I might be wrong about this as I've not used Facebook for many years now, but doesn't Facebook require a phone number for new accounts nowadays, and requires you to use your real name as well?
Think of how many accounts are created for games reasons. Some games require friends taking action to progress. Some allow friends to send prizes like lives/money/resource.
Could be like my grandma who would occasionally manually log out of the app, but then the next time she loaded the app, rather than actually logging in again, she'd create a new account because that's what she did the first time she loaded the app and thought she had to do that every time.
It could be faked 95% accurately, but that's moot, because like I said, the user hasn't necessarily learned what "trusted UI" is in the first place.
Looks like it was a real Facebook login webview.
The difference may of course be subtle, but even obviously fake logins can work on the untrained eye.
While you are absolutely right, I want to highlight that this was done in a quite sophisticated way. It's actually the real login page of Facebook in a webview. I have 2FA on all my accounts including FB, so it looked very legit. Once you have logged in, they seem to grep the token and close the webview.
Some Google auth cookies can only be used on the same tls session that created them[1]. That means the TLS session resumption information (which can be tied to hardware platform features like the TPM) is required to make use of a stolen auth cookie. Unfortunately while that approach has big security benefits, it's pretty anti-user-privacy.
[1]: https://nakedsecurity.sophos.com/2018/10/25/could-tls-sessio...
I've been very impressed by eBay/PayPal providing "very good" almost native-feeling payment integration (swipe-to-pay, UI coming up from the bottom of the screen), so it may not last forever, but interesting to hear of the depth of scamming possible on phone UI's (and probably desktop UI's too).
Not mine. I just posted what Niek van der Maas wrote on his GitHub. I don't think he's even reading this HN thread.
Since neither iOS nor Android have any kind of trusted UI, there is no way you can be sure if you are logging into Facebook on an app, or just giving that app your credentials for them to do as they please.
Until iOS or Android get trusted UI for these usecases, I suggest using browsers on windows/Mac/Linux where you can see the in the address bar which company you are giving credentials to, and can't as easily be faked.
If you must use a mobile device to log into Facebook via a third party app, I suggest using a new Facebook account each time.