But there’s a hitch there; the researchers learned that for backwards compatibility, Facebook identifies early adopters of a mobile app using the public user ID, therefore, if a user has signed into the app via OAuth before May, 2014, they’re still exposed to the attack.