{"id":421881,"date":"2011-05-11T11:33:36","date_gmt":"2011-05-11T11:33:36","guid":{"rendered":"http:\/\/www.ghanamma.net\/2011\/05\/11\/facebook-profile-access-leaked\/"},"modified":"2011-05-11T11:33:36","modified_gmt":"2011-05-11T11:33:36","slug":"facebook-profile-access-leaked","status":"publish","type":"post","link":"https:\/\/www.ghanamma.com\/2011\/05\/11\/facebook-profile-access-leaked\/","title":{"rendered":"Facebook profile access ‘leaked’"},"content":{"rendered":"

11 May 2011<\/span> Last updated at<\/span> 07:33 ET<\/span><\/span><\/p>\n

Access to hundreds of thousands of Facebook accounts may have accidentally been leaked because of a flaw in some applications.<\/p>\n

Security firm Symantec discovered that programs were inadvertently sharing access tokens which could be used by advertisers.<\/p>\n

It estimates that, as of last month, 100,000 applications were still enabling leaks.<\/p>\n

Facebook said that it was improving authentication methods.<\/p>\n

“We have been working with Symantec to identity issues in our authentication flow to ensure that they are more secure,” Facebook’s Naitik Shah wrote in a blog post on Tuesday<\/a>.<\/p>\n

Spare keys<\/span><\/p>\n

In his report<\/a>, Symantec’s Nishant Doshi explained how access tokens act “like spare keys” to a Facebook user’s account.<\/p>\n

These keys were typically given out, with the user’s permission, to help applications on the Facebook platform function.<\/p>\n

With the keys, applications could access a user’s profile and photographs, as well as posting messages on their wall.<\/p>\n

However, the newly-discovered weakness in the old authentication method would allow spare keys to be passed to further third-parties – likely to include advertisers – through referral data.<\/p>\n

Continue reading the main story<\/a><\/p>\n

\u201cStart Quote<\/span><\/h2>\n
\n

We estimate that over the years, hundreds of thousands of applications may have inadvertently leaked millions of access tokens to third parties\u201d<\/p>\n<\/blockquote>\n

End Quote<\/span> Nishant Doshi<\/span> Symantec<\/span><\/div>\n

“The Facebook application is now in a position to inadvertently leak the access tokens to third parties potentially on purpose and unfortunately very commonly by accident,” explained Mr Doshi.<\/p>\n

“We estimate that over the years, hundreds of thousands of applications may have inadvertently leaked millions of access tokens to third parties.”<\/p>\n

But he downplayed the risk, adding: “Fortunately, these third-parties may not have realised their ability to access this information.”<\/p>\n

Facebook’s director of developer relations Kevin Purdy disputed the findings.<\/p>\n

In a statement, he said: “We’ve conducted a thorough investigation which revealed no evidence of this issue resulting in a user’s private information being shared with unauthorised third parties.”<\/p>\n

“In addition, this report ignores the contractual obligations of advertisers and developers which prohibit them from obtaining or sharing user information in a way that violates our policies.”<\/p>\n

Less secure<\/span><\/p>\n

By default, new applications on Facebook are required to authenticate using OAuth 2.0, a shared open standard co-authored by several sites including Google and Twitter.<\/p>\n

While older applications are encouraged to change to the new system, it is not yet compulsory.<\/p>\n

Facebook is now working with third-party developers help migrate them to the OAuth 2.0 system.<\/p>\n

“Because of the number of apps using our legacy auth system, we need to be thoughtful about this transition,” wrote Facebook’s Naitik Shah wrote.<\/p>\n

Paul Mutton, a security analyst at Netcraft, said that while the vulnerability could potentially be used for malicious purposes, no secure data such as passwords has been taken.<\/p>\n

“Potentially someone else could post stuff to your stream or to your friends’ streams – making you like things that you perhaps wouldn’t have liked,” he said.<\/p>\n

Makers of Facebook applications have been given until 1 September by Facebook to make sure their application uses the OAuth 2.0 system.<\/p>\n

“For some applications to continue working, the makers will have to make changes. It’s about giving the developers time,” added Mr Mutton.<\/p>\n

“It shouldn’t take too long to make the change. But in the cases of more commercial apps, it’s going to be more convoluted.”<\/p>\n

Symantec has advised users to change their passwords if they are concerned about unauthorised third-party access to their profile.<\/p>\n<\/div>\n<\/p>\n

See the article here:
\nFacebook profile access ‘leaked’<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

