Facebook is one Chrome extension away from a privacy scandal

Re:Facebook is one Chrome extension away from a privacy scandal by bishplsok on Thursday February 17, 2022 @02:46PM (#30377741)

So, I just tested this; it's an access token that has no authorized scopes to access sensitive data. It literally only exposes public profile data, which basically just consists of name, picture info, and internal Facebook user ID -- the default public profile info listed in the developer docs.

Is it a security flaw? Absolutely. Is Facebook still terrible? Of course.

But this article is, frankly, egregiously inaccurate in its claims on the severity of the issue.

[ Parent | on HN ]

Re:Facebook is one Chrome extension away from a privacy scandal by jtsiskin on Friday February 18, 2022 @02:53PM (#30390277)

It’s dumber than that. The chrome extension requires *.facebook.com host permission. It can literally do whatever it wants - add friends, delete your profile, etc. You could write this same article about gmail, twitter, etc, any site in the world. The author just doesn’t understand chrome extension permissions

[ Parent | on HN ]