Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Meta fined $102M for storing passwords in plain text

engadget.com

Post reply on HN
Print view View original

51–60 of 136 posts

Re: Meta fined $102M for storing passwords in plain text

#51

Post by cogman10 »

locallost wrote: post #41
delusional wrote: post #36

Earlier quoted context omitted.

> Meta does not intend Is an odd concept. Is the argument that nobody noticed? If somebody noticed, but the cleanup was deffered, them they did "intend to". It's like defending a bank robber by saying that he didn't intend to rob the bank, he just had a gun in his hand, and then he figured the damage was already done, so he may as well get some money.

I think the comment is the context of being a software developer. "Everyone" knows you shouldn't do that, so it would be a bit odd if the company of Facebook's size would. But if it was accidental, then it makes it clearer how it happened. It's still a grave mistake, but not unthinkable. I personally write bugs all the time.

I gotta level with you, not everyone knows you shouldn't do that.

There's a number of devs that don't think twice about storing sensitive keys in a git repo.

I could 100% see how someone would do this, see log messages with passwords in plain text, and then faff off being the last person to actually look at those logs. "K, this case is done, what's next"

Re: Meta fined $102M for storing passwords in plain text

#53

Post by nomilk »

yunohn wrote: post #50
nomilk wrote: post #47

Earlier quoted context omitted.

hmm.. that's a very sympathetic take. Most frameworks blot out passwords from logs by default, so even a newbie programmer on their first day doesn't make the mistake of logging plaintext passwords, yet facebook somehow made that mistake... It should raise eyebrows when the security practices of SWEs at a billion dollar company are outperformed by any newbie developer working a toy project.

I think it’s actually much easier to make such mistakes at large companies with sprawling codebases and potential for settings that inadvertently end up logging sensitive data. Especially for nobody to notice either.

True but they're also better resourced in terms of humans (and their experience) and tooling that should prevent or at least catch any blunders quickly.

Re: Meta fined $102M for storing passwords in plain text

#54

Post by cogman10 »

osullip wrote: post #44
locallost wrote: post #41

Earlier quoted context omitted.

I think the comment is the context of being a software developer. "Everyone" knows you shouldn't do that, so it would be a bit odd if the company of Facebook's size would. But if it was accidental, then it makes it clearer how it happened. It's still a grave mistake, but not unthinkable. I personally write bugs all the time.

Logging passwords on the fly is probably common. Some debug or log action setup and forgotten. However, if you ever see a password in plain text you should raise alarms to the highest level. In this case, I don't think the alarm was raised.

I agree, but also I know of devs that don't understand the basic security implications of passwords being in logs. I could easily see how someone, maybe even a couple of people, could see these logs and think nothing of them.

Re: Meta fined $102M for storing passwords in plain text

#55

Post by sealeck »

sschueller wrote: post #39
foota wrote: post #28

It's mentioned in nested comments, but (as you'd probably expect) meta does not intend to store passwords in plaintext. There was a bug where they were logging plaintext passwords for some period of time e.g., when someone tried to log in etc.,.

Boeing did not intend to have its plane crash when it installed the MCAS.

And it turns out that plane crashes are much more serious failures than logging sensitive data internally. Not to say what Facebook has done isn't an embarrasing failure that really shouldn't happen, but they're clearly not the same thing.

Re: Meta fined $102M for storing passwords in plain text

#56

Post by croes »

foota wrote: post #28

It's mentioned in nested comments, but (as you'd probably expect) meta does not intend to store passwords in plaintext. There was a bug where they were logging plaintext passwords for some period of time e.g., when someone tried to log in etc.,.

That's why the fine is only $102M

Re: Meta fined $102M for storing passwords in plain text

#57

Post by nolok »

foota wrote: post #28

It's mentioned in nested comments, but (as you'd probably expect) meta does not intend to store passwords in plaintext. There was a bug where they were logging plaintext passwords for some period of time e.g., when someone tried to log in etc.,.

And they're not fined for storing in plaintext, nor for storing in plaintext by mistake, they're fined because the law give a time limit for you to notify the regulator after you notice it and they waited too long.

And in this specific case just to be clear it's not about taking too long to notify the public / customer, but about taking too long to notify regulator (the delay is much shorter). And they're not supposed to have perfect facts when they notify it, there is no sanction for notifying and saying "but we're not sure yet" if you're being honest, or coming back later with correction, there is a sanction for not telling them in time.

We often see "companies should be responsible / should have to inform me" and that's part of that regulation, and it only works if there are clear defined delay and sanction when they're not respected.

Re: Meta fined $102M for storing passwords in plain text

#58

Post by mulmen »

nomilk wrote: post #47
oefrha wrote: post #42

Earlier quoted context omitted.

To the (intentionally?) obtuse responses: intending to store passwords in plaintext usually means storing plaintext passwords in databases and doing authentication with that; and that’s what the gazillion of commenters replying to the title are implying. Mistakenly logging credentials because of e.g. badly interacting HTTP middleware is still a very nasty bug, but it doesn’t count as intending to store passwords in p…

hmm.. that's a very sympathetic take. Most frameworks blot out passwords from logs by default, so even a newbie programmer on their first day doesn't make the mistake of logging plaintext passwords, yet facebook somehow made that mistake... It should raise eyebrows when the security practices of SWEs at a billion dollar company are outperformed by any newbie developer working a toy project.

> It should raise eyebrows when the security practices of SWEs at a billion dollar company are outperformed by any newbie developer working a toy project.

Facebook isn’t “a billion dollar” company it’s “a 1,435 billion dollar” company.

Excuses start to run thin.

Re: Meta fined $102M for storing passwords in plain text

#59

Post by vidarh »

nomilk wrote: post #47
oefrha wrote: post #42

Earlier quoted context omitted.

To the (intentionally?) obtuse responses: intending to store passwords in plaintext usually means storing plaintext passwords in databases and doing authentication with that; and that’s what the gazillion of commenters replying to the title are implying. Mistakenly logging credentials because of e.g. badly interacting HTTP middleware is still a very nasty bug, but it doesn’t count as intending to store passwords in p…

hmm.. that's a very sympathetic take. Most frameworks blot out passwords from logs by default, so even a newbie programmer on their first day doesn't make the mistake of logging plaintext passwords, yet facebook somehow made that mistake... It should raise eyebrows when the security practices of SWEs at a billion dollar company are outperformed by any newbie developer working a toy project.

Passwords are just data. If said data is not tagged in a way that makes it clear it is a password, finding an algorithm that will successfully blot out passwords in the general case is intractable without being far too aggressive to be useful.

All such tools rely on assumptions about what will be logged following certain rules that the logging can check against - it's not hard to accidentally convert data to a format that when logged happens to fail these kinds of tests.

They should have caught it. But it's not surprising that it occasionally happens.

Re: Meta fined $102M for storing passwords in plain text

#60

Post by pbhjpbhj »

wahnfrieden wrote: post #16
progbits wrote: post #14

Earlier quoted context omitted.

It's unbelievable how little most developers care about security. At this point I've given up on educating them since it went nowhere, instead I'm locking down permissions to things like firewall and secret vault so random people don't fuck it up.

Their managers don't incentivize them spending time on it, and their PM will fight security tickets they don't understand the need for. Most devs have little autonomy at orgs today and operate under a strict hierarchy of command at the ticket level.

Presumably, "we're been storing 600 Million passwords in plaintext" is understandable to their PMs given its understandable to complete laymen. Aren't FAANG companies supposed to employ the very brightest minds.

Hard to imagine this wasn't done on purpose.

Post reply on HN