<http://schema.org/articleBody>
"  The spring of online security holes continues. Just in case you didn&amp;#039;t get your fill of Heartbleed and the ongoing woes of Internet Explorer, there&amp;#039;s a new security weakness making waves today: a vulnerability in the login tools OAuth and OpenID. If you&amp;#039;re ever seen registered for a web service and it offered you the opportunity to log in via Facebook, then you&amp;#039;ve seen OAuth at work. OAuth and OpenID are both open standards that provide a secure way to log into a third-party website with your credentials from a site such as Facebook or Twitter. According to CNET, a Ph. D. from Singapore named Wang Jing identified the weakness, which would allow an attacker to launch a covert redirect. Basically, a popup that looks real and has the proper URL would ask a user to authorize an app via their Facebook or other account. Approving that request would grant the attacker access to personal info or allow them to redirect you to a malicious website. CNET says Wang told Facebook about the weakness, but the tech giant replied that fixing the problem &amp;quot;can&amp;#039;t be accomplished in the short term.&amp;quot; He also contacted sites including Google, LinkedIn, and PayPal, all of which use OAuth and OpenID. The only sure way to stop these attacks would be for all the third-party apps to use a whitelist (in which only pre-approved software/files/apps are allowed), he says, which might be prohibitively expensive. These flaws aren&amp;#039;t as dangerous as Heartbleed for the simple reason that users can close the popup immediately and snuff out the danger. (Also, as Mashable points out, some of the tech giants already knew about the weakness.) But the vulnerability is so broad that it might be much harder to close off for good. So be smart out there. "^^<http://www.w3.org/2001/XMLSchema#string>
<http://www.popularmechanics.com/technology/security/a10530/another-depressingly-huge-online-security-hole-16754426/>