Facebook Apps On Any Website: A Clever Move? Or a Security Nightmare?

["Paul Ferguson" <fergdawg () netzero net>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Well, given the amount of malicious JavaScript, malware, and other
possibilities to use Facebook (and other similar social networking
platforms) for abuse, I certainly wouldn't categorize this news:

http://www.techcrunch.com/2008/01/26/facebook-apps-on-any-website-clever-mo
ve/

...as a "clever move".

The announcement says, in part, that:

[snip]

...JavaScript client library allows you to make Facebook API calls from any
web site and makes it easy to create Ajax Facebook applications. Since the
library does not require any server-side code on your server, you can now
create a Facebook application that can be hosted on any web site that
serves static HTML. An application that uses this client library should be
registered as an iframe type. This applies to either iframe Facebook apps
that users access through the Facebook web site or apps that users access
directly on the app’s own web sites. Almost all Facebook APIs are
supported.

[snip]

ref:
http://developers.facebook.com/news.php?blog=1&story=73

In fact, I foresee this as an extraordinarily short-sighted move with
far-reaching security implications -- which will allow the levels of
malicious abuse to reach new heights.

In fact, minor annoyances such as this:

http://www.latimes.com/technology/la-ca-webscout27jan27,1,46127.story

...may become fond memories, as this new "feature" will allow
miscreants to create much more malicious functionality.

So, this is a forecast placeholder for me -- we'll have to look
back on my forecast at some point in the future to see if I'm
right, or not. :-)

More fun times ahead, methinks.

- - ferg

-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.3 (Build 3017)

wj8DBQFHnMXPq1pz9mNUZTMRAgMtAKCbor93vupeMzz6ReoJkPcwch0faACfTtJn
uRpXFqCa0U0YyJ1Bk4Fe3rc=
=84k4
-----END PGP SIGNATURE-----

--
"Fergie", a.k.a. Paul Ferguson
 Engineering Architecture for the Internet
 fergdawg(at)netzero.net
 ferg's tech blog: http://fergdawg.blogspot.com/


_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.