Take the 2-minute tour ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.

Today I was playing with some web security, and there was a surprise when I decided to test the Forget the Password link on Facebook.

I chose to send the password reset code to my Gmail address, and right after that Facebook pops up with another window with a message telling that I don't have to worry about my password reset code as I am already logged into my Gmail account.

Already logged in

How can they do that? I am guessing that it has something to do with the OpenID protocol, but shouldn't I have to allow it in order for Facebook to interact with my Gmail account?

share|improve this question
    
* Can you confirm that this behaviour does not login if you log out of gmail? * Can you post screenshots when logged in/out of gmail? * Can you open Firebug/Chrome network inspector and post the entire traffic during this event? –  Achille Nov 5 '11 at 23:31
1  
I remember there was a trick using your Gmail pic: if it can be displayed, it means you're logged. See Google for more info. –  seriousdev Nov 5 '11 at 23:48
add comment

5 Answers 5

The OAuth tokens for Google are at https://accounts.google.com/b/0/IssuedAuthSubTokens (it's different from Linked Accounts).

When I tried it, Facebook created a popup with a OAuth prompt the first time and only briefly opened a blank popup on subsequent attempts. De-authorizing Facebook makes the prompts appear again.

share|improve this answer
3  
This isn't OAuth, it's OpenID. –  Yuliy Nov 6 '11 at 8:33
    
@Yuliy, pretty sure it's both, I ran a program that uses the Google Docs API, and remember that API uses oath. –  gatoatigrado Nov 6 '11 at 8:47
    
Yes, google uses a hybrid oauth+openid procotol (see code.google.com/apis/accounts/docs/OpenID.html). –  El Yobo Nov 6 '11 at 12:32
    
This is correct. If you had linked your Google account with Facebook, they can verify your GMail address (with immediate OpenID sign-in process, w/o any UI). After that there is no point to ask you to verify password change through verification code sent to e-mail, etc. –  timdream Nov 8 '11 at 3:17
add comment

Have you looked at your Google account to see if you gave Facebook permission to access your Google information?

share|improve this answer
    
Where can one see that? –  ldigas Nov 6 '11 at 0:32
1  
@Idigas - AFAICT Dashboard shows it (google.com/dashboard) - near the top is 'Websites authorized to access the account' which takes me to accounts.google.com/IssuedAuthSubTokens –  James Manning Nov 6 '11 at 6:50
    
If you have a Google+ account, go directly here. –  Alex Nov 6 '11 at 11:19
add comment

It uses OpenID. If you've previously used OpenID to give Facebook access to your e-mail (such as to import your contacts to Facebook), then it'll try and do that. If you haven't done so, then you'd be presented with a prompt to give Facebook access (if you say no, then just go and actually wait for the password reset e-mail to get delivered to you).

share|improve this answer
add comment

In Account Settings, there's a "Linked Accounts" section where you can have Facebook automatically log in if you're logged in to one of your OpenID-enabled accounts on other sites. Maybe you forgot that you linked your Gmail account?

share|improve this answer
    
Nope it's not that unfortunately. I tried it myself removing all linked accounts. The event above still happens. –  phwd Nov 5 '11 at 23:12
add comment

This isn't the case. As mentioned, the only site that can access GMail cookies is GMail. I have just tested this exact method and (having never authorised before) the popup took me to a page on the accounts.google.com sub-domain asking me to authorise access for Facebook. This is exactly what I would expect and hope to happen.

It would appear the OP has previously authorised such an action, maybe through Google Buzz or similar?

share|improve this answer
add comment

protected by Community Nov 6 '11 at 9:27

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.