11 May 2011 Last updated at 07:33 ET Access to hundreds of thousands of Facebook accounts may have accidentally been leaked because of a flaw in some applications. <\/p>\n","protected":false},"author":0,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13],"tags":[],"class_list":{"0":"post-421881","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-sports"},"yoast_head":"\nFacebook profile access 'leaked' - Ghanamma.com<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.ghanamma.com\/2011\/05\/11\/facebook-profile-access-leaked\/\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"Facebook profile access 'leaked' - Ghanamma.com\" \/>\n<meta name=\"twitter:description\" content=\"11 May 2011 Last updated at 07:33 ET Access to hundreds of thousands of Facebook accounts may have accidentally been leaked because of a flaw in some applications.\" \/>\n<meta name=\"twitter:creator\" content=\"@ghanamma\" \/>\n<meta name=\"twitter:site\" content=\"@ghanamma\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.ghanamma.com\/2011\/05\/11\/facebook-profile-access-leaked\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.ghanamma.com\/2011\/05\/11\/facebook-profile-access-leaked\/\"},\"author\":{\"name\":\"\",\"@id\":\"\"},\"headline\":\"Facebook profile access ‘leaked’\",\"datePublished\":\"2011-05-11T11:33:36+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.ghanamma.com\/2011\/05\/11\/facebook-profile-access-leaked\/\"},\"wordCount\":593,\"commentCount\":0,\"articleSection\":[\"Sports\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.ghanamma.com\/2011\/05\/11\/facebook-profile-access-leaked\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.ghanamma.com\/2011\/05\/11\/facebook-profile-access-leaked\/\",\"url\":\"https:\/\/www.ghanamma.com\/2011\/05\/11\/facebook-profile-access-leaked\/\",\"name\":\"Facebook profile access 'leaked' - Ghanamma.com\",\"isPartOf\":{\"@id\":\"https:\/\/www.ghanamma.com\/2011\/#website\"},\"datePublished\":\"2011-05-11T11:33:36+00:00\",\"author\":{\"@id\":\"\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.ghanamma.com\/2011\/05\/11\/facebook-profile-access-leaked\/\"]}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.ghanamma.com\/2011\/#website\",\"url\":\"https:\/\/www.ghanamma.com\/2011\/\",\"name\":\"Ghanamma.com\",\"description\":\"News In Ghana - Latest Ghana News Headlines\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.ghanamma.com\/2011\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Facebook profile access 'leaked' - Ghanamma.com","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.ghanamma.com\/2011\/05\/11\/facebook-profile-access-leaked\/","twitter_card":"summary_large_image","twitter_title":"Facebook profile access 'leaked' - Ghanamma.com","twitter_description":"11 May 2011 Last updated at 07:33 ET Access to hundreds of thousands of Facebook accounts may have accidentally been leaked because of a flaw in some applications.","twitter_creator":"@ghanamma","twitter_site":"@ghanamma","twitter_misc":{"Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.ghanamma.com\/2011\/05\/11\/facebook-profile-access-leaked\/#article","isPartOf":{"@id":"https:\/\/www.ghanamma.com\/2011\/05\/11\/facebook-profile-access-leaked\/"},"author":{"name":"","@id":""},"headline":"Facebook profile access ‘leaked’","datePublished":"2011-05-11T11:33:36+00:00","mainEntityOfPage":{"@id":"https:\/\/www.ghanamma.com\/2011\/05\/11\/facebook-profile-access-leaked\/"},"wordCount":593,"commentCount":0,"articleSection":["Sports"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.ghanamma.com\/2011\/05\/11\/facebook-profile-access-leaked\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.ghanamma.com\/2011\/05\/11\/facebook-profile-access-leaked\/","url":"https:\/\/www.ghanamma.com\/2011\/05\/11\/facebook-profile-access-leaked\/","name":"Facebook profile access 'leaked' - Ghanamma.com","isPartOf":{"@id":"https:\/\/www.ghanamma.com\/2011\/#website"},"datePublished":"2011-05-11T11:33:36+00:00","author":{"@id":""},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.ghanamma.com\/2011\/05\/11\/facebook-profile-access-leaked\/"]}]},{"@type":"WebSite","@id":"https:\/\/www.ghanamma.com\/2011\/#website","url":"https:\/\/www.ghanamma.com\/2011\/","name":"Ghanamma.com","description":"News In Ghana - Latest Ghana News Headlines","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.ghanamma.com\/2011\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/www.ghanamma.com\/2011\/wp-json\/wp\/v2\/posts\/421881","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ghanamma.com\/2011\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ghanamma.com\/2011\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ghanamma.com\/2011\/wp-json\/wp\/v2\/comments?post=421881"}],"version-history":[{"count":0,"href":"https:\/\/www.ghanamma.com\/2011\/wp-json\/wp\/v2\/posts\/421881\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.ghanamma.com\/2011\/wp-json\/wp\/v2\/media?parent=421881"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ghanamma.com\/2011\/wp-json\/wp\/v2\/categories?post=421881"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ghanamma.com\/2011\/wp-json\/wp\/v2\/tags?post=421881"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}