Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Meta fined $102M for storing passwords in plain text

engadget.com

Post reply on HN
Print view View original

41–50 of 136 posts

Re: Meta fined $102M for storing passwords in plain text

#41

Post by locallost »

delusional wrote: post #36
foota wrote: post #28

It's mentioned in nested comments, but (as you'd probably expect) meta does not intend to store passwords in plaintext. There was a bug where they were logging plaintext passwords for some period of time e.g., when someone tried to log in etc.,.

> Meta does not intend Is an odd concept. Is the argument that nobody noticed? If somebody noticed, but the cleanup was deffered, them they did "intend to". It's like defending a bank robber by saying that he didn't intend to rob the bank, he just had a gun in his hand, and then he figured the damage was already done, so he may as well get some money.

I think the comment is the context of being a software developer. "Everyone" knows you shouldn't do that, so it would be a bit odd if the company of Facebook's size would. But if it was accidental, then it makes it clearer how it happened. It's still a grave mistake, but not unthinkable. I personally write bugs all the time.

Re: Meta fined $102M for storing passwords in plain text

#42

Post by oefrha »

foota wrote: post #28

It's mentioned in nested comments, but (as you'd probably expect) meta does not intend to store passwords in plaintext. There was a bug where they were logging plaintext passwords for some period of time e.g., when someone tried to log in etc.,.

To the (intentionally?) obtuse responses: intending to store passwords in plaintext usually means storing plaintext passwords in databases and doing authentication with that; and that’s what the gazillion of commenters replying to the title are implying.

Mistakenly logging credentials because of e.g. badly interacting HTTP middleware is still a very nasty bug, but it doesn’t count as intending to store passwords in plaintext.

And something similar has happened to me, and I’m sure many others: logging middleware storing sensitive user data that shouldn’t be visible to engineers with mere access to logs (not as bad as logging credentials in my case, but still).

Re: Meta fined $102M for storing passwords in plain text

#44

Post by osullip »

locallost wrote: post #41
delusional wrote: post #36

Earlier quoted context omitted.

> Meta does not intend Is an odd concept. Is the argument that nobody noticed? If somebody noticed, but the cleanup was deffered, them they did "intend to". It's like defending a bank robber by saying that he didn't intend to rob the bank, he just had a gun in his hand, and then he figured the damage was already done, so he may as well get some money.

I think the comment is the context of being a software developer. "Everyone" knows you shouldn't do that, so it would be a bit odd if the company of Facebook's size would. But if it was accidental, then it makes it clearer how it happened. It's still a grave mistake, but not unthinkable. I personally write bugs all the time.

Logging passwords on the fly is probably common. Some debug or log action setup and forgotten.

However, if you ever see a password in plain text you should raise alarms to the highest level.

In this case, I don't think the alarm was raised.

Re: Meta fined $102M for storing passwords in plain text

#45

Post by [deleted] »

radicalbyte wrote: post #38
progbits wrote: post #14

Earlier quoted context omitted.

It's unbelievable how little most developers care about security. At this point I've given up on educating them since it went nowhere, instead I'm locking down permissions to things like firewall and secret vault so random people don't fuck it up.

I don't see that in capable developers (who usually end up pushed to "backend") but it is absolutely endemic in frontend and extremely problematic in organisations which have full stack created frontend-first. All too often even the super seniors / leads have a very limit knowledge of security (or performance, reliability etc).

[deleted]

Re: Meta fined $102M for storing passwords in plain text

#46

Post by Arbortheus »

FartyMcFarter wrote: post #35
tjpnz wrote: post #30

Earlier quoted context omitted.

When you select candidates based on whether they know how to invert a BST and other trivia it's not terribly surprisingly.

How would you select candidates to make sure they avoid this kind of security bug?

“You are building an account authentication system and need to store user passwords, what design measures would you take to ensure this would be done securely?”

Follow up question. “What measures would you take to ensure this complies with relevant data protection regulations?”

If they give a somewhat competent answer, you at least know they’re the sort of developer that can critically analyse this sort of thing.

Re: Meta fined $102M for storing passwords in plain text

#47

Post by nomilk »

oefrha wrote: post #42
foota wrote: post #28

It's mentioned in nested comments, but (as you'd probably expect) meta does not intend to store passwords in plaintext. There was a bug where they were logging plaintext passwords for some period of time e.g., when someone tried to log in etc.,.

To the (intentionally?) obtuse responses: intending to store passwords in plaintext usually means storing plaintext passwords in databases and doing authentication with that; and that’s what the gazillion of commenters replying to the title are implying. Mistakenly logging credentials because of e.g. badly interacting HTTP middleware is still a very nasty bug, but it doesn’t count as intending to store passwords in p…

hmm.. that's a very sympathetic take.

Most frameworks blot out passwords from logs by default, so even a newbie programmer on their first day doesn't make the mistake of logging plaintext passwords, yet facebook somehow made that mistake...

It should raise eyebrows when the security practices of SWEs at a billion dollar company are outperformed by any newbie developer working a toy project.

Re: Meta fined $102M for storing passwords in plain text

#48

Post by nicolas_t »

oefrha wrote: post #42
foota wrote: post #28

It's mentioned in nested comments, but (as you'd probably expect) meta does not intend to store passwords in plaintext. There was a bug where they were logging plaintext passwords for some period of time e.g., when someone tried to log in etc.,.

To the (intentionally?) obtuse responses: intending to store passwords in plaintext usually means storing plaintext passwords in databases and doing authentication with that; and that’s what the gazillion of commenters replying to the title are implying. Mistakenly logging credentials because of e.g. badly interacting HTTP middleware is still a very nasty bug, but it doesn’t count as intending to store passwords in p…

According to the pci dss auditor I had when doing a pci das level 1 audit. The most common credit card leak vector is logging middlewares logging credit card nunbers

Re: Meta fined $102M for storing passwords in plain text

#49

Post by slim »

oefrha wrote: post #42
foota wrote: post #28

It's mentioned in nested comments, but (as you'd probably expect) meta does not intend to store passwords in plaintext. There was a bug where they were logging plaintext passwords for some period of time e.g., when someone tried to log in etc.,.

To the (intentionally?) obtuse responses: intending to store passwords in plaintext usually means storing plaintext passwords in databases and doing authentication with that; and that’s what the gazillion of commenters replying to the title are implying. Mistakenly logging credentials because of e.g. badly interacting HTTP middleware is still a very nasty bug, but it doesn’t count as intending to store passwords in p…

unless you are Facebook and tightly collaborating with police and intelligence in countries with no respect for human rights

Re: Meta fined $102M for storing passwords in plain text

#50

Post by yunohn »

nomilk wrote: post #47
oefrha wrote: post #42

Earlier quoted context omitted.

To the (intentionally?) obtuse responses: intending to store passwords in plaintext usually means storing plaintext passwords in databases and doing authentication with that; and that’s what the gazillion of commenters replying to the title are implying. Mistakenly logging credentials because of e.g. badly interacting HTTP middleware is still a very nasty bug, but it doesn’t count as intending to store passwords in p…

hmm.. that's a very sympathetic take. Most frameworks blot out passwords from logs by default, so even a newbie programmer on their first day doesn't make the mistake of logging plaintext passwords, yet facebook somehow made that mistake... It should raise eyebrows when the security practices of SWEs at a billion dollar company are outperformed by any newbie developer working a toy project.

I think it’s actually much easier to make such mistakes at large companies with sprawling codebases and potential for settings that inadvertently end up logging sensitive data. Especially for nobody to notice either.
Post reply on HN