News for hackers. Stuff that matters.

A comment on Symantec says change your Facebook password now.

Re:Symantec says change your Facebook password now by joe_the_user on Wednesday May 11, 2011 @03:49PM (#2538100)
As far as I know, an Oauth token should independent of one's password (that is, in fact, their purpose).

If there are Oauth tokens giving excess permission floating around, I assume the proper approach would be to remove permission from the your various apps and then give it to them again.

But what do I know? Well, other than Facebook's own documentation and Oauth documentation?

[ Parent | on HN ]
Re:Symantec says change your Facebook password now by jwatzman on Wednesday May 11, 2011 @04:57PM (#2538396)
My understanding is that this was a bug with the previous authentication scheme, before they rolled out OAuth. Changing your password revokes old tokens for all authentication schemes and thus mitigates the problem.
[ Parent | on HN ]