Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Case in point, TrueCaller. I had logged into TC using a proxy twitter account. I am assuming that as part of the authentication process, an access_token must have been saved by TC.

  1. If the hackers have this token, what can they be able to do with it?
  2. Assuming that the hackers have gotten a hold of my database, what can I as a developer do, to minimise the effect of the leak? What are the good practices for such login?

Thank you.

share|improve this question
    
Also developers should pay attention to the opposite scenario: Suppose sign in is supported from many accounts (Twitter/Facebook/etc). Even with double submit cookies, an attacker could still insert a dummy account into what is unused, creating a backdoor. Demo @Blackhat here –  makerofthings7 Jul 28 '13 at 3:58

1 Answer 1

1 . If the hackers have this token, what can they be able to do with it?

That depends on the individual "social network", but such tokens are mostly configured to expire/invalidate after a certain period of time. Also, the networks you mentioned all have multiple security implementations running to limit such attack vectors by — among other things — linking the token to the IP. Ask yourself how unlikely it is that an attacker will be able to fetch multiple characteristics simultaneously… I can't say it'll not happen, as Murphy's law would most certainly prove me wrong. ;)

2 . Assuming that the hackers have gotten a hold of my database, what can I as a developer do, to minimise the effect of the leak? What are the good practices for such login?

Follow the procedures you would follow in relation to every information security incident — apply the 6 Phases of Incident Management:

  1. Preparation
  2. Identification
  3. Containment
  4. Eradication
  5. Recovery
  6. Training

To dive deeper into "incident management", you might want to start out by checking the following infos:

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.