IIT Home Page CNR Home Page

How to Grant Less Permissions to Facebook Applications

Single Sign-On (SSO) is an authentication procedure that allows users to adopt the same credentials to access multiple services. On the other hand, OAuth 2.0 is a protocol that enables authorized applications to access data that are stored in a resource server. A practical example of the adoption of SSO with OAuth 2.0 is given by all the websites or applications that use the “Log in with Facebook” procedure to authenticate users already registered with Facebook.

In this paper, we propose a mechanism that exploits a weakness of OAuth 2.0 and a missing control of the website to show how it is possible to register a user by reducing the number of scopes that the website requires with the “Log in with Facebook” procedure. Finally, we illustrate two examples that exploit the proposed mechanism and provide a solution to address the problem. 


IAS 2013, Yassmine Hammamet – Tunisia, 2013

IIT authors:

Daniele Sgandurra

Foto di Daniele Sgandurra

Type: Article in proceedings of international peer-reviewed conference
Field of reference: Information Technology and Communication Systems

Activity: Architectures, protocols and mechanisms for the security of distributed services and systems
Social Networking