Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Meta fined $102M for storing passwords in plain text

engadget.com

Post reply on HN
Print view View original

91–100 of 136 posts

Re: Meta fined $102M for storing passwords in plain text

#91

Post by mdhb »

JCharante wrote: post #87
omnimus wrote: post #84

Earlier quoted context omitted.

“lots” not really as most companies want accesss to european market. Also no you dont need to consult lawyers when writing code. You just dont track and save data and do questionable stuff with it. Saving passwords in logs is surely security issue first before its GDPR issue.

> “lots” not really as most companies want accesss to european market. Plenty of foreign newspapers block the EU from accessing their sites. The EU is not that a big market.

This is also factually incorrect https://tradingeconomics.com/country-list/gdp?continent=euro...

Re: Meta fined $102M for storing passwords in plain text

#92

Post by smittywerben »

AmericanChopper wrote: post #4

This is a very imaginative use of the word “breach”, according to the details reported in the article at least. Internal staff (inadvertently) had access to users plaintext passwords. The article doesn’t mention any use of these credentials in a breach though, and doesn’t make any refutation of Meta’s claim that this never occurred. Internal staff having access to my data is what I would normally expect from a servic…

I don't know about you but if tens of millions of passwords stored in plaintext are accessible to 80k people they're as good as useless now. You're thinking too much like "hacker selling data security" and not enough like "stalker who works at facebook logged into my gmail because I use the same password as my facebook" regular bob security. Just because you didn't end up in a dataset on some forum doesn't mean that someone's ex has a boyfriend who started his first day at facebook and left his laptop unattended and the ex saw see your facebook password is your "cat's name + 123" in the debug log and nobody at Facebook says anything for years or something.

Anyways I think it's fine for them to define breach as the loss/destruction of data i.e. making a password known, which destroys it's value.

Re: Meta fined $102M for storing passwords in plain text

#93

Post by maeil »

JCharante wrote: post #80
jart wrote: post #74

Earlier quoted context omitted.

How long has that even been a regulation and in which countries does it apply? Software engineers are trained to view these kinds of things as bugs. Legal isn't trained to monitor bug trackers.

it's GDPR from the subheader > The Irish Data Protection Commission found that the company violated several GDPR rules. this is why lots of websites block the EU from accessing. You basically need to consult with lawyers to make sure you're not accidentally breaking the law when writing a codebase.

I see this comment pop up here often in these threads about EU fines and regulations. "Apple/company should just call the EUs bluff and stop selling in the EU!".

Apple's a good example because they're such an incredibly global brand, who should be less reliant on EU customers. Yet Europe is responsible for >20% of their revenue. Shareholders would eat you alive for just "nope"ing away from that.

Yes, US GDP/capita is far above the EU average, but the EU still represents 450 million, on average fairly wealthy people. So companies simply play ball. And that excludes the UK, whose data protection laws are similarly strict.

Re: Meta fined $102M for storing passwords in plain text

#94

Post by oliwarner »

jart wrote: post #74
nolok wrote: post #57

Earlier quoted context omitted.

And they're not fined for storing in plaintext, nor for storing in plaintext by mistake, they're fined because the law give a time limit for you to notify the regulator after you notice it and they waited too long. And in this specific case just to be clear it's not about taking too long to notify the public / customer, but about taking too long to notify regulator (the delay is much shorter). And they're not suppose…

How long has that even been a regulation and in which countries does it apply? Software engineers are trained to view these kinds of things as bugs. Legal isn't trained to monitor bug trackers.

> Software engineers are trained to view these kinds of things as bugs

Competent engineers —software or other— must have an education in safety standards and legal regulations. I had a pretty formal education in data protection at both A-Level and undergrad. I know real engineers get tetchy about us programmers edging in, so if you want any claim to an engineering title, ignoring the ramifications of your code in the real world is unacceptable.

But that doesn't seem to be the problem here. Somebody did know it was bad, did fix it urgently, did report it internally and did an impact assessment. The problem was they needed to notify the regulator earlier so they knew it could have been a problem.

If these passwords were in the wild, delaying notification by however many days means attackers have more time to use stolen credentials. $100m sounds like a lot but a lot of these regulatory rules scale with the company so that punishments like this have impact. They need to improve how they handle security notification.

Re: Meta fined $102M for storing passwords in plain text

#95

Post by JCharante »

mdhb wrote: post #91
JCharante wrote: post #87

Earlier quoted context omitted.

> “lots” not really as most companies want accesss to european market. Plenty of foreign newspapers block the EU from accessing their sites. The EU is not that a big market.

This is also factually incorrect https://tradingeconomics.com/country-list/gdp?continent=euro...

How so? Your source shows that Asia + North America make up like 67% of global GPD.

Re: Meta fined $102M for storing passwords in plain text

#96

Post by JCharante »

maeil wrote: post #93
JCharante wrote: post #80

Earlier quoted context omitted.

it's GDPR from the subheader > The Irish Data Protection Commission found that the company violated several GDPR rules. this is why lots of websites block the EU from accessing. You basically need to consult with lawyers to make sure you're not accidentally breaking the law when writing a codebase.

