Live data from Hacker News

Meta fined $102M for storing passwords in plain text

engadget.com

81–90 of 136 posts

Re: Meta fined $102M for storing passwords in plain text

#81
post #74
post #57

Earlier quoted context omitted.

And they're not fined for storing in plaintext, nor for storing in plaintext by mistake, they're fined because the law give a time limit for you to notify the regulator after you notice it and they waited too long. And in this specific case just to be clear it's not about taking too long to notify the public / customer, but about taking too long to notify regulator (the delay is much shorter). And they're not suppose…

How long has that even been a regulation and in which countries does it apply? Software engineers are trained to view these kinds of things as bugs. Legal isn't trained to monitor bug trackers.

It’s part of GDPR. I’ve been given training on it at all (3) companies I’ve worked for and training has always included what constitutes a breach and what to do.

I would hope any company would treat it as an incident rather than just a bug where senior enough folks would be involved to know what their responsibilities are.

Re: Meta fined $102M for storing passwords in plain text

#84
post #74

Earlier quoted context omitted.

How long has that even been a regulation and in which countries does it apply? Software engineers are trained to view these kinds of things as bugs. Legal isn't trained to monitor bug trackers.

it's GDPR from the subheader > The Irish Data Protection Commission found that the company violated several GDPR rules. this is why lots of websites block the EU from accessing. You basically need to consult with lawyers to make sure you're not accidentally breaking the law when writing a codebase.

“lots” not really as most companies want accesss to european market.

Also no you dont need to consult lawyers when writing code. You just dont track and save data and do questionable stuff with it. Saving passwords in logs is surely security issue first before its GDPR issue.

Re: Meta fined $102M for storing passwords in plain text

#85
post #65
post #59

Earlier quoted context omitted.

Passwords are just data. If said data is not tagged in a way that makes it clear it is a password, finding an algorithm that will successfully blot out passwords in the general case is intractable without being far too aggressive to be useful. All such tools rely on assumptions about what will be logged following certain rules that the logging can check against - it's not hard to accidentally convert data to a format…

Not that hard [1]: Rails.application.config.filter_parameters += [ :passw, :email, :secret, :token, :_key, :crypt, :salt, :certificate, :otp, :ssn, :cvv, :cvc ] [1] https://github.com/rails/rails/blob/8a2e28d7451d5ae4cb194fcc...

Assuming, of course, that the data is logged as a parameter rather than as a raw string, or as an instance variable in another object, or any number of other ways. Developers thinking it is "not that hard" is a big red flag to me, suggesting odds are high your logs are full of things that should not be there. Using filters is a first step only.

Re: Meta fined $102M for storing passwords in plain text

#86
post #84

Earlier quoted context omitted.

it's GDPR from the subheader > The Irish Data Protection Commission found that the company violated several GDPR rules. this is why lots of websites block the EU from accessing. You basically need to consult with lawyers to make sure you're not accidentally breaking the law when writing a codebase.

“lots” not really as most companies want accesss to european market. Also no you dont need to consult lawyers when writing code. You just dont track and save data and do questionable stuff with it. Saving passwords in logs is surely security issue first before its GDPR issue.

yes it's a security issue but you wouldn't "expect" to get fined millions of dollars.

Do I think we should punish companies for storing passwords in plaintext? Yes. Would I expect that a bug and devs untrained in GDPR best practices could lead to fines? No.

Usually in software engineering you don't get your company fined for making terrible mistakes unless you're in a field like finance. This was just passwords which most sites have, not something like PCI DSS stuff

Re: Meta fined $102M for storing passwords in plain text

#87
post #84

Earlier quoted context omitted.

it's GDPR from the subheader > The Irish Data Protection Commission found that the company violated several GDPR rules. this is why lots of websites block the EU from accessing. You basically need to consult with lawyers to make sure you're not accidentally breaking the law when writing a codebase.

“lots” not really as most companies want accesss to european market. Also no you dont need to consult lawyers when writing code. You just dont track and save data and do questionable stuff with it. Saving passwords in logs is surely security issue first before its GDPR issue.

> “lots” not really as most companies want accesss to european market.

Plenty of foreign newspapers block the EU from accessing their sites. The EU is not that a big market.

Re: Meta fined $102M for storing passwords in plain text

#88
post #11

Earlier quoted context omitted.

In many senses, internal staff having access to plaintext passwords is a breach.

It’s a control failure, not a breach. It would also be an incident, one that could result in a subsequent breach, or one that warrants some work to be done to ensure it does not turn into a breach. But it has not resulted in an unauthorised party gaining access to the data, and is therefor not a breach.

It's relatively common for publications to lazily only reference an action that resulted in a legal outcome, rather than the justification provided for the outcome.

For instance, Bob imprisoned for car bomb rather than Bob imprisoned after judgement rules deaths unlawfully resulted from Bob's malicious car bombing. Had Bob's car bomb been on a film set and no one hurt, Bob would hopefully be fine.

If you read coverage with this in mind, then what matters is more a case of how likely an action is to be unlawful and thus how lazy the publication is being.

If someone blows up a car, we'd assume it was unlawful. If a company stores passwords unlawfully we'd assume it was unlawful and hopefully for good reason...

From GDPR: "personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed"

A typical security policy for securing passwords is to never store them in plaintext.

It would be a rare situation for the storage to not be accessible (what would be the point of storing it).

Thus it would seem fair to assume that in most cases plain text storage of passwords would be a breach of security (internal controls breach) would implicitly also be a breach of personal data (legal definition) as it would at the very least be accidentally accessible to staff, contractors or third parties (whoever hosts the storage).

So, it will likely fit the definition of a breach.

But, it still needs to escalate to a point where it would be recognised as serious enough to warrant action (like reporting to data subjects or regulators).

There are situations where storing passwords in plaintext may not warrant reporting or fines, such as if upon realising the breach it was evident that nobody had accessed the data and it was destructed before harm could be realised; but I doubt anyone would ever know about these situations happening in companies so it's fair to assume they wouldn't reach major news sites.

Re: Meta fined $102M for storing passwords in plain text

#89
post #74

Earlier quoted context omitted.

How long has that even been a regulation and in which countries does it apply? Software engineers are trained to view these kinds of things as bugs. Legal isn't trained to monitor bug trackers.

it's GDPR from the subheader > The Irish Data Protection Commission found that the company violated several GDPR rules. this is why lots of websites block the EU from accessing. You basically need to consult with lawyers to make sure you're not accidentally breaking the law when writing a codebase.

I probably encounter this like 5 times a year, your statement is wrong.

Re: Meta fined $102M for storing passwords in plain text

#90
post #57
post #28

It's mentioned in nested comments, but (as you'd probably expect) meta does not intend to store passwords in plaintext. There was a bug where they were logging plaintext passwords for some period of time e.g., when someone tried to log in etc.,.

And they're not fined for storing in plaintext, nor for storing in plaintext by mistake, they're fined because the law give a time limit for you to notify the regulator after you notice it and they waited too long. And in this specific case just to be clear it's not about taking too long to notify the public / customer, but about taking too long to notify regulator (the delay is much shorter). And they're not suppose…

To be clear, they are absolutely being fined for storing passwords in plaintext.

They chose not to mitigate the fine by following proper procedure.

Post reply on HN