Being an application security consultant, I see this stuff a lot unfortunately. Just takes a missing authorization check on the feature, then you got the keys to the kingdom.
Facebook Network Breach Impacts Up to 50M Users
91–100 of 635 posts
Re: Facebook Network Breach Impacts Up to 50M Users
#92Re: Facebook Network Breach Impacts Up to 50M Users
#93Recently talked to 2 friends working for fb. According to them, the culture there is very toxic. For a master's degree, once get in, you need to get promoted in 22 months (I might misremember the actual number.) or you will have to leave. Debugging is never counted as a real work, so for quick promotion, nobody wants to solve bugs unless a bug becomes too obvious. And they also complained about no work-life balance.…
What, exactly, is wrong with the expectation that people make senior level eventually? What exactly is wrong with being able to work at any time? I worked there for years, and if I was landing code at 12am, it was because I was excited about what I was doing. It was wonderful being able to work with people from all over the world on high-impact projects, and fixing important bugs was definitely high-impact. People wh…
What you call being "excited about working at 12am" I call "accepting being a corporate slave".
Re: Facebook Network Breach Impacts Up to 50M Users
#94On the one hand, every time another scandal or breach is revealed about centralized networks, I want to post this and have everyone recognize the root problem and the solution: https://Qbix.com (see the video) On the other hand, I feel like I’m shamelessly promoting/shilling my own company. How to do it in a classy way? I really believe that there is a problem people are not recognizing enough to do something about i…
Seeing as you asked... your website's terrible UX doesn't help. I just took a look and moved on within 30 seconds - a dated look and feel (that also feels targeted at primary school teachers), walls of text, broken links, no clear route back to the homepage to reorient yourself (can't click the logo), no clear waypoints to follow... You only get one chance to make a first impression. I'm afraid the first impression I…
In addition, the site isn't responsive, which is quite problematic considering that statistics show ~60% of web traffic is on mobile devices.
Re: Facebook Network Breach Impacts Up to 50M Users
#95What are some secure Facebook Messenger alternatives to use? The only reason I currently have Facebook is because of the ease behind Messenger but I do not want to continue using their services. I also need to be able to convince my friends to try a different platform since I want to be able to continue to communicate with them. Any advice?
Re: Facebook Network Breach Impacts Up to 50M Users
#96Earlier quoted context omitted.
It's very easy for me to believe. "View As" is an authorization and authentication sensitive, limited user impersonation feature. Video uploading interacts with, and complicates, authorization in an application with fine grained privacy and permission models. It's intuitively straightforward that modifying code for uploading videos could (read: not should) have authorization and authentication ramifications. One of t…
> It's intuitively straightforward that modifying code for uploading videos could (read: not should) have authorization and authentication ramifications. I get this part. But why would it affect only videos and not other entities (photos, status etc.)? I would think creating (or uploading) any of the entities have the same authorization and authentication ramifications. What could be different for videos? Unless the…
They said they introduced bug in video uploading part in 2017. All were Ok till then.
Re: Facebook Network Breach Impacts Up to 50M Users
#97Earlier quoted context omitted.
What, exactly, is wrong with the expectation that people make senior level eventually? What exactly is wrong with being able to work at any time? I worked there for years, and if I was landing code at 12am, it was because I was excited about what I was doing. It was wonderful being able to work with people from all over the world on high-impact projects, and fixing important bugs was definitely high-impact. People wh…
What you call being "excited about working at 12am" I call "accepting being a corporate slave".
I don't think you can so glibly dismiss enthusiasm as Stockholm syndrome. Passionate people push the world forward, and mocking passion is a recipe for mediocrity and stagnation.
Re: Facebook Network Breach Impacts Up to 50M Users
#98Earlier quoted context omitted.
Could have been any other mechanism on the site.
...but it wasn't. Which is the point, no?
Which is why the point doesn't make sense. The article says tokens were leaked. There are plenty other places where such bug could happen, so it shouldn't serve as a strong validation of "User impersonation code always terrifies the bajeebus out of me".
(Not to mention it's not really user impersonation, it's just filtering your profile page based on computed access level of one of your friends.)
Re: Facebook Network Breach Impacts Up to 50M Users
#992.23 billion active users, 50 million affected. ~2% of their user base. Wow, that's a lot of people affected, and somehow just a tiny sliver of their user base.
Re: Facebook Network Breach Impacts Up to 50M Users
#100Earlier quoted context omitted.
It is essential that tech companies, especially ones that provide critical infrastructure, place technical excellence above other priorities. Denigrating meritocracy is like pollution: the impact may not be immediate, and in the short term, it may look like you can have your cake and eat it too, but the universe is not caring and not kind, and if you forget about the need for excellence in the continual struggle agai…
Is Facebook now considered critical infrastructure?
According to some in the US government, Facebook can change the result of an election, so I guess that would qualify