Increase the bug bounty rewards for such things to depend on the scale so $1M-$10M bounty should be given. Otherwise face a reputation hit.
Facebook Says Hackers Stole Detailed Personal Data from 14M People
181–190 of 217 posts
Re: Facebook Says Hackers Stole Detailed Personal Data from 14M People
#182Earlier quoted context omitted.
PSA: Woah.wait. I just thought since personal data of about ~30 million people was leaked, most of them would be having Gmail accounts. So, isn't Gmail under threat too? I think GOOGLE should also issue an advisory asking people to change their security questions. Did I miss something?
Google has been actively trying to get people to stop using security questions in favour of various kinds of two-factor for quite some time now (mainly mobile phone number based stuff). They'll be fine.
I know, but many still might be using these questions right?
Re: Facebook Says Hackers Stole Detailed Personal Data from 14M People
#183I'm one of the unlucky 400,000 who had the most information stolen. Complete notification: Is my Facebook account impacted by this security issue? Yes. Based on what we've learned so far in our investigation, attackers accessed the following Facebook account information: * Name. * Primary email address. * Most recently added phone number. Additionally, the attackers also accessed other account information, including:…
> The 15 most recent searches you've entered into the Facebook search bar. I can see how the attacker can use this to blackmail somebody.
I don't. Can you provide an example or two?
Re: Facebook Says Hackers Stole Detailed Personal Data from 14M People
#184And after that they want to put a Facebook camera in your living room?
Re: Facebook Says Hackers Stole Detailed Personal Data from 14M People
#185what are the chances that a class lawsuit will follow? not an expert on this but haven't seen it mentioned yet on this discussion.
Re: Facebook Says Hackers Stole Detailed Personal Data from 14M People
#186Facebook posting: https://newsroom.fb.com/news/2018/10/update-on-security-issu... Check if you are affected here: https://www.facebook.com/help/securitynotice (posting because it took 10+ mins to find it - many media outlets are not linking directly to it)
FB should timestamp these articles. It happened a couple of weeks ago, or is this new news?
The first article has the date at the top: "October 12, 2018".
They might intend to repeatedly update the second one, which might be a reason not to put a published date on it.
Re: Facebook Says Hackers Stole Detailed Personal Data from 14M People
#187This is why I hate not having custom security questions from Banks. What is my fathers middle name? Well, if you have facebook and he puts it up there you can find out. I have no control over that. I could start using fake answers but trying to remember the fake answers vs real answers is tough. Whereas when I get a custom question I have a custom answer that I will always remember. Such as made up on the spot Name o…
How is this relevant? Hackers can steal recovery question answers regardless of whether web token vulnerabilities exist. And web token vulnerabilities can exist regardless of recovery question strategies.
Re: Facebook Says Hackers Stole Detailed Personal Data from 14M People
#188This is why I hate not having custom security questions from Banks. What is my fathers middle name? Well, if you have facebook and he puts it up there you can find out. I have no control over that. I could start using fake answers but trying to remember the fake answers vs real answers is tough. Whereas when I get a custom question I have a custom answer that I will always remember. Such as made up on the spot Name o…
What? No! Custom security questions result in stuff like:
“Am I blonde?”
“What’s my shoe size?”
“How old am I?”
“Do I have a dog?”
And of course, the answers to those are incredibly easy to guess / enumerate.
Re: Facebook Says Hackers Stole Detailed Personal Data from 14M People
#189If Facebook could go back in time and choose between: a) Paying out a $1m USD bug bounty, or b) Accepting the reputational hit from a successful exploit I wonder which they would choose with perfect hindsight? Facebook runs a great bug bounty program, but given Facebook's size, data footprint, and profitability, perhaps it's worth increasing the rewards.
If facebook offered a single $1m bug bounty, it would have likely gone to some other vulnerability besides this.
I would guess facebook gets a fair number of bug bounty reports of equal or greater severity than this one. Also in the past on HN when people argue that the payout of a bug bounty is too low, there have been comments saying web vulnerabilities are pretty much worthless on the black market.
https://news.ycombinator.com/item?id=9041017
Re: Facebook Says Hackers Stole Detailed Personal Data from 14M People
#190Earlier quoted context omitted.
I doubt other payment or ecommerce platforms are any more secure. Given its size, I assume Facebook has a lot of smart people working on security. And they still screw it up. How are smaller platforms, who can't attract or pay for the very best talent, going to do any better (other than by being smaller targets, I guess)?
> I assume Facebook has a lot of smart people working on security. I am not willing to roll the dice on that assumption.
[deleted]