What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 130 Stack Exchange communities.

I just asked my first question on Stack Overflow. In that process I typed in my e-mail and a name. All well and good, because I figured it would be nice to be able to log in later, I decided to register using my Facebook account. So, I clicked on the Facebook button, and then agreed to let this site access my public data. All was fine with that, too.

Except that I was never asked to actually confirm that I am the owner of that Facebook account. I was never asked to type in my password, Facebook has yet to send me an e-mail telling me that I've logged in from a different site/client like it usually does, and now I can apparently log in here by simply clicking the "log in" link. No password was ever asked for, so I'm left concluding that anyone who knows my e-mail could have signed me up, and could log in for me and pretend to be me.

What is going on?

share|improve this question
4  
Were you already logged in into Facebook? –  Pëkka Feb 7 '11 at 15:29

2 Answers 2

up vote 3 down vote accepted

At some stage you logged into Facebook with a password. The OpenId concept is that you're using that authentication here.

That is, Facebook won't let me appear as you without me knowing your Facebook password, so I'd have no way to use OpenId to log in to SO as you.

share|improve this answer
    
Ah, yes I was in fact logged in already on facebook. I guess that should have been obvious, but it just freaked me out that it didn't ask for a password at all on a different site. Thanks for clearing that up. –  MCXXIII Feb 7 '11 at 15:37

Facebook itself is the one who tells us "yes, this is the same person". When you click that link, you get redirected to Facebook, which in turn a) knows it's you, because you're logged in to FB, and b) knows that you're okay with Facebook telling us that it's you (because you previously allowed this).

We just believe what Facebook tells us; it's their responsibility to confirm your identity.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .