Report: “No Boundaries For Facebook Data: Third-Party Trackers Abuse Facebook Login”

From the Always “Must Read” Freedom-to-Tinker Blog (April 18, 2018):

So far in the No boundaries series, we’ve uncovered how web trackers exfiltrate identifying information from web pages, browser password managers, and form inputs.
Today we report yet another type of surreptitious data collection by third-party scripts that we discovered: the exfiltration of personal identifiers from websites through “login with Facebook” and other such social login APIs. Specifically, we found two types of vulnerabilities [1]:

• seven third parties abuse websites’ access to Facebook user data

• one third party uses its own Facebook “application” to track users around the web.

From the Conclusion of the Blog Post:

This unintended exposure of Facebook data to third parties is not due to a bug in Facebook’s Login feature. Rather, it is due to the lack of security boundaries between the first-party and third-party scripts in today’s web.
Still, there are steps Facebook and other social login providers can take to prevent abuse: API use can be audited to review how, where, and which parties are accessing social login data. Facebook could also disallow the lookup of profile picture and global Facebook IDs by app-scoped user IDs.

Read the Complete Post (about 2000 words)

Filed under: Data Files, News, Patrons and Users