Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook Network Breach Impacts Up to 50M Users

nytimes.com

Post reply on HN
Print view View original

581–590 of 635 posts

Re: Facebook Network Breach Impacts Up to 50M Users

#581

Post by aaaaaaaaaab »

bitL wrote: post #138
asveikau wrote: post #124

Earlier quoted context omitted.

>> you need to get promoted in 22 months ... or you will have to leave > What, exactly, is wrong with the expectation that people make senior level eventually? The problem is when you base too much on promotion systems and performance reviews, that end up as a form of bias and favoritism not closely approximating the truth. Some amount of people are doing useful work for you (like cleaning up after people you think a…

> you risk losing their valuable contributions. Modus operandi in these companies is to rewrite/reintroduce whole products instead of fixing bugs from already discarded people. So if you lose a critical amount of worn out higher paid contributors, you just make a V2 or introduce a new product with a completely new fresh team that will get discarded after another 3 years. This requires fresh supply of motivated and hu…

So that’s why Google is “reinventing” their chat every 2 years!

Re: Facebook Network Breach Impacts Up to 50M Users

#582

Post by DCoder »

genzoman wrote: post #190

Until they can provide some data that say the 50 million number is a fact, I don't believe it's that low. Every breach starts out on the low end, and miraculously ends up being double or triple as they do "more research" and the initial anger dies down.

Hofstadter's Law, data breach edition: the breach's always worse than you think it is, even after you factor in Hofstadter's Law.

Re: Facebook Network Breach Impacts Up to 50M Users

#583

Post by red_admiral »

why_only_15 wrote: post #489
lurker456 wrote: post #389

Earlier quoted context omitted.

If your password is leaked, then you can still reset it. If your fingerprint signature leaks, you're out of options.

Burn your fingers!

This may be an urban legend, but I've heard there was once a bank robber who dipped his fingertips in acid. After a few months, his fingers healed, and the prints were exactly the same as before.

Re: Facebook Network Breach Impacts Up to 50M Users

#584

Post by SmellyGeekBoy »

303space wrote: post #567
sct202 wrote: post #434

Earlier quoted context omitted.

I'm pretty sure they logged out more than <5% (90m of 2B) of their users, because of the people I talk to on a daily basis on Messenger like well over 2/3s got logged out. I could see if they meant 90m of American users or something.

Also if the tokens can be used for 3rd party “Sign in through Facebook” authentication this just compromised millions of people’s entire digital identities for everything from dating sites to financial logins.

They can, and this is why I completely disabled that feature a while back.

Re: Facebook Network Breach Impacts Up to 50M Users

#586

Post by marvin »

sizzle wrote: post #560
rblatz wrote: post #550

Earlier quoted context omitted.

Technical debt, multiple systems using multiple old authentication routines getting slowly upgraded to new auth methods. And no one taking the time to fully understand the ramifications. And honestly it seems like that was the right choice for the teams responsible. They all made tons of money delivered features and now years later a bug is found.

Would you feel the same way if this vulnerability was for, say, a major banking website?

I work for a major (by Norwegian standards) bank. This level of authentication integration trickery wouldn't be attempted by us. Mainly because we try hard to avoid serious technical debt (due to timeline/delivery pressure) in our security infrastructure. We occasionally take such shortcuts in places that are not mission-critical, but they are always considered carefully as the tradeoff that they are. I believe that we are considerably better at technology development than most of the banks in the US.

That said, I've heard stories of similar bugs in the industry. The difference was that they were more shallow in the effort to reproduce; deep enough to get through QA but discovered quickly in production.

But honestly, Facebook has more resources to spend on security than any online bank. Banking security should be defense-in-depth: Strong first layer security, serious monitoring of suspicious activity & openness for reports by users, a certain level of manual approval of irrevocable transfers, a certain revocability of transfers that are able to be automatically processed, transfer size limits to deny one breach to have huge consequences.

And finally, a credible economic and legal system that ensures only a tiny minority of people want to rob a bank because there are much better options for making money, and banking regulations that leave the responsibility for security vulnerabilities squarely with the bank's shareholders.

Anyone can be owned with enough effort, so it's not just about creating software that's as secure as you can make it. You need to have sound policies as well.

Re: Facebook Network Breach Impacts Up to 50M Users

#587

Post by SmellyGeekBoy »

red_admiral wrote: post #32

I find facebook's effects on privacy and democracy as scary as the next person, but so far their secure coding standards have been extremely high. They're one of the few big names NOT on haveibeenpwned.com, they run their passwords through a KDF and then encrypt the result with a hardware security module, and a whole lot of other good things. I guess even the best (at secure coding) sometimes mess up.

The fact that passwords have never been leaked is irrelevant when a hacker can just get hold of the access tokens!

Re: Facebook Network Breach Impacts Up to 50M Users

#588

Post by koko775 »

ern wrote: post #491
red_admiral wrote: post #32

I find facebook's effects on privacy and democracy as scary as the next person, but so far their secure coding standards have been extremely high. They're one of the few big names NOT on haveibeenpwned.com, they run their passwords through a KDF and then encrypt the result with a hardware security module, and a whole lot of other good things. I guess even the best (at secure coding) sometimes mess up.

They're one of the few big names NOT on haveibeenpwned.com Have Amazon, Google, Twitter, Microsoft or Apple been on haveibeenpwned? That’s what I think of when I hear “big names”.

MS yes, via LinkedIn (at least)

Re: Facebook Network Breach Impacts Up to 50M Users

#589

Post by freddie_mercury »

sct202 wrote: post #434
genzoman wrote: post #190

Until they can provide some data that say the 50 million number is a fact, I don't believe it's that low. Every breach starts out on the low end, and miraculously ends up being double or triple as they do "more research" and the initial anger dies down.

I'm pretty sure they logged out more than <5% (90m of 2B) of their users, because of the people I talk to on a daily basis on Messenger like well over 2/3s got logged out. I could see if they meant 90m of American users or something.

I don't think you understand how big the world outside of the US. They could logout 50% of all Americans and it amounts to 5% of Facebook. How many people in other countries have you spoken to before drawing your conclusion?

Re: Facebook Network Breach Impacts Up to 50M Users

#590

Post by groestl »

badminton1 wrote: post #523
herpderperator wrote: post #415

Excerpts from the press call transcript [1] by Guy Rosen explaining what lead to this breach being possible: > The first bug was that, when using the View As function to look at your profile as another person would, the video uploader shouldn’t have actually shown up at all. But in a very specific case, on certain types of posts that are encouraging people to post happy birthday greetings, it did show up. > The secon…

The "View as" feature has been the source of many security vulnerabilities. There was a time where you could read other peoples' chats using this feature.

When designing such a system, the immediate failure mode is obvious: at some point, someone will read data not meant for them.

As every feature on FB needs to take "View as" into account when handling their own permissions, a lot of developers on FB's payroll get a chance to f'up. We are all humans, so the probability of this happening is very high. The impact (for the users) is also high, given that it's automated and concerns every user on FB equally.

When dealing with a very probable, high impact risk in a software project, considerable additional effort is warranted to mitigate that risk: in this case maybe taint checking and additional implementations of the same feature in different programming paradigms, to ensure the system is fail-stop.

But in contrast to airlines and railways, the interests of FB and their users are not aligned. For Facebook, this risk is not (or was not deemed to be of) high impact, so we did't get any of this.

Post reply on HN