Hacker News Reader

Has anyone checked to see if any Facebook access tokens were saved unencrypted in the database? They mention that users who logged in with Facebook instead of username/password would be completely safe, but if access tokens were leaked, then many users could have their Facebook data mined.

View on HN

All they have to do is expire their secret key and all the access tokens will be invalidated.

Are Facebook access tokens vulnerable to such an attack?

If I remember correctly, at least Google tokens wouldn't be: The application receives a token from Google. With that token, a new session token is created. This session token expires and can only be renewed with the application token and the correct redirect URL.

If Facebook uses a similar scheme, tokens would be useless without the running application renewing session tokens.

Nothing like that happens with Facebook, if I recall correctly. Once you have an access token you're good to go until it expires.

Reply on news.ycombinator.com