You didn't need the target's access token. Your own worked just fine. | Hacker News

Hacker News new | past | comments | ask | show | jobs | submit

login

geetee on Feb 12, 2015 | parent | context | favorite | on: Deleting any Facebook album

You didn't need the target's access token. Your own worked just fine.

murki on Feb 12, 2015 | [–]

Exactly, that in itself is the whole point of this being a security bug.

sleepyhead on Feb 13, 2015 | [–]

Woah, didn't catch that when I first skimmed through the article. $12,500 wasn't enough then.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact