1

I am scared that someone can get into anybodys account on my game, if user does not have Facebook. Stealer makes facebook with same email that user in my game, and then click "Login with facebook" -> redirects him to permission page -> back to my page - it detects that facebook email is same as victim's and -> stealer is logged into victims account.

How could I prevent this? Just t allow LOGGED in users to associate their account with facebook's ?

|improve this question
3

OpenID requires the user to be logged into the website of the OpenID account they are using. So unless someone is logged into that Facebook account, Facebook won't authenticate them and allow them to be logged into your website. So if someone uses the same email address as another person's Facebook account they will still fail to login.

Update

Facebook does require the verification of email addresses so this kind of hijacking attempt will not work.

|improve this answer
  • sorry, by "openID" I meant ALL services which provides fast-login API. So, I'm talking about facebook only – genesis Jun 18 '11 at 13:45
  • 1
    My answer applies to any OpenID provider, including Facebook. – John Conde♦ Jun 18 '11 at 13:46
  • I didn'T get it. Facebook requires logged to be facebook account, right? But when comeone creates fake account with same email as registered in my DB, he would be able to log in. Or ? – genesis Jun 18 '11 at 13:48
  • 1
    If someone creates a fake account with the same email they would not be able to login. Just having the same email address is not enough. They must also log into Facebook successfully to pass the OpenID authentication. Obviously they won't know the Facebook password for that account and thus will fail authentication and will not be logged into your website. – John Conde♦ Jun 18 '11 at 13:49
  • I think you didn'T get me. Example: You're my victim, you do not have facebook and I know your mail is foo@bar.com (on my site) -> I will create facebook account -> mail foo@bar.com -> does facebook require activate? (maybe that's the point) -> if no, login to facebook -> go to my one-click login app -> user is logged on my email .. so, does facebook require activation? – genesis Jun 18 '11 at 13:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.