Symantec says change your Facebook password now

Re:Symantec says change your Facebook password now by sanj on Wednesday May 11, 2011 @04:21PM (#2538256)

What's glossed over here is that this is only an issue if you're allowed the offline_access extended permission:

From the article:

By default, most access tokens expire after a short time, however the application can request offline access tokens which allow them to use these tokens until you change your password, even when you aren’t logged in.

Further, Facebook explicitly revokes tokens when you change your password.

[ Parent | on HN ]

Re:Symantec says change your Facebook password now by joe_the_user on Wednesday May 11, 2011 @06:27PM (#2538663)

Further, Facebook explicitly revokes tokens when you change your password.

Do you have a reference for that? Seriously, I'm working on Oauth stuff and I would like as much information as possible.

[ Parent | on HN ]

Re:Symantec says change your Facebook password now by teej on Wednesday May 11, 2011 @06:32PM (#2538679)

Under "Using The Access Token"

    If the user changes their password, the access token expires
    or the user deauthorizes your app in the App Dashboard, the 
    Graph API will issue an HTTP 400 and return the error in the 
    body of the response:

from http://developers.facebook.com/docs/authentication/

[ Parent | on HN ]