Tag Info

Hot answers tagged

35

This is simply Facebook trying to provide a better user experience for those users who may have Caps Lock enabled, or who's devices automatically capitalize the first letter of the password. I don't think there any any cookies per your question. It is likely that the password hashing and storage is as standard as you would expect. The alternate passwords ...


2

To specifically address the scenario, Facebook doesn't need to wait until a user logs in to capture an OAuth token. Since you're trusting Facebook as your authentication provider, they can generate a valid OAuth token for any user in their system anytime they please. Given that, there are three potentially correct answers here. This is not a threat, ...


1

I suspect it really means «They have stolen your cookies and can impersonate you. Change your password in order to invalidate the session» Another explanation would be that they could show a fake login prompt (eg. simulating that you got logged out, or entered a wrong password) and obtain your password from there.



Only top voted, non community-wiki answers of a minimum length are eligible