Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook Network Breach Impacts Up to 50M Users

nytimes.com

Post reply on HN
Print view View original

51–60 of 635 posts

Re: Facebook Network Breach Impacts Up to 50M Users

#51

Post by modeless »

sdwisely wrote: post #4
dom96 wrote: post #2

Some more details here: https://newsroom.fb.com/news/2018/09/security-update/

> But it’s clear that attackers exploited a vulnerability in Facebook’s code that impacted “View As”, a feature that lets people see what their own profile looks like to someone else. This allowed them to steal Facebook access tokens which they could then use to take over people’s accounts oh boy, what a mess.

Isn't this the second time this feature has been exploited? I thought I remembered a similar issue from a while ago.

Re: Facebook Network Breach Impacts Up to 50M Users

#52

Post by make3 »

ummonk wrote: post #36
dawhizkid wrote: post #9

Is it wrong to be glad FB's reputation has tarnished (and stock price sideways) over the past year or so? For so long they've monopolized the talent pool in the Bay Area. If more people decide 1) they don't want to work at FB and 2) FB employees are itching to leave then I see any stain on FB's employment brand as a net positive to the greater tech + startup ecosystem.

How have they monopolized the talent pool? By paying their employees better than everyone else?

there is also prestige associated to big names like Facebook (and Google, Apple, etc)

Re: Facebook Network Breach Impacts Up to 50M Users

#54

Post by Alex3917 »

sdwisely wrote: post #4
dom96 wrote: post #2

Some more details here: https://newsroom.fb.com/news/2018/09/security-update/

> But it’s clear that attackers exploited a vulnerability in Facebook’s code that impacted “View As”, a feature that lets people see what their own profile looks like to someone else. This allowed them to steal Facebook access tokens which they could then use to take over people’s accounts oh boy, what a mess.

Stealing the access token is the worst possible attack, because it wouldn't get logged or lead to any sort of notification. If they were only able to steal the passwords, this would have gotten caught immediately.

Re: Facebook Network Breach Impacts Up to 50M Users

#55

Post by kidsnow »

teagee wrote: post #22
dawhizkid wrote: post #9

Is it wrong to be glad FB's reputation has tarnished (and stock price sideways) over the past year or so? For so long they've monopolized the talent pool in the Bay Area. If more people decide 1) they don't want to work at FB and 2) FB employees are itching to leave then I see any stain on FB's employment brand as a net positive to the greater tech + startup ecosystem.

Based on their privacy issues, influence scandal, etc. its scary to imagine what the company looks like without the best and brightest.

Same could be said for Google

Re: Facebook Network Breach Impacts Up to 50M Users

#56

Post by modeless »

IvyMike wrote: post #45

So here is a question: my girlfriend only uses FB on her laptop, and always logs out when she's done. I usually make fun of her for doing this. But does this mean most of the time that there was no active access token and she is mostly safe? (Excluding the windows of time where she was actively using FB) Do I have to take back all of my teasing?

I doubt it. The "View As" feature does not require the target to be currently logged in to Facebook AFAIK.

Re: Facebook Network Breach Impacts Up to 50M Users

#57

Post by Strongerpass »

enitihas wrote: post #50

Was everyone logged out automatically or only those who were affected? Is anyone here who wasn't logged out today?

I'm logged on on my phone and hane not seen any security notices in my feed. Have not been logged out.

Edit: Same on my PC. Still logged on.

Re: Facebook Network Breach Impacts Up to 50M Users

#58

Post by bonniemuffin »

enitihas wrote: post #50

Was everyone logged out automatically or only those who were affected? Is anyone here who wasn't logged out today?

I was still logged in. I just went and did the "log out all my active sessions" thing just for good measure, even though I didn't see anything unusual there.

Re: Facebook Network Breach Impacts Up to 50M Users

#59

Post by kidsnow »

IvyMike wrote: post #45

So here is a question: my girlfriend only uses FB on her laptop, and always logs out when she's done. I usually make fun of her for doing this. But does this mean most of the time that there was no active access token and she is mostly safe? (Excluding the windows of time where she was actively using FB) Do I have to take back all of my teasing?

Only if the act of logging out explicitly invalidates the token on the server side
Post reply on HN