How To Cheat On Facebook Apps Permissions

http://homakov.blogspot.com/2012/08/how-to-cheat-on-facebook-apps.html

by homakov • 14 years ago

96 29 14 years ago

homakov.blogspot.com

radagaisus2• 14 years ago

How is this a flaw? Go to your Facebook apps settings and you can disable extended permissions for any app there. The apps are expected to work with only some of the permissions, and they have APIs to check which permissions they have enabled. This is intended.

Edit: There's also an option to edit/disable the extended permissions during the authorization. Docs: https://developers.facebook.com/docs/opengraph/authenticatio... (Permissions section)

homakov10• 14 years ago

> This is intended

what is intended here? I am user and I cannot opt-out perms in user interface. So I have to use URL trick. Looks not intended

radagaisus2• 14 years ago

https://www.facebook.com/settings?tab=applications

Irishsteve• 14 years ago

But does this give basic permissions or full ?

homakov10• 14 years ago

app will receive basic perm

magoon2• 14 years ago

Any facebook app can "require" permissions simply by refusing to operate unless you grant it the permissions it wants.

Many developers request permissions they think they'll use in the future, so this trick is useful because it puts it back on the app to error out when the user is missing a permission it actually needs.

homakov10• 14 years ago

Checking permissions after authorization rather a work around than a normal work flow.

Facebook should either let me to opt out permissions in UI or make them required (if I press Allow then permission is granted anyway)

magoon2• 14 years ago

I disagree, an app should always check permissions on startup and request any that it needs, in case the user has removed those permissions on their own.

remi• 14 years ago

There’s a great Chrome extension that lets you choose which permission to give to the app when authorizing it: https://github.com/chadselph/fprivacy

homakov10• 14 years ago

although any non programmer human being is smart enough to just modificate 'scope' param in URL :)

nikkob• 14 years ago

You can change an application's permissions on Facebook's authorization page, but this will only work if the application does not check a user's allowed permissions when the loop goes back to the application. If the developer checks the permissions granted based on the retrieved access token (via https://graph.facebook.com/me/permissions?access_token=USER_...), he/she can see which permissions have been allowed by the user. The developer can then just disallow your use of the app until you allow all permissions.

Reference: https://developers.facebook.com/docs/authentication/

nikcub2• 14 years ago

First, this isn't a flaw.

Second, this is well known and has been discussed here previously a number of times.

There are already numerous browser extensions that allow users to customize these settings. for eg. FBSecure:

http://www.addictivetips.com/internet-tips/fbsecure-customiz...

and

https://github.com/chadselph/OOptOut-Chrome-Extension

previously discussed on HN here:

https://news.ycombinator.com/item?id=3287272

and a bunch of other threads that I can't find right now.

homakov10• 14 years ago

>First, this isn't a flaw.

I didn't really call it a flaw. Just UX stupidity or whatever

>Second, this is well known and has been discussed here previously a number of times.

well known? :) is it mainstream to call smth 'well known' if you know something?

> There are already numerous browser extensions that allow users to customize these settings. for eg. FBSecure:

extensions are useless because actions are really routine. but it's nice to have them, anyway.

nikcub2• 14 years ago

Flaw is my word, but 'cheating' almost implies it. the params are documented here:

https://developers.facebook.com/docs/authentication/permissi...

I thought I would dump my previous links incase you jump into writing an extension. It would be better to contribute to the open source extension than to have yet another project (as we do with removing auth popups on news feed items)

Otherwise nothing against this making news again, the more people that know about it the better

darrhiggs• 14 years ago

This only solves half the problem. I recently tried this with yahoo reader, yet on the yahoo site there was a social reader widget with my friends and my reading history. I paused it when I realised but it seems you need to be aware of more than what permissions they have on the facebook platform; something many of my friends had not realised.

d0m• 14 years ago

I've had this bug with a facebook app I built.. I thought the flow would be:

  - Ask for permission
   - Yes? -> Good you're in.
   - No? -> Ok, np see you another day, maybe.

But what was happening is there was a third flow..

    - Yes (But I don't give you permissions!!).

And that created a nasty bug later on in the app.

I don't think it's a "flaw" because you can accept the first perm. dialog as a user, but deny the second one (Asking for more permission). But, I believe it should be more explicit that developers need to verify permissions on every actions requiring them.

homakov10• 14 years ago

basically provider could just return 'scope' for 'token' when you obtain it with 'code' along with 'expire_at' parameter

NickM• 14 years ago

This is definitely a cool trick, but the real problem with FB app privacy is that unless you completely disable the app platform on your account, any apps that your friends install can also see information about you.

Does it really matter how much you can limit your own apps, if anyone on your friends list can install any app and silently give away your information to some unknown third party without your knowledge or consent?

RKearney• 14 years ago

Not true. Just go to the Apps, Games and Websites section of the Privacy Settings and use the "How people bring your info to apps they use" section to select exactly what you want apps your friends use to be able to access about you. Doesn't require completely disabling the app platform.

How To Cheat On Facebook Apps Permissions

Related Stories