Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook Asking for Some New Users' Email Passwords

thedailybeast.com

Post reply on HN
Print view View original

231–240 of 377 posts

Re: Facebook Asking for Some New Users' Email Passwords

#231

Post by icebraining »

fareesh wrote: post #226
icebraining wrote: post #208

Earlier quoted context omitted.

In theory, the password doesn't have to be stored at all. I bet it's kept in some sort of job queue, so it might be stored in disk (e.g. Redis AOF), but even that could be avoided. Still, one has to wonder why do it at all, considering the simple alternative of sending a verification email, which was already implemented.

Isn't the motive to get the user's contact lists? If there's an error isn't there a chance that the password leaks out into an error log somewhere?

> Isn't the motive to get the user's contact lists?

Probably, yeah.

> If there's an error isn't there a chance that the password leaks out into an error log somewhere?

Sure; there are ways of avoiding that, but who knows what they did.

Re: Facebook Asking for Some New Users' Email Passwords

#232

Post by hopler »

TeMPOraL wrote: post #91
billdybas wrote: post #47

Earlier quoted context omitted.

Sure, but is that not what an online password manager is? :P

If the on-line component goes anywhere beyond the ability to sync an opaque binary blob that only your local machines can decrypt and reencrypt, there's a problem there.

How does my secret key get from my phone to my tablet?

Re: Facebook Asking for Some New Users' Email Passwords

#233

Post by doubletgl »

dvfjsdhgfv wrote: post #178
robteix wrote: post #176

Earlier quoted context omitted.

I mostly agree but don’t underestimate the effect that drinking the kool-aid can have on your ability to tell if something is wrong or not. I’ve worked in these megacorps and I understand how easy is to believe everything they do is awesome. “We’re just doing it to make it easier for our users” or “we’re Facebook, we know how to securely handle their passwords” It’s very easy to _believe_ these things when you’re in…

But frankly, when you think about it, the only amazing thing about FB is how it got popular, that's all. As for the user experience it's very far from amazing, in spite of all the tech used. It's slow, and on mobile not only slow but also resource hungry, it has several glitches, plus there is a ton of things that annoy users. Now, I can understands that someone working for SpaceX can think they're all amazing, but i…

React and other JS projects gave them a largely positive reputation as tech employer in that field.

Re: Facebook Asking for Some New Users' Email Passwords

#234

Post by propogandist »

ramraj07 wrote: post #222
nemothekid wrote: post #22

Earlier quoted context omitted.

Mint legitmatized that authorization flow years before Plaid came around and the banks decided that was the best way to move forward instead of adopting something like an oauth2 flow.

I use mint even now. I'm generally technically paranoid, and have just concluded mint is not actually that risky. Here's why: 1. Most banking companies seem to have a much better security landscape than other places, including tracking where you're logging in from. Even with a password it won't be easy for a hacker to do stuff with my accounts. Almost any change or transaction triggers an email and sms alert too. 2.…

Mints privacy policy includes this language "we may prepare and share information about our customers with third parties, such as advertisers or partners, for research, academic, marketing and/or promotional purposes." - where any usage of "may" can be substituted with "will".

They say they will anonymize data, but advertisers have no interest in data if they can't action on it -- i.e. use the data they buy for targeted advertising.

Re: Facebook Asking for Some New Users' Email Passwords

#235

Post by luckylion »

bhnmmhmd wrote: post #174
sqldba wrote: post #161

Earlier quoted context omitted.

Top tech talent generally have no idea how businesses make money. So of course you’d ignore them.

This. I studied Electrical Engineering and in my experience, the only thing my classmates cared about was the technical aspects of the field, and often they couldn't see the big picture. Great talents of course, but more like robots, not even capable of understanding the humanitarian aspects of life. Such a waste. Disclaimer: It's just my experience, not necessarily true for all engineers and engineering schools.

That's one part of it, I'm sure. Another part is that if you pipe up, you risk getting shunned: loss of income, loss of status, loss of being "part of the cool kids". Sure, you can get another job (that pays less) but you'll probably not work at the same cutting edge technology, and when you tell relatives or friends who you work for, their eyes don't light up.

If somebody offered me five to eight times as much as I make today with a huge boost in status and other positive side effects, and all they ask is to quiet down those silly principles, I'm not so sure I'd say no. "You can still do good in 5 years when you've made enough money to be set for life", I'd probably tell myself.

