shehrozef

Hello everyone,

Lead author of the paper here. I am encouraged to see such insightful discussion on our work. Excited to discuss and address any questions/concerns that you anyone may have.

A preprint of our full paper can be found here: https://arxiv.org/pdf/2006.15794.pdf.

We are also publicly sharing a disclosure page (https://github.com/shehrozef/canarytrap). This page contains details of third-party apps which are detected as misusing user data or violating Facebook's TOS in our work.

This is a good idea but third-party developers might lose interest in Facebook's SSO if they are not getting user's real email address :)

Hey, Lead author of the paper here. I would like to highlight that these detected apps amount to more than one percent of monitored apps. Considering Facebook has millions of apps, there could be tens of thousands of apps potentially misusing users data.