Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook Network Breach Impacts Up to 50M Users

nytimes.com

Post reply on HN
Print view View original

541–550 of 635 posts

Re: Facebook Network Breach Impacts Up to 50M Users

#541

Post by branchless »

devindotcom wrote: post #403
Angostura wrote: post #284

Earlier quoted context omitted.

I very very much doubt the NYT would have agreed to an embargo on a story like this. It's a major news story, not the launch of a new car.

Since you're just getting downvoted, I may as well say that as a member of the press it isn't uncommon to see embargoes on stuff like this. They don't say a week out "hey we've got a huge security announcement" but they do say "we have something coming out this afternoon and we're doing a briefing half an hour before if you agree not to publish before we go public." It's often in the interest of the reporter to agree…

How many press members do you think see this open ticket for insider trading as a bonus worth keeping by keeping on the right side of these companies?

Re: Facebook Network Breach Impacts Up to 50M Users

#542

Post by plaidfuji »

yaseer wrote: post #198
prostoalex wrote: post #149

Earlier quoted context omitted.

> the long-term societal tradeoff of not developing addictive mental candy Along with React, GraphQL and a bunch of other technologies with various degrees of popularity https://opensource.fb.com Along with various startups building around the projects incubated at Facebook - Asana, Interana, Phacility, Qubole, etc.

React + GraphQL Where B is the sum of the set consisting of: -Breaking democracy in the US and the UK by being _the_ platform for disinformation. -Disinformation assisting genocide in Myanmar. -Use correlating strongly with poor mental health -Manipulating behaviour to encourage poor attention spans for the sake of ad-clicking -Constantly violating basic standards of privacy -(I could go on..) Oh wait, excuse my arit…

I think the sadder part of this argument is that nobody outside of software engineers know or care what GraphQL is, yet it’s being touted as a “societal benefit”. How about the fact that my grandma with limited mobility can still attend church virtually through the Live feature? Regardless of how often the scions of the Valley disavow their own technology (I would /never/ let my children use our products!), there are a billion or so other people who actually use it to real benefit in their quaint little lives.

Re: Facebook Network Breach Impacts Up to 50M Users

#543

Post by askmike »

teagee wrote: post #72
testplzignore wrote: post #53

Fun fact: https://newsroom.fb.com/news/2018/09/security-update/ was published at 16:42:44. https://www.nytimes.com/2018/09/28/technology/facebook-hack-... was published at 16:45:41. NYT writes fast :)

...and posted on HN ~16:47

Posting a link to HN takes 10 seconds. Writing a news article doens't.

Re: Facebook Network Breach Impacts Up to 50M Users

#544

Post by nautilus12 »

bigiain wrote: post #540
flgr wrote: post #507

Earlier quoted context omitted.

Notably, they previously had issues were "View as" allowed you to view notifications and messages of the user you were viewing as. If they'd done a proper post mortem and corrected the fundamental issue, and made sure it wouldn't have re-occured, this should not have happened.

Instead they moved fast and broke things.

Its more important for you to move fast and break things and make us money than to move slow and do things the right way. The life of an engineer...Do it now! why did you do it that way!? Now we are screwed??

Re: Facebook Network Breach Impacts Up to 50M Users

#545

Post by ransom1538 »

erichurkman wrote: post #7
sdwisely wrote: post #4

Earlier quoted context omitted.

> But it’s clear that attackers exploited a vulnerability in Facebook’s code that impacted “View As”, a feature that lets people see what their own profile looks like to someone else. This allowed them to steal Facebook access tokens which they could then use to take over people’s accounts oh boy, what a mess.

User impersonation code always terrifies the bajeebus out of me.

if ( loggedin_user() ) { }.... oh shit wait, since it is viewAs it's not that it's current_user() oops.

Re: Facebook Network Breach Impacts Up to 50M Users

#546

Post by gboudrias »

herpderperator wrote: post #415

Excerpts from the press call transcript [1] by Guy Rosen explaining what lead to this breach being possible: > The first bug was that, when using the View As function to look at your profile as another person would, the video uploader shouldn’t have actually shown up at all. But in a very specific case, on certain types of posts that are encouraging people to post happy birthday greetings, it did show up. > The secon…

> The second bug was that this video uploader incorrectly used the single signon functionally, and it generated an access token that had the permissions of the Facebook mobile app. And that’s not the way the single sign-on functionality is intended to be used.

