News for hackers. Stuff that matters.
Re:All your Facebook Access Tokens are belong to us by thehme on Tuesday October 29, 2013 @12:32PM (#6635438)
Can't read blog post:

Error 520 Ray ID: c513da5e9750697 Web server is returning an unknown error

https://support.cloudflare.com/hc/en-us/articles/200171936-E...

humm...

[ Parent | on HN ]
Re:All your Facebook Access Tokens are belong to us by patmcguire on Tuesday October 29, 2013 @11:41AM (#6634935)
Can anyone get to the article?
[ Parent | on HN ]
Re:All your Facebook Access Tokens are belong to us by mikeevans on Tuesday October 29, 2013 @11:55AM (#6635060)
Overview which links to the original post can be found here: http://threatpost.com/facebook-android-flaws-enable-any-app-...
[ Parent | on HN ]
Re:All your Facebook Access Tokens are belong to us by jt2190 on Tuesday October 29, 2013 @12:36PM (#6635479)
Is this it?

http://webcache.googleusercontent.com/search?q=cache:F0k-GBb...

[ Parent | on HN ]
Re:All your Facebook Access Tokens are belong to us by thefreeman on Tuesday October 29, 2013 @12:01PM (#6635123)
worked for me. tldr: Facebook apps were leaking the access token via the android log cat which is accessible from any app installed on your device.
[ Parent | on HN ]
Re:All your Facebook Access Tokens are belong to us by JosephRedfern on Tuesday October 29, 2013 @12:19PM (#6635295)
AFAIK since Android 4.1 the READ_LOGS permission (needed for an app to be able to access logcat output) can no longer be granted to a 3rd party application... of course, there are going to be lots of devices out there running Android < 4.1.
[ Parent | on HN ]
Re:All your Facebook Access Tokens are belong to us by CaveTech on Tuesday October 29, 2013 @12:04PM (#6635148)
AFAIK this has been a problem for well over 2 years now.
[ Parent | on HN ]
Re:All your Facebook Access Tokens are belong to us by hfreire on Tuesday October 29, 2013 @11:44AM (#6634963)
Nope.
[ Parent | on HN ]
Re:All your Facebook Access Tokens are belong to us by zaidf on Tuesday October 29, 2013 @12:17PM (#6635265)
We condemn anyone that stores passwords as plaintext. Time to treat access tokens as nothing less than a password.
[ Parent | on HN ]
Re:All your Facebook Access Tokens are belong to us by davidkuridza on Tuesday October 29, 2013 @12:20PM (#6635302)
How would you store access tokens on a device, using two-way encryption or do you have something else in mind?
[ Parent | on HN ]
Re:All your Facebook Access Tokens are belong to us by zaidf on Tuesday October 29, 2013 @12:34PM (#6635455)
Two way encryption, yep.
[ Parent | on HN ]
Re:All your Facebook Access Tokens are belong to us by colinhowe on Tuesday October 29, 2013 @01:07PM (#6635734)
but then for any reasonable application to be able to use them they'll need to store the unencryption key anyway..
[ Parent | on HN ]
Re:All your Facebook Access Tokens are belong to us by tedunangst on Tuesday October 29, 2013 @01:45PM (#6636058)
Obviously you wouldn't store the encryption key in plaintext...
[ Parent | on HN ]
Re:All your Facebook Access Tokens are belong to us by paulgb on Tuesday October 29, 2013 @02:32PM (#6636405)
It's encrypted keys all the way down.
[ Parent | on HN ]
Re:All your Facebook Access Tokens are belong to us by Zancarius on Tuesday October 29, 2013 @02:53PM (#6636564)
That's easy! We could use two-way encryption to encrypt the encryption key.
[ Parent | on HN ]
Re:All your Facebook Access Tokens are belong to us by snarfy on Tuesday October 29, 2013 @01:46PM (#6636076)
What's wrong with 'correct horse battery staple'?
[ Parent | on HN ]