Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Meta fined $102M for storing passwords in plain text

engadget.com

Post reply on HN
Print view View original

111–120 of 136 posts

Re: Meta fined $102M for storing passwords in plain text

#111

Post by AmericanChopper »

ethbr1 wrote: post #109
AmericanChopper wrote: post #105

Earlier quoted context omitted.

Sure, and I don’t disagree that it’s a bad situation for Meta to have created. It’s being fined for “potentially violating” a statute that I find objectionable. Being breached implies that some harm befell consumers, this article (and the others I’ve read about this incident) don’t make any reference to an actual harm being uncovered.

I think there should be a "reasonable expectation" of a breach having happened. Secrets laying in an accessible place for 7 years... reasonable expectation is someone looked at them.

It’s a reasonable possibility, it’s also a reasonable possibility that nobody did.

But somebody incidentally seeing them, and maybe, maybe not recognising they were passwords is not a breach. Somebody intentionally misusing them would be, and I haven’t seen anything to suggest there’s a reasonable expectation that that occurred.

A reasonable expectation is also not the standard of proof I’d generally like to see from a government attempting to enforce a penalty.

Re: Meta fined $102M for storing passwords in plain text

#112

Post by tzs »

foota wrote: post #28

It's mentioned in nested comments, but (as you'd probably expect) meta does not intend to store passwords in plaintext. There was a bug where they were logging plaintext passwords for some period of time e.g., when someone tried to log in etc.,.

Also, it is not against GDPR per se to store passwords in plain text. It is required to keep user data safe from unauthorized access and processing and encryption is one way to help with that, but if you have it sufficiently protected by other means it would be OK under GDPR to have it in plain text.

Avoiding ever storing passwords (or credit cards) in plain text [1] is actually harder than you might think.

Even if you outsource password handling by using some third party authorization service so passwords should never even touch your servers, and handle credit card payments by having them handled on your checkout page by a frame or JavaScript or something that only ever sends them directly to your payment processor, you can still end up with the damn things in plain text on your servers.

How? Because you receive emails to support that look like this:

> Hello; I'm a subscriber to your service, account "Bob666", password "S3cr!t", billed to my credit card 4111111111111111 with security code 123. That card is expiring. My new card is 4012888888881881 with security code 712, expiration date May 2026. Please use my new card for renewals. Thanks!

You may also receive messages like that in chat if you offer support via chat. And maybe even to email addresses other than support.

So now you've got a plain text password and two plain text credit numbers along with their security codes stored in the inboxes of everyone who is on the support list, and possibly also somewhere in the database of your ticketing system if mail to support automatically creates a ticket.

It gets worse. If you offer support by phone and that goes to voicemail after support hours you will find passwords and credit card numbers in there.

[1] Note: technically probably almost nothing is actually stored in plain text nowadays. It's almost always going to stored on a filesystem that is using filesystem level encryption, and that filesystem is likely on a block device that is doing block level encryption. But I believe when people talk about "plain text" storage it means at a higher level. If I store the string "this is a secret" in foo.txt, that counts as plain text even though foo.txt is on an encrypted filesystem on an encrypted disk.

Re: Meta fined $102M for storing passwords in plain text

#113

Post by ethbr1 »

AmericanChopper wrote: post #111
ethbr1 wrote: post #109

Earlier quoted context omitted.

I think there should be a "reasonable expectation" of a breach having happened. Secrets laying in an accessible place for 7 years... reasonable expectation is someone looked at them.

It’s a reasonable possibility, it’s also a reasonable possibility that nobody did. But somebody incidentally seeing them, and maybe, maybe not recognising they were passwords is not a breach. Somebody intentionally misusing them would be, and I haven’t seen anything to suggest there’s a reasonable expectation that that occurred. A reasonable expectation is also not the standard of proof I’d generally like to see from…

I think knowledge of them would absolutely be a breach, because you wouldn't be able to guarantee that person didn't remember and subsequently misuse them.

Re: Meta fined $102M for storing passwords in plain text

#114

Post by AmericanChopper »

ethbr1 wrote: post #113
AmericanChopper wrote: post #111

Earlier quoted context omitted.

It’s a reasonable possibility, it’s also a reasonable possibility that nobody did. But somebody incidentally seeing them, and maybe, maybe not recognising they were passwords is not a breach. Somebody intentionally misusing them would be, and I haven’t seen anything to suggest there’s a reasonable expectation that that occurred. A reasonable expectation is also not the standard of proof I’d generally like to see from…

I think knowledge of them would absolutely be a breach, because you wouldn't be able to guarantee that person didn't remember and subsequently misuse them.

If the data was publicly leaked then this argument would have some merit. But it wasn’t, the only people who could have accessed these passwords were insiders, and those passwords were used to protect data that many of them would have access to anyway.

There is no evidence any unauthorised party gained access to any private data as a result of this incident. There is no evidence that any authorised party misused data as a result of this incident. A “breach” that involves no unauthorised access, and no misuse is not a breach.

A control failure occurred, and it was remedied in the most appropriate way possible.

