Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Meta fined $102M for storing passwords in plain text

engadget.com

Post reply on HN
Print view View original

11–20 of 136 posts

Re: Meta fined $102M for storing passwords in plain text

#11

Post by nomilk »

AmericanChopper wrote: post #4

This is a very imaginative use of the word “breach”, according to the details reported in the article at least. Internal staff (inadvertently) had access to users plaintext passwords. The article doesn’t mention any use of these credentials in a breach though, and doesn’t make any refutation of Meta’s claim that this never occurred. Internal staff having access to my data is what I would normally expect from a servic…

In many senses, internal staff having access to plaintext passwords is a breach.

Re: Meta fined $102M for storing passwords in plain text

#13

Post by poincaredisk »

pibefision wrote: post #6
DexesTTP wrote: post #3

Context: This is for a 2019 data breach on a system that was created in 2012. The GDPR was instated in 2018 (has it really been that long? Wow feels like yesterday) and Meta failed to disclose the 2019 data breach properly under GDPR, hence the fine.

GDPR fine is 4% of global turnover from previous fiscal year. 102m seems low to me.

That's the maximal fine (that was never used as far as I know, at least on a large company). In this case the fine is understandably much smaller, since the privacy incident is not critical, and Facebook reported the problem to the authorities on its own.

Re: Meta fined $102M for storing passwords in plain text

#14

Post by progbits »

can16358p wrote: post #8

I really don't get how companies so large do stupid things like this. Hashing and salting passwords isn't some newly introduced advanced rocket science, it's literally a 101-level "obvious" thing. How can a huge corporation like Meta/Facebook can do this is beyond my imagination.

It's unbelievable how little most developers care about security.

At this point I've given up on educating them since it went nowhere, instead I'm locking down permissions to things like firewall and secret vault so random people don't fuck it up.

Re: Meta fined $102M for storing passwords in plain text

#15

Post by Negitivefrags »

can16358p wrote: post #8

I really don't get how companies so large do stupid things like this. Hashing and salting passwords isn't some newly introduced advanced rocket science, it's literally a 101-level "obvious" thing. How can a huge corporation like Meta/Facebook can do this is beyond my imagination.

The usual way this happens is accidentally logging passwords. Or even other cases where passwords happen to be included in something else. It can happen more easily than you think.

Like for example, if you collect server side crash dumps, are you really taking care that there is no sensitive information sitting in the memory image stored in them?

Re: Meta fined $102M for storing passwords in plain text

#16

Post by wahnfrieden »

progbits wrote: post #14
can16358p wrote: post #8

I really don't get how companies so large do stupid things like this. Hashing and salting passwords isn't some newly introduced advanced rocket science, it's literally a 101-level "obvious" thing. How can a huge corporation like Meta/Facebook can do this is beyond my imagination.

It's unbelievable how little most developers care about security. At this point I've given up on educating them since it went nowhere, instead I'm locking down permissions to things like firewall and secret vault so random people don't fuck it up.

Their managers don't incentivize them spending time on it, and their PM will fight security tickets they don't understand the need for. Most devs have little autonomy at orgs today and operate under a strict hierarchy of command at the ticket level.

Re: Meta fined $102M for storing passwords in plain text

#17

Post by AmericanChopper »

nomilk wrote: post #11
AmericanChopper wrote: post #4

This is a very imaginative use of the word “breach”, according to the details reported in the article at least. Internal staff (inadvertently) had access to users plaintext passwords. The article doesn’t mention any use of these credentials in a breach though, and doesn’t make any refutation of Meta’s claim that this never occurred. Internal staff having access to my data is what I would normally expect from a servic…

In many senses, internal staff having access to plaintext passwords is a breach.

It’s a control failure, not a breach. It would also be an incident, one that could result in a subsequent breach, or one that warrants some work to be done to ensure it does not turn into a breach. But it has not resulted in an unauthorised party gaining access to the data, and is therefor not a breach.

Re: Meta fined $102M for storing passwords in plain text

#18

Post by shprd »

AmericanChopper wrote: post #4

This is a very imaginative use of the word “breach”, according to the details reported in the article at least. Internal staff (inadvertently) had access to users plaintext passwords. The article doesn’t mention any use of these credentials in a breach though, and doesn’t make any refutation of Meta’s claim that this never occurred. Internal staff having access to my data is what I would normally expect from a servic…

> This is a very imaginative use of the word “breach”

You're mistaken. You might be thinking of breach in terms of "hacking into", but they used it as:

  personal data breach
Which accurately means "unauthorised access to personal data"[0] and seem to be the language used by the DPC.

[0] - https://ico.org.uk/for-organisations/law-enforcement/guide-t...

Re: Meta fined $102M for storing passwords in plain text

#20

Post by ethbr1 »

AmericanChopper wrote: post #17
nomilk wrote: post #11

Earlier quoted context omitted.

In many senses, internal staff having access to plaintext passwords is a breach.

It’s a control failure, not a breach. It would also be an incident, one that could result in a subsequent breach, or one that warrants some work to be done to ensure it does not turn into a breach. But it has not resulted in an unauthorised party gaining access to the data, and is therefor not a breach.

I think it's impossible to say there was no breach, given they were exposed for 7 years.
Post reply on HN