Facebook Leaks Access Tokens, Exposes Private User Data to Advertisers

eweek.com

39 points·mwbiz··8 comments

>Most access tokens expire in two hours, but some tokens work offline and remain valid until the user changes the password, Doshi said.

FB users can just go into their authenticated applications list and revoke access tokens on a per-application basis. Changing passwords shouldn't be necessary - that's the whole point of access tokens.

Not only is it unnecessary, it won't do anything. One of the big points of access tokens is that they survive password changes, so a user can change their credentials and not have to reauthorize a few dozen apps.

"If the user changes their password, the access token expires" [http://developers.facebook.com/docs/authentication/]

That's not the case if `offline_access` has been requested.

TL;DR: An old Facebook auth system included access tokens in app iframe URLs, which were subsequently leaked through the referrer to app advertisers, analytics, etc.

>Certain Facebook applications are leaking “access tokens” to third parties, such as advertisers, giving them access to personal-profile data ...

we all are sure that Facebook did it unintentionally, just by [technical] mistake.

The leak looks wholly unintentional. No conspracy theories necessary.

If I haven't visited facebook.com in months, am I safe?

Reply on news.ycombinator.com