Re: Meta fined $102M for storing passwords in plain text

#115

Post by bongodongobob »

grayhatter wrote: post #106
Negitivefrags wrote: post #15

Earlier quoted context omitted.

The usual way this happens is accidentally logging passwords. Or even other cases where passwords happen to be included in something else. It can happen more easily than you think. Like for example, if you collect server side crash dumps, are you really taking care that there is no sensitive information sitting in the memory image stored in them?

the word you should use is carelessly, as in carelessly logging passwords. When working with data that you can reasonably expect to contain secrets, you should behave as if it does contain secrets. It worries me that you mention you're aware that server side crash dumps may contain sensitive data, but you also speak as if it's reasonable to not protect them knowing they do, or they might. I'd hope or expect anyone wo…

What you're saying makes sense for a small startup with 20 people. Have you worked in an org of 10000+ that's been around for 30 years? Where the people who built the systems no longer work there? Where the people who maintain them are 3+ career cycles removed? Things get so baked in "one doesn't simply make changes" because no one person understands how everything works, so you do your best and keep closing tickets. "Hey we should really investigate whether or not passwords are included in memory in our 2000 severs across the globe!" "Lol ok maybe when you close out the 30 tickets on your plate."

Re: Meta fined $102M for storing passwords in plain text

#117

Post by smittywerben »

AmericanChopper wrote: post #108
smittywerben wrote: post #92

Earlier quoted context omitted.

I don't know about you but if tens of millions of passwords stored in plaintext are accessible to 80k people they're as good as useless now. You're thinking too much like "hacker selling data security" and not enough like "stalker who works at facebook logged into my gmail because I use the same password as my facebook" regular bob security. Just because you didn't end up in a dataset on some forum doesn't mean that…

If this control failure allowed malicious insiders to access private data, and misuse people’s personal accounts, then a data breach would have actually occurred. But I haven’t seen any suggestion that this happened, only references to the possibility that it might have happened. I’m really just thinking like somebody who believes that if the government is going to punish you for something, then I believe the event y…

I could agree that this fine is bureaucratic Big Compliance enforcing its made-up standards. At the same time, it's hard for me to feel bad for Facebook.

If someone's violating internal auditing procedures, those same procedures won't catch them. It's dangerous because it's a violation of the procedure itself. Proving such violations without tools like no-knock warrants or the NSA moving in is nearly impossible.

So you end up with a misappropriated circus of Big Compliance issuing fines over no wrongdoing and internal audits finding no wrongdoing when you rarely hear about this type of internal abuse unless someone is careless enough to brag about it to their Tinder date.

Re: Meta fined $102M for storing passwords in plain text

#118

Post by mdhb »

JCharante wrote: post #95
mdhb wrote: post #91

Earlier quoted context omitted.

This is also factually incorrect https://tradingeconomics.com/country-list/gdp?continent=euro...

How so? Your source shows that Asia + North America make up like 67% of global GPD.

The $18349 Billion GDP. What did you think I was referring to? Were you trying to be daft?

Re: Meta fined $102M for storing passwords in plain text

#119

Post by bongodongobob »

bongodongobob wrote: post #24
can16358p wrote: post #8

I really don't get how companies so large do stupid things like this. Hashing and salting passwords isn't some newly introduced advanced rocket science, it's literally a 101-level "obvious" thing. How can a huge corporation like Meta/Facebook can do this is beyond my imagination.

I'm honestly never surprised by any of this stuff. I've done some contracting and file access is always a shitshow. Picture this: > Intern or contractor gets hired. > Someone runs a script to create the user because permissions have turned into a rats nest that no human can understand > No one knows how the script works anymore, it's probably outdated and only does 60% of the job > User is added to a quagmire of grou…

To the comment below about measuring security... Usually this comes from putting security theater over pragmatism. Everything is so granular it's impossible to figure out what people need so you fuck around with it for a day and then give up and just give em local admin because actual work needs to be done. You can't get away from the fact that work requires write access. All those groups and policies are meaningless when the rubber hits the road. In the end you just have to hire people who can be trusted to do the right thing and not burn the house down.

Re: Meta fined $102M for storing passwords in plain text

#120

Post by nolok »

JCharante wrote: post #86
omnimus wrote: post #84

Earlier quoted context omitted.

“lots” not really as most companies want accesss to european market. Also no you dont need to consult lawyers when writing code. You just dont track and save data and do questionable stuff with it. Saving passwords in logs is surely security issue first before its GDPR issue.

yes it's a security issue but you wouldn't "expect" to get fined millions of dollars. Do I think we should punish companies for storing passwords in plaintext? Yes. Would I expect that a bug and devs untrained in GDPR best practices could lead to fines? No. Usually in software engineering you don't get your company fined for making terrible mistakes unless you're in a field like finance. This was just passwords which…

> yes it's a security issue but you wouldn't "expect" to get fined millions of dollars.

Which is exactly why companies don't care, which is why this regulation was made and those fines decided.

> Usually in software engineering you don't get your company fined for making terrible mistakes unless you're in a field like finance.

You're not fined for a mistake, you're fined for a mistake AND that mistake huer the customer more than you AND you don't disclose it swiflty to him.

Post reply on HN