|
In light of the latest news I do know that session hijacking on unsecure networks is a possibility... Besides that(and weak passwords) What are the other means a hacker can use to get access to my facebook account(or similar web accounts)? What can I do to stop such hacker's motives ? How can I secure users on my website from facing similar fate? |
||||
|
Questions on Super User are expected to relate to computer software or computer hardware within the scope defined in the FAQ. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about closed questions here.
|
A flaw in Facebook's security could come from any of many directions, but most of those are out of your hands. Session hijacking via a Trojan horse on your machine, simple phishing, or password theft via a Trojan would also compromise your account. Finally, sharing passwords with any other sites means possibly giving those sites the keys to your account. Good virus protection catches 2/4, the third (phishing) is a matter of making sure you never enter your password into a site you haven't confirmed to be "facebook.com" (I'd suggest setting up automatic login via another service, for example, a Google account, thus avoiding typing in your password at all) Finally, not sharing passwords between sites is just common sense. In general, keep your wits about you, don't hand someone access to your account, and you're as safe as the safest facebook user can be. |
|||
|
|
From a website admin/developer's perspective, the easiest way is using a third-party Single-Sign-On provider like Facebook Connect (well, maybe not them) or, preferrably, the OpenID system, like StackExchange does. This has some important advantages, the most important of which:
The Wiki article I linked has some further discussion on the pros and cons. Also, to some, I might sound like I'm preaching the gospel of Jeff, but yeah, he has a point. |
|||
|
|
