April 6, 2025 06:46:36 AM Menu
» » » Hacking Facebook Connect




TL;DR Every website with "Connect Facebook account and log in with it" is vulnerable to account hijacking. Every website relying on signed_request (for example official JS SDK) is vulnerable to account takeover, as soon as an attacker finds a 302 redirect to other domain.











I don't think these will be fixed, as I've heard from the Facebook team that it will break compatibility. I
27 Jan 2014
Posted by
Labels: ,
at 20:18

0 comments:

Post a Comment

WELLCOME MY WEB

:) :)) ;(( :-) =)) ;( ;-( :d :-d @-) :p :o :>) (o) [-( :-? (p) :-s (m) 8-) :-t :-b b-( :-# =p~ $-) (b) (f) x-) (k) (h) (c) cheer
Click to see the code!
To insert emoticon you must added at least one space before the code.

Subscribe to: Post Comments (Atom)
 
Top