Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook security hole allows viewing of private photos

forum.bodybuilding.com

Post reply on HN
Print view View original

91–100 of 143 posts

Re: Facebook security hole allows viewing of private photos

#91

Post by r00fus »

nyellin wrote: post #34
Archio wrote: post #24

Earlier quoted context omitted.

I think it's a stretch to call this "just" a mistake. First of all, there isn't any malicious code that has to be run to execute it, it's a simple as clicking a few buttons in the UI. Secondly, Facebook is a site with hundreds of millions of users managing billions of private photos. With the amount of revenue & number of developers they have, it's inexcusable that they can't think through a simple process like this…

I'm downvoting you for saying I think it's a stretch to call this a mistake If it wasn't on purpose, it was a mistake. Period. It might be inexcusable, as you later pointed out, but it was still unintentional. Everyone likes to hate on Facebook. If this was a YC startup, I suspect people would be more forgiving.

> If this was a YC startup, I suspect people would be more forgiving.

Evidence to the contrary: the Dropbox security fiasco (which sounded worse but was resolved in hours with claims of no malicious activity) prompted several HN entries. HNers aren't so biased as to be blind to inexcusable negligence (esp. because a large majority of us are users of those services and have personal stake.)

Facebook has a history of such "mistakes", a founder who thinks FB users are "dumb fucks" (and has reportedly maliciously used FB's password log), and all the motive in the world to be "negligent" as it's a way they can make money (as long as we don't find out).

The foolish thing to do is to assume this is still a mistake after repeated history of such "mistakes".

Re: Facebook security hole allows viewing of private photos

#92

Post by peterhunt »

pasbesoin wrote: post #87
peterhunt wrote: post #83

Earlier quoted context omitted.

Maybe that was true in the past, but today when you delete your data it is gone. Trust me, I wrote it myself. The law enforcement guidelines that have been circulating recently corroborate this.

Thank you for the update/clarification. I deleted a couple of pictures this morning (nothing 'nekkid' ;-) and will have a look to confirm that they are indeed "gone" (inaccessible via direct URL -- albeit the URL of a CDN). Would you happen to have the identity or URL of a specific guideline that you could point to? EDIT: I just checked the URL of an image I deleted about an hour and a half ago, and that image is sti…

Things take a while to fall out of CDN cache, I forget what the TTL is these days but it should be reasonable.

Re: Facebook security hole allows viewing of private photos

#93

Post by corin_ »

tptacek wrote: post #84
balsam wrote: post #70

Earlier quoted context omitted.

i'd like to see these tagged. (seriously) anybody knows what they are drinking in that last pic? The bottle looks interesting.

Looks like Johnnie Walker Blue. I'm a little skeezed out at having looked at these photos at all, but "name that liquor" will apparently (in borderline cases like this) trump my principles.

Yep it is, the drink of choice for people who don't want a particularly cheap bottle and pay for label not taste.

Re: Facebook security hole allows viewing of private photos

#94

Post by pasbesoin »

peterhunt wrote: post #92
pasbesoin wrote: post #87

Earlier quoted context omitted.

Thank you for the update/clarification. I deleted a couple of pictures this morning (nothing 'nekkid' ;-) and will have a look to confirm that they are indeed "gone" (inaccessible via direct URL -- albeit the URL of a CDN). Would you happen to have the identity or URL of a specific guideline that you could point to? EDIT: I just checked the URL of an image I deleted about an hour and a half ago, and that image is sti…

Things take a while to fall out of CDN cache, I forget what the TTL is these days but it should be reasonable.

Understandable. I'll check again, a bit later.

Thanks again for taking the time to reply.

Re: Facebook security hole allows viewing of private photos

#95

Post by karlzt »

flyosity wrote: post #90
tzury wrote: post #51

someone [1] pulled this trick on Zuck's account [2] 1. http://twitter.com/#!/flyosity/status/144065873743839233 2. http://imgur.com/a/PrLrB

This is a little too meta... I tweeted that (that's me!) but the link to Zuck's photos was found further down in the comments here on HN. That's where I saw it.

https://news.ycombinator.com/item?id=3318903

Re: Facebook security hole allows viewing of private photos

#97

Post by axiomotion »

noname123 wrote: post #85
kristopolous wrote: post #25

General form appears to be as follows: http://www.facebook.com/ajax/report/social.php? __a=1& __d=1& attach_additional_photos=1& cid=((FBID))& content_type=0& h=((HASH BASED ON YOUR ACCOUNT))& phase=6& report_id=1& rid=((FBID)) After you get that initial hash then you can swap out the CID and the RID and get everyone else (I tried it for 3)... it's pretty easy. This issue is probably going to make mainstream news by…

I tried to follow this url format by using Chrome Developer toolbar after clicking on "report this photo" of a non-private photo to extract my account hash id, rid and cid of the interested person. It's a GET according to Developer tool. I get this however, for (;;);{"__ar":1,"error":1357006,"errorSummary":"Don't have Permission","errorDescription":"You don't have sufficient permissions to do that.","payload":null} A…

Get the same error, guess it is already fixed.

Re: Facebook security hole allows viewing of private photos

#98

Post by mkjones »

This was indeed a bug, and shouldn't work any more. We turned off the system that lets you report content through this flow (and thus made this bug's code inaccessible) as soon as we became aware of the issue.

In the future, if you find a security / privacy bug on Facebook, feel free to report it via our whitehat program, which will get things looked at more quickly than random blog posts. You can get credit for the find and even make money with bug-bounty payouts: http://www.facebook.com/whitehat/.

For what it's worth, a few people were alluding to this meaning that we don't check privacy by default. In fact we do have a pretty robust default-deny system for running privacy checks. This was an edge case where it was forced to work in a way that was incorrect.

(I work at Facebook, but not on this system.)

Re: Facebook security hole allows viewing of private photos

#100

Post by rbrcurtis »

Groxx wrote: post #80
raphman wrote: post #36

Earlier quoted context omitted.

No. This shows that Facebook has no robust security model at all. Either they do not have any mandatory access control for private data, or someone approved of circumventing such access control measures for this feature. Both is in my opinion inacceptable for a company holding so much potentially sensitive data.

One example of a hole does not make a bucket into a sieve. For a company of FBs size and personal data contents, I agree, they have a rather scary track record. But saying implies is fallacious, especially when it's also a symptom of through .

but it does make a tire flat. :)
Post reply on HN