I'm wondering why Facebook is not handling the cookie export between browsers and related security concerns. This will be worst when they are using the "remember me" option as the cookies will be persisted for many days in the machine and someone can easily steam those cookies if it is a shared computer.

I think even Google is also not doing it. I copied the CURL from google with the cookies and executed it in the command line and I was able to get the expected outputs(mails). These 2 are used as identity providers in most cases. So I believe the applications which are using these two as the identity provider and using the remember me option which is provided by them also should face a similar threat.

Is there is an identity provider which handles it properly, maybe with the device fingerprinting or any other technologies?

Appreciate if someone could mention such IDPs and how it is handling that use case.

  • 2
    Did you ever think that there are also plenty advantages of this non-device-fingerprint approach? And that faking JS-detected data is possible too? – user155462 Jul 11 '18 at 8:29
  • Yes I thought about that. Anyway, I want to get to know exactly any IDPs are using it. For example Ping or Shibboleth. If so I'm thinking to evaluate their methodology – Dush Jul 11 '18 at 8:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.