Building Facebook's Service Encryption Infastructure
1–10 of 48 posts
Re: Building Facebook's Service Encryption Infastructure
#2Does anyone know if they use encryption and access control to granularly regulate access to data? For example, the part of the system that feeds data to advertisements shouldn’t have access to my private messages (in my view that would be a huge breach of trust with users.)
Re: Building Facebook's Service Encryption Infastructure
#3Does anyone know if they use encryption and access control to granularly regulate access to data? For example, the part of the system that feeds data to advertisements shouldn’t have access to my private messages (in my view that would be a huge breach of trust with users.)
There are several access control mechanisms. One such ACL as mentioned in the post is identity certificates which are used to perform access control. Other mechanisms for identity are CATs which have been talked about in the past https://rwc.iacr.org/2018/Slides/Lewi.pdf and https://www.youtube.com/watch?v=kY-Bkv3qxMc
Re: Building Facebook's Service Encryption Infastructure
#4[troll] wasn't already encryption available for the data? Assuming it was all cleartext before this blog post.
Re: Building Facebook's Service Encryption Infastructure
#5Does anyone know if they use encryption and access control to granularly regulate access to data? For example, the part of the system that feeds data to advertisements shouldn’t have access to my private messages (in my view that would be a huge breach of trust with users.)
There are several access control mechanisms. One such ACL as mentioned in the post is identity certificates which are used to perform access control. Other mechanisms for identity are CATs which have been talked about in the past https://rwc.iacr.org/2018/Slides/Lewi.pdf and https://www.youtube.com/watch?v=kY-Bkv3qxMc
CATs at first sight look like Macaroons or JWTs. Thanks for the links!
Re: Building Facebook's Service Encryption Infastructure
#6Is this an engineering article to help prime the pump for discussing FB's approach to taking privacy more seriously (e.g. Zuckerberg's the "future is private")? The article does not explicitly state any connection to such larger FB company and product developments, but it made me think it's connected in some way.
Re: Building Facebook's Service Encryption Infastructure
#7Earlier quoted context omitted.
There are several access control mechanisms. One such ACL as mentioned in the post is identity certificates which are used to perform access control. Other mechanisms for identity are CATs which have been talked about in the past https://rwc.iacr.org/2018/Slides/Lewi.pdf and https://www.youtube.com/watch?v=kY-Bkv3qxMc
CATs at first sight look like Macaroons or JWTs. Thanks for the links!
Ya they're similar in that they are all signed blobs of data, but different in the sense that they are specifically designed to send authentication information via several layers of proxies
Re: Building Facebook's Service Encryption Infastructure
#8It seems that they recreated a Service Mesh. Running Istio or Consul Connect takes care or the vast majority of issues listed in this post: Encryption, Identity, access control. And even trasparently for the developpers (no modification of the code...)
Re: Building Facebook's Service Encryption Infastructure
#9> After several days, we finally narrowed down the issue to a bad Advanced Vector Extensions (AVX) instruction on a single CPU in our fleet
This isn't even the first time I've heard of an issue at FB being caused by a single bad CPU instruction. Working at a scale where "Problem X is a one-in-a-million edge case" and "Problem X happens several times per day" are synonymous is weird...
Re: Building Facebook's Service Encryption Infastructure
#10Earlier quoted context omitted.
CATs at first sight look like Macaroons or JWTs. Thanks for the links!
Ya they're similar in that they are all signed blobs of data, but different in the sense that they are specifically designed to send authentication information via several layers of proxies
I'm actually interested in this subject so I'll check out your links when I'll be able to. At first sight this sounds like wrapping tokens or third party caveats in Macaroons.