All your Facebook Access Tokens are belong to us

thefreeman wrote: post #5

patmcguire wrote: post #2

Can anyone get to the article?

worked for me. tldr: Facebook apps were leaking the access token via the android log cat which is accessible from any app installed on your device.

AFAIK this has been a problem for well over 2 years now.

Re: All your Facebook Access Tokens are belong to us

#7

Post by zaidf » Tue, Oct 29, 2013, 4:17 PM UTC

We condemn anyone that stores passwords as plaintext. Time to treat access tokens as nothing less than a password.

Re: All your Facebook Access Tokens are belong to us

#8

Post by JosephRedfern » Tue, Oct 29, 2013, 4:19 PM UTC

thefreeman wrote: post #5

patmcguire wrote: post #2

Can anyone get to the article?

worked for me. tldr: Facebook apps were leaking the access token via the android log cat which is accessible from any app installed on your device.

AFAIK since Android 4.1 the READ_LOGS permission (needed for an app to be able to access logcat output) can no longer be granted to a 3rd party application... of course, there are going to be lots of devices out there running Android < 4.1.

Re: All your Facebook Access Tokens are belong to us

#9

Post by davidkuridza » Tue, Oct 29, 2013, 4:20 PM UTC

zaidf wrote: post #7

We condemn anyone that stores passwords as plaintext. Time to treat access tokens as nothing less than a password.

How would you store access tokens on a device, using two-way encryption or do you have something else in mind?

Re: All your Facebook Access Tokens are belong to us

#10

Post by thehme » Tue, Oct 29, 2013, 4:32 PM UTC

Can't read blog post:

Error 520 Ray ID: c513da5e9750697 Web server is returning an unknown error

https://support.cloudflare.com/hc/en-us/articles/200171936-E...

humm...