Facebook’s login to other sites service lets scum slurp your stuff
A security researcher has claimed it’s possible to extract user information from Facebook’s Login service, the tool that lets you sign into third-party sites with a Facebook ID.
Readers will be familiar with Steven Englehardt (a Mozilla privacy engineer who pursues privacy research for his PhD at Princeton), whose work on browser fingerprinting led him to identifying a remarkable degree of privacy invasion by analytical scripts.
In Englebardt’s latest work, in partnership with Gunes Acar and Arvind Narayanan, the three explain that they identified seven sites accessing Facebook user data, and one site using Facebook’s application to track users around the Web.
For users, Facebook Login looks like a boon: they only need to use their Facebook password to log into multiple sites or apps. That, however, puts a very strong onus on Facebook to make sure the whole process is secure.
What Englebardt discovered is simple: “when a user grants a website access to their social media profile, they are not only trusting that website, but also third parties embedded on that site.”
The third parties were able to grab Facebook user ID, e-mail, name, and other profile information including (in one case) gender.
“We found seven scripts collecting Facebook user data using the first party’s Facebook access”, he wrote. The practice isn’t yet widespread, thankfully: scripts to gather this user information were only found on 434 of the Alexa top million sites, including “fiverr.com, bhphotovideo.com, and mongodb.com”.
The table below shows some a sample of some sites’ data collection Englehardt’s team identified.
Engledhardt noted that OnAudience stopped the data collection when he’d previously spotted them misusing browser autofill features.
The second tracker Engledhardt discovered was that sites can abuse iFrames to de-anonymise users who had used Facebook Login to access their sites. In the example given in the article, Bandsintown (an online gig guide) was carrying a hidden tracker that passed user information to an embedded iFrame script (meaning Bandsintown could read the Facebook profile).
He added that having linked the logged in user to their Facebook profile, Bandsintown could then pass that information up to advertisers.
When notified, the site discontinued the practice.
Englehardt emphasised that this kind of third-party data gathering shouldn’t be regarded as a bug on Facebook’s part, although having announced “anonymous login” four years ago, it might be time for the Social Network™ to implement the feature.
As he wrote: “It is straightforward for a third party script to grab data from the Facebook API.
Source:-https://www.theregister.co.uk/2018/04/19/facebook_third_party_site_login_security_leak/