Re: Facebook Asking for Some New Users' Email Passwords

#236

Post by netwanderer3 »

kyle-rb wrote: post #67

I just don't understand how this gets implemented without someone speaking up and saying "hey, wait, isn't this an insane thing to do?". I would guess it's some combination of the complainers being ignored, and people at a higher level thinking "well we're doing this in a secure way, as long as the user trusts us, and why wouldn't they trust us, we're Facebook!".

I would love to take a peak into the meeting where they formulated this idea.

With all the shit being fired at Facebook from all directions these days, I just want to see the faces and reactions of those who thought "Yep, that's a good idea!" when this concept was originally brought up. It's really stretching my curiosity and imagination to the point where I start wondering what type of people they are hiring at Facebook these days.

Is there a name for this phenomenal in psychology where one would insist on doing the exact same things other people are criticizing them, but with an increasingly higher intensity the more they get criticized for it? This is exactly what it is.

Re: Facebook Asking for Some New Users' Email Passwords

#237

Post by nathan_long »

hn_throwaway_99 wrote: post #18

All of these types of "hey, give us your password to this other system" are just training users to get phished. IMO the worst offender in this is Plaid, which has created a service where millions of people are giving their banking credentials so some random startup can mine your transaction data. And people think FB has privacy implications...

Arguably, giving up your email login is worse than giving up your banking login, since attackers could use your email to reset the password on other accounts, possibly including bank accounts.

For banking, a better system would allow you to generate some kind of token in your banking site which would allow the kinds of permissions you want to grant to a third party, and which you could unilaterally revoke at any time.

Re: Facebook Asking for Some New Users' Email Passwords

#238

Post by jobigoud »

emilsedgh wrote: post #123

I think Facebook is very desperate and they don't seem to have a choice. You see, Facebook has Facebook.com, Instagram and Whatsapp. Facebook.com has already reached it's peak and is not going to grow. Instagram is likely to have the same trajectory as Facebook.com and Whatsapp is not making them money anyways. They failed to get into any new market or come up with any decent product. And they are supposed to compete…

Don't forget Oculus. Facebook has a big foot in VR for better or worse.

Re: Facebook Asking for Some New Users' Email Passwords

#239

Post by TheRealDunkirk »

leCapitalist wrote: post #82
kyle-rb wrote: post #67

I just don't understand how this gets implemented without someone speaking up and saying "hey, wait, isn't this an insane thing to do?". I would guess it's some combination of the complainers being ignored, and people at a higher level thinking "well we're doing this in a secure way, as long as the user trusts us, and why wouldn't they trust us, we're Facebook!".

Easy. The engineers who built it care mostly about their total compensation and getting promoted. They therefore gleefully implement the product requirements. The PMs behind the idea also care about the above, except they are held to account by business objectives. By narrowly optimizing for a particular objective (reducing account fraud) in an unprincipled manner, they come up with an insane feature idea like this.…

> Welcome to life at a big tech company.

Most of this is, as you've correctly spelled out, just due to perverse incentives, and there's not really any intentional malfeasance. The REAL problems start when you get a neurotic psychopath with a modicum of power, and an agenda to climb the ladder, who pushes through ideas they KNOW are bad for the company, as a whole, in the long run, but do so anyway because they know it will help their career in the short run. I've been powerless to try to stop this from happening at two Fortune 250's.

Re: Facebook Asking for Some New Users' Email Passwords

#240

Post by matwood »

CalRobert wrote: post #219
matwood wrote: post #210

Earlier quoted context omitted.

This is why control > salary for me. I would much rather (and do) work at a smaller company making less money, but where I have real input in the company itself. We routinely have clients ask for more tracking data on users and we explain/teach why it is a bad idea. In some way these FB stories help me, because I can point to these articles and ask 'do you want to end up associated with this ?'

That's great when you have the ability to forego potential salary. It's also why manufactured scarcity (especially in housing) enables people who wish to apply engineering effort in unethical ways. If 10 engineers are bidding on 5 houses, the 5 highest-paid ones will get it. Any pay raise they get will get dumped in to their house - give them all 100k raises and the house will go up by whatever another 100k a year in…

First, no one is talking about getting paid incredibly less (especially if you factor in COLA). It's more generally about not maximizing for only salary. Second, unless you want to work in one of the big companies, why work where it is only engineers bidding on houses? Engineers have the luxury right now of taking less pay and still making much more than a large majority of the population.
Post reply on HN