What gets exposed using Login Using Facebook?

[DelJo63]

Have you ever seen

Of course you have - - a very high percentage of websites offer this technique of gaining access to another website. It's easy so why not? CAVEAT EMPTOR on that question; don't be so naive!

Before delving into the issues, the overall conclusion is

NEVER LINK one site to another with a social media login!

If your privacy is important to you and your friends:
Disassociate all your logins from any social site(s) you use
Login manually to each and every website using a login.​

Ignoring browser and website privacy settings (which need to be reviewed frequently btw),
the OAuth API(aka the technique which enables logging in with a social site ID), gives hidden access to thrid party software which you can't control.

Excerpts from:
https://freedom-to-tinker.com/2018/...ta-third-party-trackers-abuse-facebook-login/

Cambridge Analytica was found misusing user data collected by a Facebook quiz app which used the Login with Facebook feature. We’ve uncovered an additional risk: when a user grants a website access to their social media profile, they are not only trusting that website, but also third parties embedded on that site.

Vulnerability 1: Third parties piggyback on Facebook access granted to websites
https://s3.amazonaws.com/ftt-upload...2018/04/17235951/third_party_exfiltration.png

Vulnerability 2: Tracking users around the web with the Facebook Login service
https://s3.amazonaws.com/ftt-upload...18/04/18000001/third_party_identification.png

it is due to the lack of security boundaries between the first-party and third-party scripts in today’s web. Still, there are steps Facebook and other social login providers can take to prevent abuse: API use can be audited to review how, where, and which parties are accessing social login data. Facebook could also disallow the lookup of profile picture and global Facebook IDs by app-scoped user IDs

What are you sharing:
https://www.cbsnews.com/news/what-are-you-sharing-when-you-sign-in-with-facebook-or-google/


the overall conclusion is

NEVER LINK one site to another with a social media login!

If your privacy is important to you and your friends:
Disassociate all your logins from any social site(s) you use
Login manually to each and every website using a login.​

 

[holdum323]

Excellent! No need for me to say any thing more. Thanks.(y)(y)

 

[Rich M]

Wow good post I hope everyone reads this!