Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Meta fined $102M for storing passwords in plain text

engadget.com

Post reply on HN
Print view View original

61–70 of 136 posts

Re: Meta fined $102M for storing passwords in plain text

#61

Post by Mountain_Skies »

oefrha wrote: post #42
foota wrote: post #28

It's mentioned in nested comments, but (as you'd probably expect) meta does not intend to store passwords in plaintext. There was a bug where they were logging plaintext passwords for some period of time e.g., when someone tried to log in etc.,.

To the (intentionally?) obtuse responses: intending to store passwords in plaintext usually means storing plaintext passwords in databases and doing authentication with that; and that’s what the gazillion of commenters replying to the title are implying. Mistakenly logging credentials because of e.g. badly interacting HTTP middleware is still a very nasty bug, but it doesn’t count as intending to store passwords in p…

When I did application security I had to argue with developers about PCI and PII data in logs all the time. They would insist that there was "no other way" and that it was secure inside our system. I'd refuse to change the status of the vuln to anything other than critical. I found many similar vulns in our database that had been marked as false positives or non-critical by other infosec people in the company. The common thread was none of them had a background in software development so they just trusted what the developer told them. This seems to happen frequently in places where there's a culture of compliance being more important than actual security.

Re: Meta fined $102M for storing passwords in plain text

#62

Post by vidarh »

cogman10 wrote: post #51
locallost wrote: post #41

Earlier quoted context omitted.

I think the comment is the context of being a software developer. "Everyone" knows you shouldn't do that, so it would be a bit odd if the company of Facebook's size would. But if it was accidental, then it makes it clearer how it happened. It's still a grave mistake, but not unthinkable. I personally write bugs all the time.

I gotta level with you, not everyone knows you shouldn't do that. There's a number of devs that don't think twice about storing sensitive keys in a git repo. I could 100% see how someone would do this, see log messages with passwords in plain text, and then faff off being the last person to actually look at those logs. "K, this case is done, what's next"

I worked somewhere not long ago where the "solution" was to run code to scrub repos before building release packages because these packages were in some cases installed in customer networks that drastically increased the chance they might leak. At no point did it seem developers or the devops team realised that the fact they saw the need to do this meant that maybe they should apply the same checks used to scrub in a hook to root them on commit in the first place.

Re: Meta fined $102M for storing passwords in plain text

#63

Post by vidarh »

osullip wrote: post #44
locallost wrote: post #41

Earlier quoted context omitted.

I think the comment is the context of being a software developer. "Everyone" knows you shouldn't do that, so it would be a bit odd if the company of Facebook's size would. But if it was accidental, then it makes it clearer how it happened. It's still a grave mistake, but not unthinkable. I personally write bugs all the time.

Logging passwords on the fly is probably common. Some debug or log action setup and forgotten. However, if you ever see a password in plain text you should raise alarms to the highest level. In this case, I don't think the alarm was raised.

Vast quantities of logs are never reviewed by anyone....

Re: Meta fined $102M for storing passwords in plain text

#64

Post by tjoff »

vidarh wrote: post #59
nomilk wrote: post #47

Earlier quoted context omitted.

hmm.. that's a very sympathetic take. Most frameworks blot out passwords from logs by default, so even a newbie programmer on their first day doesn't make the mistake of logging plaintext passwords, yet facebook somehow made that mistake... It should raise eyebrows when the security practices of SWEs at a billion dollar company are outperformed by any newbie developer working a toy project.

Passwords are just data. If said data is not tagged in a way that makes it clear it is a password, finding an algorithm that will successfully blot out passwords in the general case is intractable without being far too aggressive to be useful. All such tools rely on assumptions about what will be logged following certain rules that the logging can check against - it's not hard to accidentally convert data to a format…

HN does it, if I post my password it will automatically change it to stars, see: *************

Re: Meta fined $102M for storing passwords in plain text

#65

Post by nomilk »

vidarh wrote: post #59
nomilk wrote: post #47

Earlier quoted context omitted.

hmm.. that's a very sympathetic take. Most frameworks blot out passwords from logs by default, so even a newbie programmer on their first day doesn't make the mistake of logging plaintext passwords, yet facebook somehow made that mistake... It should raise eyebrows when the security practices of SWEs at a billion dollar company are outperformed by any newbie developer working a toy project.

Passwords are just data. If said data is not tagged in a way that makes it clear it is a password, finding an algorithm that will successfully blot out passwords in the general case is intractable without being far too aggressive to be useful. All such tools rely on assumptions about what will be logged following certain rules that the logging can check against - it's not hard to accidentally convert data to a format…

Not that hard [1]:

    Rails.application.config.filter_parameters += [
      :passw, :email, :secret, :token, :_key, :crypt, :salt, :certificate, :otp, 
    :ssn, :cvv, :cvc
    ]
[1] https://github.com/rails/rails/blob/8a2e28d7451d5ae4cb194fcc...

Re: Meta fined $102M for storing passwords in plain text

#68

Post by nh2 »

0.1 % of current revenue fine.

If your company made a billion $ revenue per year, it'd have to pay $100k.

Doesn't feel like a great incentive to do it right.

If they improved debuggability by logging all requests to make the company more than 0.1 % efficient, it's a good deal for them.

Re: Meta fined $102M for storing passwords in plain text

#69

Post by tveyben »

102M$ might sound like a large sum - but the math shows that a leaked clear text password here is just fined with less than one dollar…

(Yes I have read the fine is triggered by not informing the authorities in due time)

Interesting how the affected user is actually valuated…

Re: Meta fined $102M for storing passwords in plain text

#70

Post by benmmurphy »

tjoff wrote: post #64
vidarh wrote: post #59

Earlier quoted context omitted.

Passwords are just data. If said data is not tagged in a way that makes it clear it is a password, finding an algorithm that will successfully blot out passwords in the general case is intractable without being far too aggressive to be useful. All such tools rely on assumptions about what will be logged following certain rules that the logging can check against - it's not hard to accidentally convert data to a format…

HN does it, if I post my password it will automatically change it to stars, see: *************

hunter2
Post reply on HN