[sct202]

I'm pretty sure they logged out more than <5% (90m of 2B) of their users, because of the people I talk to on a daily basis on Messenger like well over 2/3s got logged out. I could see if they meant 90m of American users or something.

[freddie_mercury]

I don't think you understand how big the world outside of the US. They could logout 50% of all Americans and it amounts to 5% of Facebook. How many people in other countries have you spoken to before drawing your conclusion?

[303space]

Also if the tokens can be used for 3rd party “Sign in through Facebook” authentication this just compromised millions of people’s entire digital identities for everything from dating sites to financial logins.

[SmellyGeekBoy]

They can, and this is why I completely disabled that feature a while back.

[CWuestefeld]

I was logged out twice, once in the morning and again in the evening - I came back to this discussion to see if there was some explanation.

(No, it's not that it was just two devices - I had to log in four times just on my phone. Once for Messenger, once for FB itself; during each occurrence.)

[arnaudsm]

Why the downvotes ? This is important data, and no one gave this information in the whole thread.

[nkozyra]

Probably because it's entirely anecdotal and attempts to extrapolate from such a small sample size.

[azernik]

It's more a problem of a biased sample than a small sample - this attack spread through the friend network, and so if one of your Facebook friends is in the attacked/vulnerable group then other ones are also likely to be.

[nkozyra]

Sure, but that's very different than the logical problem I'm talking about.

[ericd]

Because his friend group is not a random sampling.