Live data from Hacker News

Facebook shoots first, ignores questions later; account lock-out attack works

arstechnica.com

11–20 of 90 posts

Re: Facebook shoots first, ignores questions later; account lock-out attack works

#11
That's not even news, everyone who has worked with facebook has the same issues. For such an understaffed company, that's not surprising. We have our domain banned from their spam filter before we even launched our game (really, it was just a redirect back to facebook); been like that for months and still no response to our complaints.

Re: Facebook shoots first, ignores questions later; account lock-out attack works

#12
They have 500 million users. It's probably easier to shoot first and ask questions later, because even if you kill 1000 users a day, you still have a lot of users.

Remember, Facebook is about one thing: eyeballs. If some eyeballs cost them money, it's easier to lock them out than to work with them.

If you don't want some large company to shut down your website, host your own.

Re: Facebook shoots first, ignores questions later; account lock-out attack works

#13
post #10

Counter-notice, but only if you are positive it's a bogus takedown. https://www.chillingeffects.org/dmca/counter512.pdf (not actually a pdf) They have to put it back online with a counter-notice.

It doesn't sound to me like this is necessarily a DMCA complaint. While the DMCA defines certain procedures in return for certain protections, I don't think it actually forbids just dropping Facebook a note saying "Hey, this is infringing content", without even having to necessarly own the content in question, and if Facebook chooses to aggressively take it down, what recourse do you have? Filing a counternotice won't necessarily do anything, as far as I can tell.

Re: Facebook shoots first, ignores questions later; account lock-out attack works

#14
post #2

Many IT security standards actually require account lock-outs. For example, PCI-DSS requires it. No one seems to understand that the goal of the attack may be to deny access. The attackers may not want to compromise the account, only to keep someone (or a group of people) locked out for a bit while they do something bad elsewhere. Edit: I'm surprised an account would be locked by a DMCA request though. Block or remov…

It's not even a DMCA request. You just fill in a form and claim infringement, without even having to authenticate who you are. So, I don't see this as following any sort of "fair" process that gives the other side an opportunity to challenge or object.

Re: Facebook shoots first, ignores questions later; account lock-out attack works

#16
FYI - the copyright complaint form is here: https://www.facebook.com/legal/copyright.php?noncopyright_no...

As you can see, it's not a normal DMCA take down, and it can easily be spoofed.Yes, you have to certify under penalty of perjury, but what difference does that make if the contact information is bogus?

Re: Facebook shoots first, ignores questions later; account lock-out attack works

#17
post #13
post #10

Counter-notice, but only if you are positive it's a bogus takedown. https://www.chillingeffects.org/dmca/counter512.pdf (not actually a pdf) They have to put it back online with a counter-notice.

It doesn't sound to me like this is necessarily a DMCA complaint. While the DMCA defines certain procedures in return for certain protections, I don't think it actually forbids just dropping Facebook a note saying "Hey, this is infringing content", without even having to necessarly own the content in question, and if Facebook chooses to aggressively take it down, what recourse do you have? Filing a counternotice won'…

Safe-harbor means the provider dooes not have to authenticate a DMCA notice - the takedown notice is done under perjury, they just have to obey it to escape any liability.

The catch is there is virtually never a prosecution for a bogus takedown, I cannot remember ever reading about one, it would be huge news.

Bogus takedowns happen all the time on youtube so I guess now it's moved onto facebook.

Can't believe I am suggesting this but anonymous just needs to have "Takedown Fridays" where they target the service of their choice and perjure away to their hearts' content. When thousands of FB pages suddenly vanish, eventually Congress may get wind of it and improve the law but I kind of doubt it.

Re: Facebook shoots first, ignores questions later; account lock-out attack works

#18

You are one of 500 million "customers" who aren't even paying them any money. They can drop you at any time.

Unless you are paying them for advertising, in which case you ARE a customer. They owe their users some sort of due process.

Re: Facebook shoots first, ignores questions later; account lock-out attack works

#19
post #13
post #10

Counter-notice, but only if you are positive it's a bogus takedown. https://www.chillingeffects.org/dmca/counter512.pdf (not actually a pdf) They have to put it back online with a counter-notice.

It doesn't sound to me like this is necessarily a DMCA complaint. While the DMCA defines certain procedures in return for certain protections, I don't think it actually forbids just dropping Facebook a note saying "Hey, this is infringing content", without even having to necessarly own the content in question, and if Facebook chooses to aggressively take it down, what recourse do you have? Filing a counternotice won'…

Totally right -- it's well within FB's TOS and you have no recourse other than to email them. But, humans responding to email doesn't scale well, hence the poor "customer service".

(The quotes because, you're not so much the customer as the product...your eyeballs at least.)

Re: Facebook shoots first, ignores questions later; account lock-out attack works

#20
I feel like I'm repeating myself daily at the moment. If you're not paying for it, you shouldn't expect anything. If people paid for the services they used, they'd have recourse and the interests of the provider and the consumer would be aligned. As it stands, why would or should Facebook give a shit?

Brands building their online presence via Facebook are mad as far as I'm concerned, Facebook owns that content, they can do with it what they want and as this demonstrates, zero recourse.

Post reply on HN