Re:Symantec says change your Facebook password now
by pavel_lishin on Wednesday May 11, 2011 @03:21PM
(#2537975)
So, does changing your password instantly lock out every web-app that I've connected to my Facebook account? Or merely the stupid ones that allow me to ask my Friends what their favorite flavor of ice cream is?
Re:Symantec says change your Facebook password now
by sanj on Wednesday May 11, 2011 @04:21PM
(#2538256)
What's glossed over here is that this is only an issue if you're allowed the offline_access extended permission:
From the article:
By default, most access tokens expire after a short time, however the application can request offline access tokens which allow them to use these tokens until you change your password, even when you aren’t logged in.
Further, Facebook explicitly revokes tokens when you change your password.
Re:Symantec says change your Facebook password now
by teej on Wednesday May 11, 2011 @06:32PM
(#2538679)
Under "Using The Access Token"
If the user changes their password, the access token expires
or the user deauthorizes your app in the App Dashboard, the
Graph API will issue an HTTP 400 and return the error in the
body of the response:
Re:Symantec says change your Facebook password now
by joe_the_user on Wednesday May 11, 2011 @03:49PM
(#2538100)
As far as I know, an Oauth token should independent of one's password (that is, in fact, their purpose).
If there are Oauth tokens giving excess permission floating around, I assume the proper approach would be to remove permission from the your various apps and then give it to them again.
But what do I know? Well, other than Facebook's own documentation and Oauth documentation?
Re:Symantec says change your Facebook password now
by jwatzman on Wednesday May 11, 2011 @04:57PM
(#2538396)
My understanding is that this was a bug with the previous authentication scheme, before they rolled out OAuth. Changing your password revokes old tokens for all authentication schemes and thus mitigates the problem.
From the article:
By default, most access tokens expire after a short time, however the application can request offline access tokens which allow them to use these tokens until you change your password, even when you aren’t logged in.
Further, Facebook explicitly revokes tokens when you change your password.
Do you have a reference for that? Seriously, I'm working on Oauth stuff and I would like as much information as possible.
If there are Oauth tokens giving excess permission floating around, I assume the proper approach would be to remove permission from the your various apps and then give it to them again.
But what do I know? Well, other than Facebook's own documentation and Oauth documentation?