How we hacked Facebook with OAuth2 and Chrome bugs
- First Post
- Replies
- Stats
-
Go to
- ----- 2024 -----
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2023 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2022 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2021 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2020 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2019 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2018 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2017 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2016 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2015 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2014 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2013 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2012 -----
- December
- November
- October
- September
- August
- July
A quite interesting article about OAuth2:
http://homakov.blogspot.com.br/2013/02/hacking-facebook-with-oauth2-and-c...
--
"The measure of a man is what he does with power" - Plato
-
@abstractj
-
Volenti Nihil Difficile
Attachments:
- attachment.html (text/html — 400 bytes)
This seems like a problem with Facebook's implementation. If the OAuth 2
Provider is exclusively access code access and requires confidential
clients I don't see how any of the hacks can work. This is why in our
OAuth 2 implementation (Resteasy), we don't allow any of the public and
insecure options for OAuth2 and everything is confidential.
On 2/20/2013 6:36 AM, Bruno Oliveira wrote:
A quite interesting article about OAuth2:
http://homakov.blogspot.com.br/2013/02/hacking-facebook-with-oauth2-and-c...
--
"The measure of a man is what he does with power" - Plato
-
@abstractj
-
Volenti Nihil Difficile
_______________________________________________
security-dev mailing list
security-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/security-dev
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
4292
days inactive
4292
days old
1 comments
2 participants
tags (0)
participants (2)
-
Bill Burke -
Bruno Oliveira