I am making a custom auth flow for the application. It is inspired by OAuth 2.0. Dev sends user to an auth page on my domain, passing callback_url and api_id. I redirect user to callback_url, passing ...
I am reading about Facebook Connect and it looks a lot like OpenID Connect. Are these two similar enough that the Facebook Connect secret key is an OAuth Client Secret and therefore the same attacks ...
I'm creating a contest that will allow users to login using their Facebook & Twitter accounts and submit votes on videos. My clients concern is that users will game the system by logging into ...
Possible Duplicate: Isn’t OAuth, OpenID, Facebook Connect, and others crazy from a security standpoint? I have some real concerns about how to use facebook login for my wabb-app. I have a ...
I'm working on a mobile app with a web backend. We'd like to have users authenticate (log in) themselves through Facebook only, so we don't have to store passwords etc. and don't force users to create ...
We all know that when to store passwords, we should store it with one-way hash such as a variant of SHA, bcrypt or scrypt to prevent plain-text password leaks when the database is hacked. But what ...
I've recently find out that by simple quick look into compiled code of one of our applications, you can get both App ID (API Key) and App Secret for Facebook API I suppose that we should really keep ...