Facebook Network Breach Impacts Up to 50M Users

Post by Mahn » Sat, Sep 29, 2018, 1:20 AM UTC

pq0ak2nnd wrote: post #384

chronid wrote: post #253

Earlier quoted context omitted.

So is working at Google, Amazon and probably 90% of the big corps of the world in many sectors - from oil to finance to pharmaceutical to telecommunications and so on. And we can include the government. If you're a subcontrator or sold in body rental (modern IT slavery) you're also in the same position as an employee, so you're enabling their evils. Also, if one of those companies is a client of your company you're a…

Is it really that bad being a software/hardware engineer in Europe? I was thinking of entering via Holland (easiest work rights) and then after a few years try to work in France or Italy where it is almost impossible to fire someone, so I could retire on the job.

Post by everdev » Sat, Sep 29, 2018, 1:42 AM UTC

romed wrote: post #503

herpderperator wrote: post #415

Excerpts from the press call transcript [1] by Guy Rosen explaining what lead to this breach being possible: > The first bug was that, when using the View As function to look at your profile as another person would, the video uploader shouldn’t have actually shown up at all. But in a very specific case, on certain types of posts that are encouraging people to post happy birthday greetings, it did show up. > The secon…

That doesn't just seem like a few unlucky coincidences. That seems like a fundamentally unsound design. Why should it even be theoretically possible for a request under the authority of one user to create a token with the authority of another user?

Post by dwighttk » Sat, Sep 29, 2018, 1:49 AM UTC

Post by DickVanDyke » Sat, Sep 29, 2018, 2:01 AM UTC

Post by xianb » Sat, Sep 29, 2018, 2:10 AM UTC

rajathagasthya wrote: post #68

throwawaymath wrote: post #31

Earlier quoted context omitted.

It's very easy for me to believe. "View As" is an authorization and authentication sensitive, limited user impersonation feature. Video uploading interacts with, and complicates, authorization in an application with fine grained privacy and permission models. It's intuitively straightforward that modifying code for uploading videos could (read: not should) have authorization and authentication ramifications. One of t…

> It's intuitively straightforward that modifying code for uploading videos could (read: not should) have authorization and authentication ramifications. I get this part. But why would it affect only videos and not other entities (photos, status etc.)? I would think creating (or uploading) any of the entities have the same authorization and authentication ramifications. What could be different for videos? Unless the…