Today I was playing with some web security, and there was a surprise when I decided to test the Forget the Password link on Facebook.

I chose to send the password reset code to my Gmail address, and right after that Facebook pops up with another window with a message telling that I don't have to worry about my password reset code as I am already logged into my Gmail account.

Already logged in

How can they do that?

I am guessing that it has something to do with the OpenID protocol, but shouldn't I have to allow it in order for Facebook to interact with my Gmail account?

  • * Can you confirm that this behaviour does not login if you log out of gmail? * Can you post screenshots when logged in/out of gmail? * Can you open Firebug/Chrome network inspector and post the entire traffic during this event? – Achille Nov 5 '11 at 23:31
  • 1
    I remember there was a trick using your Gmail pic: if it can be displayed, it means you're logged. See Google for more info. – seriousdev Nov 5 '11 at 23:48

The OAuth tokens for Google are at https://accounts.google.com/b/0/IssuedAuthSubTokens (it's different from Linked Accounts).

When I tried it, Facebook created a popup with a OAuth prompt the first time and only briefly opened a blank popup on subsequent attempts. De-authorizing Facebook makes the prompts appear again.

| improve this answer | |
  • 3
    This isn't OAuth, it's OpenID. – Yuliy Nov 6 '11 at 8:33
  • @Yuliy, pretty sure it's both, I ran a program that uses the Google Docs API, and remember that API uses oath. – gatoatigrado Nov 6 '11 at 8:47
  • Yes, google uses a hybrid oauth+openid procotol (see code.google.com/apis/accounts/docs/OpenID.html). – El Yobo Nov 6 '11 at 12:32
  • This is correct. If you had linked your Google account with Facebook, they can verify your GMail address (with immediate OpenID sign-in process, w/o any UI). After that there is no point to ask you to verify password change through verification code sent to e-mail, etc. – timdream Nov 8 '11 at 3:17

Have you looked at your Google account to see if you gave Facebook permission to access your Google information?

| improve this answer | |

It uses OpenID. If you've previously used OpenID to give Facebook access to your e-mail (such as to import your contacts to Facebook), then it'll try and do that. If you haven't done so, then you'd be presented with a prompt to give Facebook access (if you say no, then just go and actually wait for the password reset e-mail to get delivered to you).

| improve this answer | |

In Account Settings, there's a "Linked Accounts" section where you can have Facebook automatically log in if you're logged in to one of your OpenID-enabled accounts on other sites. Maybe you forgot that you linked your Gmail account?

| improve this answer | |
  • Nope it's not that unfortunately. I tried it myself removing all linked accounts. The event above still happens. – phwd Nov 5 '11 at 23:12

This isn't the case. As mentioned, the only site that can access GMail cookies is GMail. I have just tested this exact method and (having never authorised before) the popup took me to a page on the accounts.google.com sub-domain asking me to authorise access for Facebook. This is exactly what I would expect and hope to happen.

It would appear the OP has previously authorised such an action, maybe through Google Buzz or similar?

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.