Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Meta fined $102M for storing passwords in plain text

engadget.com

Post reply on HN
Print view View original

31–40 of 136 posts

Re: Meta fined $102M for storing passwords in plain text

#31

Post by shprd »

AmericanChopper wrote: post #22
shprd wrote: post #18

Earlier quoted context omitted.

> This is a very imaginative use of the word “breach” You're mistaken. You might be thinking of breach in terms of "hacking into", but they used it as: personal data breach Which accurately means "unauthorised access to personal data"[0] and seem to be the language used by the DPC. [0] - https://ico.org.uk/for-organisations/law-enforcement/guide-t...

That describes an entirely different incident to the one referenced in this article.

Edited the link out. It doesn't make a difference anyway for the purpose of this discussion.

Re: Meta fined $102M for storing passwords in plain text

#32

Post by ChoHag »

bongodongobob wrote: post #24
can16358p wrote: post #8

I really don't get how companies so large do stupid things like this. Hashing and salting passwords isn't some newly introduced advanced rocket science, it's literally a 101-level "obvious" thing. How can a huge corporation like Meta/Facebook can do this is beyond my imagination.

I'm honestly never surprised by any of this stuff. I've done some contracting and file access is always a shitshow. Picture this: > Intern or contractor gets hired. > Someone runs a script to create the user because permissions have turned into a rats nest that no human can understand > No one knows how the script works anymore, it's probably outdated and only does 60% of the job > User is added to a quagmire of grou…

[dead]

Re: Meta fined $102M for storing passwords in plain text

#33

Post by vanjajaja1 »

can16358p wrote: post #8

I really don't get how companies so large do stupid things like this. Hashing and salting passwords isn't some newly introduced advanced rocket science, it's literally a 101-level "obvious" thing. How can a huge corporation like Meta/Facebook can do this is beyond my imagination.

it happens because you have one component logging everything for traceability, and it hosts the interconnect between 2 other components which need to communicate passwords. thus the password accidentally slips into a plain text log file

generally there are tools that search for & flag PII logging, if it slips through the tools its because there are layers of indirection involved

Re: Meta fined $102M for storing passwords in plain text

#34

Post by fulafel »

can16358p wrote: post #8

I really don't get how companies so large do stupid things like this. Hashing and salting passwords isn't some newly introduced advanced rocket science, it's literally a 101-level "obvious" thing. How can a huge corporation like Meta/Facebook can do this is beyond my imagination.

Big organizations just have a lot of bureucracy attempting to codify common sense. I bet they have paper saying you shouldn't do this.

Re: Meta fined $102M for storing passwords in plain text

#35

Post by FartyMcFarter »

tjpnz wrote: post #30
can16358p wrote: post #8

I really don't get how companies so large do stupid things like this. Hashing and salting passwords isn't some newly introduced advanced rocket science, it's literally a 101-level "obvious" thing. How can a huge corporation like Meta/Facebook can do this is beyond my imagination.

When you select candidates based on whether they know how to invert a BST and other trivia it's not terribly surprisingly.

How would you select candidates to make sure they avoid this kind of security bug?

Re: Meta fined $102M for storing passwords in plain text

#36

Post by delusional »

foota wrote: post #28

It's mentioned in nested comments, but (as you'd probably expect) meta does not intend to store passwords in plaintext. There was a bug where they were logging plaintext passwords for some period of time e.g., when someone tried to log in etc.,.

> Meta does not intend

Is an odd concept. Is the argument that nobody noticed? If somebody noticed, but the cleanup was deffered, them they did "intend to".

It's like defending a bank robber by saying that he didn't intend to rob the bank, he just had a gun in his hand, and then he figured the damage was already done, so he may as well get some money.

Re: Meta fined $102M for storing passwords in plain text

#37

Post by throwawaysleep »

progbits wrote: post #14
can16358p wrote: post #8

I really don't get how companies so large do stupid things like this. Hashing and salting passwords isn't some newly introduced advanced rocket science, it's literally a 101-level "obvious" thing. How can a huge corporation like Meta/Facebook can do this is beyond my imagination.

It's unbelievable how little most developers care about security. At this point I've given up on educating them since it went nowhere, instead I'm locking down permissions to things like firewall and secret vault so random people don't fuck it up.

Using the terms, wallet, threat, or prestige, make me as a non aultristic person care about the security of the systems my employer owns.

Re: Meta fined $102M for storing passwords in plain text

#38

Post by radicalbyte »

progbits wrote: post #14
can16358p wrote: post #8

I really don't get how companies so large do stupid things like this. Hashing and salting passwords isn't some newly introduced advanced rocket science, it's literally a 101-level "obvious" thing. How can a huge corporation like Meta/Facebook can do this is beyond my imagination.

It's unbelievable how little most developers care about security. At this point I've given up on educating them since it went nowhere, instead I'm locking down permissions to things like firewall and secret vault so random people don't fuck it up.

I don't see that in capable developers (who usually end up pushed to "backend") but it is absolutely endemic in frontend and extremely problematic in organisations which have full stack created frontend-first. All too often even the super seniors / leads have a very limit knowledge of security (or performance, reliability etc).

Re: Meta fined $102M for storing passwords in plain text

#39

Post by sschueller »

foota wrote: post #28

It's mentioned in nested comments, but (as you'd probably expect) meta does not intend to store passwords in plaintext. There was a bug where they were logging plaintext passwords for some period of time e.g., when someone tried to log in etc.,.

Boeing did not intend to have its plane crash when it installed the MCAS.

Re: Meta fined $102M for storing passwords in plain text

#40

Post by AmericanChopper »

shprd wrote: post #31
AmericanChopper wrote: post #22

Earlier quoted context omitted.

That describes an entirely different incident to the one referenced in this article.

Edited the link out. It doesn't make a difference anyway for the purpose of this discussion.

You didn’t edit the link out, you replaced your comment with a completely different one. I always though HN was pretty good at preventing ninja edits like that…
Post reply on HN