are logged in Gmail
#7[deleted]
Re: Facebook detects if you are logged in Gmail
#8That's pretty neat, I wish they'd publish on how they did this so others could use it. Sounds like another great way to remove friction for the user, always a great thing.
[deleted]
Re: Facebook detects if you are logged in Gmail
#9It's not very hard to do. The trick is to know a resource that only the user can access and then trigger an HTTP request to it. For instance if you have website a and say the user profile "mitsuhiko" can only be edited when you are logged in as "mitsuhiko" on http://a.example.com/profile/edit/mitsuhiko you could use this code to see if the logged in user is "mitsuhiko": Why does this work? Because onload is fired if…
Except something like this would be easily spoofable, ie. you could set your hosts file to make all a.example.com links return HTTP 200's, or open firebug to call user_is_logged_in() and you could reset passwords without any email.
Also, for something like that you should use instead so it's less of an XSS risk.
Re: Facebook detects if you are logged in Gmail
#10It's not very hard to do. The trick is to know a resource that only the user can access and then trigger an HTTP request to it. For instance if you have website a and say the user profile "mitsuhiko" can only be edited when you are logged in as "mitsuhiko" on http://a.example.com/profile/edit/mitsuhiko you could use this code to see if the logged in user is "mitsuhiko": Why does this work? Because onload is fired if…
You should post that as an answer to the question.