Is it just me or does this sound like an terrible idea in the first place? Guess we can't know for sure, but why would anything unrelated to authentication generate access tokens?

Re: Facebook Network Breach Impacts Up to 50M Users

#547

Post by chrdlu »

My girlfriend and I experienced a really weird bug in the past. We would see that Facebook said we were active in the middle of the night when we were definitely asleep. It didn't make too much sense then, but now its possible that those instances might have occurred due to someone else accessing our accounts? Both of our accounts were logged out.

Did anyone else experience anything like that?

Re: Facebook Network Breach Impacts Up to 50M Users

#548

Post by apatters »

herpderperator wrote: post #415

Excerpts from the press call transcript [1] by Guy Rosen explaining what lead to this breach being possible: > The first bug was that, when using the View As function to look at your profile as another person would, the video uploader shouldn’t have actually shown up at all. But in a very specific case, on certain types of posts that are encouraging people to post happy birthday greetings, it did show up. > The secon…

If you're more interested in tech discussion or maybe some subcultures, and less interested in food photos/anecdotes about babies, just join http://mastodon.social/ already.

Set your preferences to show posts of your native language only, start poking around the timelines, and follow people who post something interesting. Follow, boost, reply, it only takes a few days before you have plenty of interesting content in your feed.

There's zero chance on Mastodon that you'll get caught up in a gigantic data breach like this. Probably less chance you get caught up in any kind of breach -- it's too obscure to be a target, plus the code is open source so many eyes on it, etc.

And you'll enjoy these guaranteed benefits, as well:

- No longer subject to the most sophisticated data vacuuming adtech in the world

- If you get bored/annoyed you can just take a break from Mastodon because it doesn't own your life the way Facebook tries to

Re: Facebook Network Breach Impacts Up to 50M Users

#549

Post by cheeze »

apatters wrote: post #548
herpderperator wrote: post #415

Excerpts from the press call transcript [1] by Guy Rosen explaining what lead to this breach being possible: > The first bug was that, when using the View As function to look at your profile as another person would, the video uploader shouldn’t have actually shown up at all. But in a very specific case, on certain types of posts that are encouraging people to post happy birthday greetings, it did show up. > The secon…

If you're more interested in tech discussion or maybe some subcultures, and less interested in food photos/anecdotes about babies, just join http://mastodon.social/ already. Set your preferences to show posts of your native language only, start poking around the timelines, and follow people who post something interesting. Follow, boost, reply, it only takes a few days before you have plenty of interesting content in…

> Probably less chance you get caught up in any kind of breach -- it's too obscure to be a target, plus the code is open source so many eyes on it, etc.

Security through obscurity...

Open source != secure. I can guarantee that a hell of a lot more folks with a lot of security expertise have combed through the fb codebase than Mastodon.

Re: Facebook Network Breach Impacts Up to 50M Users

#550

Post by rblatz »

gboudrias wrote: post #546
herpderperator wrote: post #415

Excerpts from the press call transcript [1] by Guy Rosen explaining what lead to this breach being possible: > The first bug was that, when using the View As function to look at your profile as another person would, the video uploader shouldn’t have actually shown up at all. But in a very specific case, on certain types of posts that are encouraging people to post happy birthday greetings, it did show up. > The secon…

> The second bug was that this video uploader incorrectly used the single signon functionally, and it generated an access token that had the permissions of the Facebook mobile app. And that’s not the way the single sign-on functionality is intended to be used. Is it just me or does this sound like an terrible idea in the first place? Guess we can't know for sure, but why would anything unrelated to authentication gen…

Technical debt, multiple systems using multiple old authentication routines getting slowly upgraded to new auth methods. And no one taking the time to fully understand the ramifications. And honestly it seems like that was the right choice for the teams responsible. They all made tons of money delivered features and now years later a bug is found.
Post reply on HN