JavaScript takes user data via the 'Sign in with Facebook' feature

The JavaScript library of many advertising and analytics services is taking user data from websites that use the Facebook login permission feature.

Experts from Princeton University discovered that 434 out of 1 million pages are downloading third-party JavaScripts, able to retrieve data in this way. They also said that 434 pages did not know what was happening.

Data collection scenario No. 1

The team said the data collection took place in two ways. Case 1 is on pages that use the 'Sign in with Facebook' feature to authenticate users. When logged in, this feature sends a request to the Facebook server, returning Facebook account data to allow users to access the page.

Data collection process diagram of scenario 1

Third-party JavaScript code loaded on the page will interfere with this data and retrieve it. Although some pages collect user IDs, this ID can be transferred to Facebook ID and used to collect more information.

Data collection scenario No. 2

Scenario 2 is somewhat more complicated. If the page using 'Sign in with Facebook', a third party can embed iframe on other pages to trick the authenticated user's browser by logging into their Facebook. As in the previous case, the 3rd party monitoring script also interferes with and retrieves Facebook data.

Data collection process diagram of scenario 2

'Leaving Facebook data to a third party is not due to the error of' Sign in with Facebook 'but due to the lack of security boundaries between the 1st and 3rd party web scripts', researchers Princeton's rescue said.

'Facebook and other social networks can avoid this situation: censoring APIs to see which units access social network login data, where and how. Facebook may also disallow viewing user profiles and Facebook IDs by app-scope user ID. Maybe now should allow anonymous login (Anonymous Login) with Facebook when they have said so 4 years ago, 'the researchers said.

See more:

1. Facebook provides a warning and allows users to edit application access to protect information
2. Facebook was sued collectively because of biometric data collection, which could cost billions of dollars
3. How to turn off Facebook Platform to stop sharing personal data