72

Today I was playing with some web security, and there was a surprise when I decided to test the Forget the Password link on Facebook.

I chose to send the password reset code to my Gmail address, and right after that Facebook pops up with another window with a message telling that I don't have to worry about my password reset code as I am already logged into my Gmail account.

Already logged in

How can they do that?

I am guessing that it has something to do with the OpenID protocol, but shouldn't I have to allow it in order for Facebook to interact with my Gmail account?

2
  • * Can you confirm that this behaviour does not login if you log out of gmail? * Can you post screenshots when logged in/out of gmail? * Can you open Firebug/Chrome network inspector and post the entire traffic during this event?
    – Achille
    Nov 5, 2011 at 23:31
  • 1
    I remember there was a trick using your Gmail pic: if it can be displayed, it means you're logged. See Google for more info.
    – seriousdev
    Nov 5, 2011 at 23:48

5 Answers 5

21

The OAuth tokens for Google are at https://accounts.google.com/b/0/IssuedAuthSubTokens (it's different from Linked Accounts).

When I tried it, Facebook created a popup with a OAuth prompt the first time and only briefly opened a blank popup on subsequent attempts. De-authorizing Facebook makes the prompts appear again.

4
  • 3
    This isn't OAuth, it's OpenID.
    – Yuliy
    Nov 6, 2011 at 8:33
  • @Yuliy, pretty sure it's both, I ran a program that uses the Google Docs API, and remember that API uses oath. Nov 6, 2011 at 8:47
  • Yes, google uses a hybrid oauth+openid procotol (see code.google.com/apis/accounts/docs/OpenID.html).
    – El Yobo
    Nov 6, 2011 at 12:32
  • This is correct. If you had linked your Google account with Facebook, they can verify your GMail address (with immediate OpenID sign-in process, w/o any UI). After that there is no point to ask you to verify password change through verification code sent to e-mail, etc.
    – timdream
    Nov 8, 2011 at 3:17
8

Have you looked at your Google account to see if you gave Facebook permission to access your Google information?

3
3

It uses OpenID. If you've previously used OpenID to give Facebook access to your e-mail (such as to import your contacts to Facebook), then it'll try and do that. If you haven't done so, then you'd be presented with a prompt to give Facebook access (if you say no, then just go and actually wait for the password reset e-mail to get delivered to you).

2

In Account Settings, there's a "Linked Accounts" section where you can have Facebook automatically log in if you're logged in to one of your OpenID-enabled accounts on other sites. Maybe you forgot that you linked your Gmail account?

1
  • Nope it's not that unfortunately. I tried it myself removing all linked accounts. The event above still happens.
    – phwd
    Nov 5, 2011 at 23:12
-1

This isn't the case. As mentioned, the only site that can access GMail cookies is GMail. I have just tested this exact method and (having never authorised before) the popup took me to a page on the accounts.google.com sub-domain asking me to authorise access for Facebook. This is exactly what I would expect and hope to happen.

It would appear the OP has previously authorised such an action, maybe through Google Buzz or similar?

Not the answer you're looking for? Browse other questions tagged or ask your own question.