1

I came here with a struggle issue. We run a social media website, where people can register by classical login (might be his email or his username) and password form but also using a Facebook Connect.

When a user choose the second option, we ask for his authorization to connect to FB Auth and then FB gives us some details, as today we use the Facebook registered email as login, and his Facebook ID as password.

When we saw that we could change our main email address on fb, we knew we had to change our way to connect them. So we thought about just sending his FB ID to Authenticate the user.

To avoid any sniffing issues we added an SSL certificate. But we still have an issue : Even with minification on our Angular APP, a user could know with a little research that to authenticate his-self to our service he "just" have to know his ID and send it to us with postman.

So if he can get the Facebook ID of another user (which might even have been leaked/sold on another website), he could use Postman to authenticate as another user.

How can I secure this process ?

We thought about using asymmetric crypto where client would cypher the ID with the pub key and server would decipher it with private key. But after all, it doesn't seems to fix the problem.

Improve this question
2
  • If you are validating the claim, how can the user alter the ID?
    – SilverlightFox
    Commented Jun 28, 2016 at 13:43
  • Validation are made by Android's app. But between the Android's app and the Server, there is just a little JSON with the FB ID. I'm not an expert on Android, but It seems to be that it could be possible to disallow the JSON to be sent and replace the value ID by an other one (who has an account with a fb connect in our db) and launch the JSON request. I will then gave a session token associated with the fb id given. The API doesn't validate, it trust the Android and the SSL. That's what make me doubt :/
    – Alex Werner
    Commented Jun 29, 2016 at 10:22

1 Answer 1

Reset to default
0

I think confirming the "FB account" is enough to authenticate (provided that you verify the source and that SSO is correctly set). You can ask the user if they want to update their email if you detect it was changed. I assume you are using another ID to track your users and the email is just a simple field, right?

I recommend you to hash the FB account as well (don't store it as plain text nor store it in the password field, as it will allowed to login using that account name).

One problem of using SSO with 3rd party services, is that if they have allow the email to be changed without confirmation (due to a security bug), then it can be used to login with any other user who is using also that SSO (assuming they know that specific user's email... which should be hidden to all users).

There are many possible ways to approach your problem. I don't know which will be the best way to implement it... better to do more research and learn how the big guys are doing it.

Improve this answer
1
  • Hi lepe, Thank you for your answer, so If I can summarize : - Hashing + SSL + identifying suspect comportment should be enough in a short-term before other implementation are made.
    – Alex Werner
    Commented Jun 27, 2016 at 8:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .