Facebook Learns The Downside To Making Logins Easy

Mobile communications in general—and M-Commerce in particular—are predicated on promises of speed and convenience. But that tends to run counter to robust security so therein lies the inherent conflict between mobile and security.

Meanwhile, Facebook stands as the leader of social networks and those networks also are based on convenience. Our tale today involves a recent problem that Facebook experienced, where registered users logged in to the social site and saw the personal contacts and messages of other users instead of their own. But the glitch only happened when users were coming in through AT&T.

The site Arstechnica had a fascinating and well done look at the issue. “The problem was quickly attributed to “misrouting,” a term that suggests that information took a wrong turn somewhere in the network. It’s not completely impossible for individual packets flying across the network to be misdelivered—although there are multiple checksums protecting against that—but misdelivered packets will be uninvited guests at the destination computer, and thus thrown away,” the story said. “What apparently happened here was an unfortunate interaction of some kind between Facebook’s user authentication system and the way AT&T runs its mobile data network.”

Part of the problem, the story argued, is that almost no sites out there bother to use the Web’s built-in authentications mechanisms, preferring to craft their own. The most popular homegrown approaches involve caching, whether that involves caching entire pages (and gating delivery of those pages through a cookie) or using proxy cookies.

“WAP, a protocol that was used to create a Web-like experience for phones not capable enough to show the real Web, doesn’t support cookies. This makes life hard, so proxies that let WAP clients talk to Web servers often implement “proxy cookies,” where the proxy stores the cookies on behalf of the client. However, in that case it’s essential that the proxy knows which user it’s proxying for at any given moment, otherwise it sends the wrong cookie to the server and the user is logged in as someone else,” the story said. “Apparently Facebook, like many other sites, doesn’t think the information tied to a user’s account is important enough to protect with something stronger than a clear text cookie. Encrypting all sessions would solve these problems: passwords and cookies can’t be intercepted and proxies can’t get to the data.

Personally, I like the way Amazon handles this situation. When I arrive at Amazon.com, they recognize me and spam their recommendations at me, but when I actually want to order something I’m redirected to the encrypted site and I have to type my password. Also, Amazon explicitly recognizes that it may have mis-recognized me and offers a link to solve the problem.”

Facebook isn’t alone. This is similar to a problem that Sears experienced last summer, when some users gamed the site and used cached pages to create an area selling a “body parts roaster.”

Both sites tried to take security shortcuts, all in the name of speed and convenience. They momentarily forgot that the Web is overflowing with people just looking for a small crack to crawl through.

The use of cache to accelerate page display is fine, on its own. But to rely on it for primary authentication is asking for trouble. Mobile, however, makes such corner-cutting quite tempting. How many logons will a mobile user, shuffling for space among other packed-in commuters, tolerate? To make new mobile connections attractive, moving to a faster cache-based system is hard to resist.

But resist it chains must or they’ll start learning that cache could easily cost them a lot of cash.

Evan Schuman is a guest blogger on the McAfee Security Insights blog. Evan is the founder and Editor-in-Chief of StorefrontBacktalk.com, a global site that tracks retail IT and E-Commerce issues for readers. He also writes the weekly Retail Realities column for CBSNews.com. More on Evan can be read on his author page.

Tags: Data Protection, facebook, passwords, Risk and Compliance