Is it safe to transfer Facebook access token via TCP? What is the worst that can happen if someone gets the token?
Tell me more
×
IT Security Stack Exchange is a question and answer site for
IT security professionals. It's 100% free, no registration required.
|
|
migrated from stackoverflow.com Dec 13 '11 at 22:41
|
Depends on what you're trying to do and what kind of TCP connection you're using. To keep it short, I'll give you some things to consider:
As said: TCP is just like FTP, HTTP and all the other protocols. If it's not encrypted, people can fetch and put to use intercepted info more quickly. As a quick answer to your generalized question, this should satisfy. If you expect an in-deep risk analysis, we (the people trying to help by answering) would need to know a bit more about the "Why TCP and what for". But in the end, you'll end up with an encrypted connection (TCP or other) if you want to be 100% sure that you're SAFELY transmitting Facebook access tokens somewhere else but Facebook. Think of it like your MySQL database... you're not storing passwords unencrypted either, or are you? Same goes for transmitting sensitive data: keep it safe and encrypt what you can because you never know where the next script-kid might be lurking to ruin your day. Hmmm... Why do I get the feeling the shortest answer would have been a simple, two-letter "no"? - UPDATE As some comments show that there is a big lack in understanding data security, I'll add a few lines. Some argued HTTPS does in-stream encryption. It doesn't. HTTPS combines Hypertext Transfer Protocol (HTTP) with SSL/TLS protocol. HTTPS transmissions might be encrypted, but from a SECURITY point of view, everything can be intercepted - encrypted or not. Next, some seem to mix up HTTPS with the less used S-HTTP (Secure HTTP). There is a big difference! look at the question The question was:
The answer is NO, you need to use secure protocols to avoid eavesdropping/man-in-the-middle attacks. But let's assume the OP is smart and uses HTTPS as an crypto wrapper. With HTTPS you might avoid eavesdropping/man-in-the-middle attachs, but you can't ignore that a Chosen-ciphertext attack will still be successful! For a first read about this, check "LIMITATIONS of HTTPS" at http://en.wikipedia.org/wiki/HTTP_Secure and "CSS" attacks at http://en.wikipedia.org/wiki/Chosen-ciphertext_attack. As the OP asked about "worst case", the answer is: "interception of the key, optional decryption of the intercepted data when a security layer like HTTPS is used and in the end it might lead to the abuse of the token". Now, if the question would have been "how likely is it that this will happen", I would have answered: "pretty much unlikely, but that doesn't mean it can't happen". But if you check the question again, you'll discover that that was not part of the question. So I won't go into statistics and probability calculations here. Besides, we're missing major parts of the "how and why" of the transmission, so no one can honestly give a definitive answer regarding the probability. That would be unprofessional, to say the least. other forms of attacks No matter how you do it - in the end, everything is unsecure and unbreakable crypto has yet to be invented. Depending on the country, there can and will be a whole range of additional security problems involved... and I'm not talking about China! See how Tunesia kicked FaceBook security with something that's so simple, it should run shivers down your spine: http://www.cpj.org/internet/2011/01/tunisia-invades-censors-facebook-other-accounts.php look at the question AGAIN Don't take security questions lightly. You might comment against my answer and vote it down, but that won't make transmitting a Facebook token via TCP any safer! Especially, as the OP does not indicate he is using any kind of security layer, we have to interpret it as if the FaceBook token is transmitted from IP "a" to IP "b" in an unsecure way! A regular transmission of data using TCP is unsecure by definition for several reasons, of which I have merely scratched the surface of some. I can only repeat: don't take security questions lightly. |
|||||||||||||||||
|
|
No, this is not safe. Access tokens are pretty sensitive. Anyone who knows the access token for a user can access the user's data and perform some actions as the user, for as long as the token is valid. For instance, anyone who knows the access token The details of exactly what the access token can be used for will vary. An access token is granted to an application, when the user authorizes the application (i.e., approves installation of the application). When the user authorizes the application, the user is asked to approve the permissions requested by the app. The access token alone then grants access to those permissions. Thus, an access token is enough to allow a bad guy to do anything that the app who was initially granted the access token was authorized to do. Depending upon what permissions were granted to the app, this might include things like reading the user's wall, getting information about the user, finding information about the user's friends, posting to the user's wall, or that sort of thing. If you send the access token over an unencrypted TCP connection, then an eavesdropper who can capture the traffic you've sent can recover the access token and then use it to access the user's data or take actions on the user's behalf. That's not good. For these reasons, you should treat access tokens as confidential, and you should never send access tokens over an unencrypted channel. Facebook always uses HTTPS whenever it transmits access token. You should do the same: only send the access token over encrypted channels, like HTTPS; never send an access token over unencrypted channels. |
||||
|
|
