5

Case in point, TrueCaller. I had logged into TC using a proxy twitter account. I am assuming that as part of the authentication process, an access_token must have been saved by TC.

  1. If the hackers have this token, what can they be able to do with it?
  2. Assuming that the hackers have gotten a hold of my database, what can I as a developer do, to minimise the effect of the leak? What are the good practices for such login?

Thank you.

  • Also developers should pay attention to the opposite scenario: Suppose sign in is supported from many accounts (Twitter/Facebook/etc). Even with double submit cookies, an attacker could still insert a dummy account into what is unused, creating a backdoor. Demo @Blackhat here – goodguys_activate Jul 28 '13 at 3:58
2

1 . If the hackers have this token, what can they be able to do with it?

That depends on the individual "social network", but such tokens are mostly configured to expire/invalidate after a certain period of time. Also, the networks you mentioned all have multiple security implementations running to limit such attack vectors by — among other things — linking the token to the IP. Ask yourself how unlikely it is that an attacker will be able to fetch multiple characteristics simultaneously… I can't say it'll not happen, as Murphy's law would most certainly prove me wrong. ;)

2 . Assuming that the hackers have gotten a hold of my database, what can I as a developer do, to minimise the effect of the leak? What are the good practices for such login?

Follow the procedures you would follow in relation to every information security incident — apply the 6 Phases of Incident Management:

  1. Preparation
  2. Identification
  3. Containment
  4. Eradication
  5. Recovery
  6. Training

To dive deeper into "incident management", you might want to start out by checking the following infos:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.