Facebook Says Hackers Stole Detailed Personal Data from 14M People

Post by staticautomatic » Fri, Oct 12, 2018, 11:00 PM UTC

coliveira wrote: post #128

philsnow wrote: post #102

Earlier quoted context omitted.

Everybody should timestamp all articles. People don't want to because they want their content to be "evergreen" and they think that if there's a date that's more than a year or so old, people will disregard / discount the content. So by default many blog CMSs default to not showing the date of any articles.

Facebook is not a small blog operator. They should view this as a professional communications medium.

Post by spike021 » Fri, Oct 12, 2018, 11:04 PM UTC

jjeaff wrote: post #90

spike021 wrote: post #69

Earlier quoted context omitted.

Well, let's see. A feature used to view profile information had a vulnerability that allowed an attacker to get my phone number. My phone number isn't even listed on my profile. This means the credentials from the original implementation of said feature weren't locked down to only data available from your viewable profile. While my phone number may be available elsewhere outside of FB, I only have it tied to my accou…

The vulnerability allowed the attacker to obtain an access token for your site. So with that access token, they presumably had full access to everything as if they were you. Hence their ability to get a phone number not listed. I'm not sure if the web interface uses those same access tokens, but the mobile app probably does. So they were probably able to access everything using unpublished API endpoints that the mobi…

Post by Silhouette » Fri, Oct 12, 2018, 11:21 PM UTC

bargl wrote: post #6

This is why I hate not having custom security questions from Banks. What is my fathers middle name? Well, if you have facebook and he puts it up there you can find out. I have no control over that. I could start using fake answers but trying to remember the fake answers vs real answers is tough. Whereas when I get a custom question I have a custom answer that I will always remember. Such as made up on the spot Name o…

Post by AsyncNoTimeout » Fri, Oct 12, 2018, 11:50 PM UTC

nyokodo wrote: post #114

A downside to having deleted my facebook account before this security breach was reported is that I cannot find out if my data was compromised.

Post by lsmarigo » Sat, Oct 13, 2018, 12:05 AM UTC

alain94040 wrote: post #147

propman wrote: post #145

If I type my full name on google, I can find my home and cell phone number, age, all family members, home address, my last home address, and my google + (fb and LinkedIn I changed settings so not searchable). And it’s a pain to ask them to delete the info. It’s obscure and time consuming and no guarantees. That in my mind is worse than anything here. I didn’t allow that info to be public, we need more privacy laws.

Sounds like a startup opportunity. For only $5, we'll file take down notices left and right for all the info that is available online about you.