TECH CRUNCH - May 11 - As if Facebook’s Instant Personalization needed
another knock against it, tonight comes news of a security issue that
makes the feature even more unnerving. Web security consultant George
Deglin discovered an exploit that would allow a malicious site to
immediately harvest a Facebook user’s name, email, and data shared with
‘everyone’ on Facebook, with no action required on the user’s part. This specific exploit has been patched, and no user data was
compromised, but the security problems behind it remain. The exploit
took advantage of Cross Site Scripting to inject malicious code into
Yelp. Yelp is one of the three sites that have been deemed fit for
Facebook’s highly controversial Instant Personalization feature. The
feature grants Yelp immediate access to much of a user’s core Facebook
data as soon as they visit the reviews site, without having to bother
with logins or Connect buttons. But with that convenience comes risk —
if a site with Instant Personalization is compromised, it can put
almost any Facebook user in harm’s way. FULL ARTICLE @ TECH CRUNCH
See all posts on Yelp
See all posts on Facebook