Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Meta fined $102M for storing passwords in plain text

engadget.com

Post reply on HN
Print view View original

71–80 of 136 posts

Re: Meta fined $102M for storing passwords in plain text

#71

Post by pbhjpbhj »

FartyMcFarter wrote: post #35
tjpnz wrote: post #30

Earlier quoted context omitted.

When you select candidates based on whether they know how to invert a BST and other trivia it's not terribly surprisingly.

How would you select candidates to make sure they avoid this kind of security bug?

Avoiding the bug in the first place is not the big issue, surely. An employee can leave a door open to a secure area, if you employ security people they should have worked to mitigate that, and to catch it if it did happen.

Well "we want to run an audit to find if any passwords are stored in plaintext in our file systems". Sounds like a problem any highschooler could answer?

The idea of an audit might need a person who has done a remedial level of security work.

Re: Meta fined $102M for storing passwords in plain text

#72

Post by miningape »

oefrha wrote: post #42
foota wrote: post #28

It's mentioned in nested comments, but (as you'd probably expect) meta does not intend to store passwords in plaintext. There was a bug where they were logging plaintext passwords for some period of time e.g., when someone tried to log in etc.,.

To the (intentionally?) obtuse responses: intending to store passwords in plaintext usually means storing plaintext passwords in databases and doing authentication with that; and that’s what the gazillion of commenters replying to the title are implying. Mistakenly logging credentials because of e.g. badly interacting HTTP middleware is still a very nasty bug, but it doesn’t count as intending to store passwords in p…

Can confirm, have broken GDPR before through logging customer (and customer's customer) PII. It lasted for about a month before we realised and I had to go through the logs 1 by 1 over 3 days to remove all the data.

Re: Meta fined $102M for storing passwords in plain text

#73

Post by yakshaving_jgt »

tjoff wrote: post #64
vidarh wrote: post #59

Earlier quoted context omitted.

Passwords are just data. If said data is not tagged in a way that makes it clear it is a password, finding an algorithm that will successfully blot out passwords in the general case is intractable without being far too aggressive to be useful. All such tools rely on assumptions about what will be logged following certain rules that the logging can check against - it's not hard to accidentally convert data to a format…

HN does it, if I post my password it will automatically change it to stars, see: *************

correct-horse-battery-staple

Hmm… Not sure if it worked?

Re: Meta fined $102M for storing passwords in plain text

#74

Post by jart »

nolok wrote: post #57
foota wrote: post #28

It's mentioned in nested comments, but (as you'd probably expect) meta does not intend to store passwords in plaintext. There was a bug where they were logging plaintext passwords for some period of time e.g., when someone tried to log in etc.,.

And they're not fined for storing in plaintext, nor for storing in plaintext by mistake, they're fined because the law give a time limit for you to notify the regulator after you notice it and they waited too long. And in this specific case just to be clear it's not about taking too long to notify the public / customer, but about taking too long to notify regulator (the delay is much shorter). And they're not suppose…

How long has that even been a regulation and in which countries does it apply? Software engineers are trained to view these kinds of things as bugs. Legal isn't trained to monitor bug trackers.

Re: Meta fined $102M for storing passwords in plain text

#75

Post by dangsux »

miningape wrote: post #72
oefrha wrote: post #42

Earlier quoted context omitted.

To the (intentionally?) obtuse responses: intending to store passwords in plaintext usually means storing plaintext passwords in databases and doing authentication with that; and that’s what the gazillion of commenters replying to the title are implying. Mistakenly logging credentials because of e.g. badly interacting HTTP middleware is still a very nasty bug, but it doesn’t count as intending to store passwords in p…

Can confirm, have broken GDPR before through logging customer (and customer's customer) PII. It lasted for about a month before we realised and I had to go through the logs 1 by 1 over 3 days to remove all the data.

[dead]

Re: Meta fined $102M for storing passwords in plain text

#76

Post by tjpnz »

Arbortheus wrote: post #46
FartyMcFarter wrote: post #35

Earlier quoted context omitted.

How would you select candidates to make sure they avoid this kind of security bug?

“You are building an account authentication system and need to store user passwords, what design measures would you take to ensure this would be done securely?” Follow up question. “What measures would you take to ensure this complies with relevant data protection regulations?” If they give a somewhat competent answer, you at least know they’re the sort of developer that can critically analyse this sort of thing.

>What measures would you take to ensure this complies with relevant data protection regulations?

We hire devs to work on safety critical systems and do gauge for familiarity with standards applicable to our industry. This happens regardless of whether you're mid career or a new grad. I don't think it unreasonable to expect similar of devs working on systems where there are security or privacy considerations (which might as well be everything).

Re: Meta fined $102M for storing passwords in plain text

#78

Post by yunohn »

nomilk wrote: post #53
yunohn wrote: post #50

Earlier quoted context omitted.

I think it’s actually much easier to make such mistakes at large companies with sprawling codebases and potential for settings that inadvertently end up logging sensitive data. Especially for nobody to notice either.

True but they're also better resourced in terms of humans (and their experience) and tooling that should prevent or at least catch any blunders quickly.

You’d be surprised, but from my first hand FAANG experience that is definitely not the case. Tooling can capture things that are known to it - but not everything is setup perfectly.

Re: Meta fined $102M for storing passwords in plain text

#80

Post by JCharante »

jart wrote: post #74
nolok wrote: post #57

Earlier quoted context omitted.

And they're not fined for storing in plaintext, nor for storing in plaintext by mistake, they're fined because the law give a time limit for you to notify the regulator after you notice it and they waited too long. And in this specific case just to be clear it's not about taking too long to notify the public / customer, but about taking too long to notify regulator (the delay is much shorter). And they're not suppose…

How long has that even been a regulation and in which countries does it apply? Software engineers are trained to view these kinds of things as bugs. Legal isn't trained to monitor bug trackers.

it's GDPR from the subheader

> The Irish Data Protection Commission found that the company violated several GDPR rules.

this is why lots of websites block the EU from accessing. You basically need to consult with lawyers to make sure you're not accidentally breaking the law when writing a codebase.

Post reply on HN