I see this comment pop up here often in these threads about EU fines and regulations. "Apple/company should just call the EUs bluff and stop selling in the EU!". Apple's a good example because they're such an incredibly global brand, who should be less reliant on EU customers. Yet Europe is responsible for >20% of their revenue. Shareholders would eat you alive for just "nope"ing away from that. Yes, US GDP/capita is…

20% of revenue isn't that much. Would you rather focus on your core product and double your revenue, or focus on getting that 20%? Yes giant companies have the resources and experience less YoY growth so they will work with the EU market, but most companies would do better to ignore the EU.

Re: Meta fined $102M for storing passwords in plain text

#97

Post by AmericanChopper »

markarichards wrote: post #88
AmericanChopper wrote: post #17

Earlier quoted context omitted.

It’s a control failure, not a breach. It would also be an incident, one that could result in a subsequent breach, or one that warrants some work to be done to ensure it does not turn into a breach. But it has not resulted in an unauthorised party gaining access to the data, and is therefor not a breach.

It's relatively common for publications to lazily only reference an action that resulted in a legal outcome, rather than the justification provided for the outcome. For instance, Bob imprisoned for car bomb rather than Bob imprisoned after judgement rules deaths unlawfully resulted from Bob's malicious car bombing. Had Bob's car bomb been on a film set and no one hurt, Bob would hopefully be fine. If you read coverag…

Even by the broadest possible definition of a breach, this is still just a control failure rather than a breach. The control that failed might have made it possible for Meta employees to perpetrate a breach, but the article makes no mention of that happening, or provides any suggestion that there is evidence that it might have happened.

At at least one point in my career, I have also accidentally mishandled password data (I accidentally leaked them into a log one time - well one time that I know of at least). When I did that I caused a control to fail, and I caused a security incident that required follow up remediation work (including password resets and disclosure), which is exactly what happened here. But I did not cause a data breach to occur. I struggle to image a world where I could have caused my employer to be fined $102M for that incident, and for that to be deemed a data breach, when there is no evidence (presented or referenced in this article at least) that a breach ever occurred. If I leave the office and forget to lock the door, I've caused a control failure. But if nobody comes in to rob us, then I haven't caused a robbery or a breach or anything else like that to occur, even if a typical security policy might require me to lock the door before leaving.

The creativity required to come to this conclusion doesn't do anything to improve the credibility of the GDPR, which from an outside perspective really doesn't look like anything other than an import tariff on foreign tech in disguise.

Re: Meta fined $102M for storing passwords in plain text

#98

Post by Eddy_Viscosity2 »

maeil wrote: post #93
JCharante wrote: post #80

Earlier quoted context omitted.

it's GDPR from the subheader > The Irish Data Protection Commission found that the company violated several GDPR rules. this is why lots of websites block the EU from accessing. You basically need to consult with lawyers to make sure you're not accidentally breaking the law when writing a codebase.

I see this comment pop up here often in these threads about EU fines and regulations. "Apple/company should just call the EUs bluff and stop selling in the EU!". Apple's a good example because they're such an incredibly global brand, who should be less reliant on EU customers. Yet Europe is responsible for >20% of their revenue. Shareholders would eat you alive for just "nope"ing away from that. Yes, US GDP/capita is…

Noping out of europe would create a vacuum that would be filled by a competitor who would fully comply with the consumer protecting EU rules. Rules that many consumers in other nations would love to have themselves but don't because of regulatory capture and regular corruption. Those consumer friendly products would become popular outside of Europe. Big-US-monopoly-company would lose dominance. They would either have to change to be more consumer friendly or eat the loss of market share.

Re: Meta fined $102M for storing passwords in plain text

#99

Post by philistine »

JCharante wrote: post #96
maeil wrote: post #93

Earlier quoted context omitted.

I see this comment pop up here often in these threads about EU fines and regulations. "Apple/company should just call the EUs bluff and stop selling in the EU!". Apple's a good example because they're such an incredibly global brand, who should be less reliant on EU customers. Yet Europe is responsible for >20% of their revenue. Shareholders would eat you alive for just "nope"ing away from that. Yes, US GDP/capita is…

20% of revenue isn't that much. Would you rather focus on your core product and double your revenue, or focus on getting that 20%? Yes giant companies have the resources and experience less YoY growth so they will work with the EU market, but most companies would do better to ignore the EU.

Explain to me how not selling in the EU could double a company's revenue? How removing yourself from your third largest market would enlarge the others? How millions of people in the US don't buy an iPhone because you can buy iPhones in Germany?

Re: Meta fined $102M for storing passwords in plain text

#100

Post by nudgeee »

foota wrote: post #28

It's mentioned in nested comments, but (as you'd probably expect) meta does not intend to store passwords in plaintext. There was a bug where they were logging plaintext passwords for some period of time e.g., when someone tried to log in etc.,.

Indeed, this is a common vector for leaking PII and sensitive data. For example, what looks like an innocuous logging/print statement in an exception handler ends up leaking all sorts of data.

And it gets more messy when you start to ingest and warehouse data logs for on-call monitoring/analytics/etc, and now you have PII floating around in all sorts of data stores that need to be scrubbed.

In a previous job, we handled credit card numbers. We added PII detectors to logging libraries that would scrub anything that looked like a credit card number. We used client-side encryption where the credit card numbers are encrypted on the client before sending to the backend, so the backend systems never see the plain credit card numbers, except for the system that tokenizes them.

Post reply on HN