Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Facebook engineer abused access to user data to track down woman

businessinsider.com.au

Post reply on HN
Print view View original

101–108 of 108 posts

Re: A Facebook engineer abused access to user data to track down woman

#101

Post by cfors »

BoiledCabbage wrote: post #98
cfors wrote: post #63

Earlier quoted context omitted.

These comment's are all relatively ignorant of the fact that implementing these sorts of privacy controls generally makes your product worse and your engineers miserable. > Facebook employees were granted user data access in order to “cut away the red tape that slowed down engineers,” the book says. If we can take a step back, this is a totally reasonable policy. Unfortunately Facebook is facing the reality of the la…

> Maybe this is a hot take, but I for one prefer that my company trusts me to do the right thing rather than make it hard to do my job. Yes and banks shouldn't lock their vaults or safe deposit boxes because and just trust that all of their employees just want to do their jobs.

Let me be clear here, I'm not advocating for ZERO access control or audit logs here!

Let's take that bank argument, I'm definitely not advocating for not locking vaults or safe deposit boxes. But somebody has access to those, and when they need access they have a process for getting to it. Frankly, it definitely can be abused and banks wouldn't know for the better until after the abuse when the employee would be terminated and taken to court.

That's because they have audit logs in place. And the reason why its part of your contract as an engineer not to abuse your access to customer data.

I think the larger point I'm trying to make here is that its really, really hard to build a system that prevents any type of abuse of data. Now I'm not saying that we shouldn't strive for systems that make it hard to abuse customers data, but bad actors have ways of beating these systems and I have some empathy for a policy that places trust in employees (who need access, by definition of their job!) to not abuse it.

Anyways, these are all good comments made in response to mine. I agree with them!

[EDIT] Okay - I see the incoming point about them not needing access to that data for their job, that's a fair point. But I think most of us have been at a point in our careers where knowing the piece of information about a user that might have gotten them into a certain state is occasionally a valuable debugging tool.

Re: A Facebook engineer abused access to user data to track down woman

#102

Post by dividedbyzero »

efsavage wrote: post #45
emtel wrote: post #15

I worked at Facebook for most of 2017 and 2018. In the first week, they made it clear that you would be fired instantly for any improper access of user data. They further said that if you need to access any sensitive personal data, or if you need to log in as a user in order to debug a problem, you need to have approval from your manager _before_ the access, not after. Also, you are not allowed to access the data of…

Agreed, I was there at the same time, and was taken pretty seriously, and grew progessively more locked down as time went on. A friend of mine worked at a large bank in customer service and this was also a big part of their training, and there was even a speech trainees were given before going to their desk at the end of training. He said, almost invariably, that at least one person from every class was fired within…

> almost invariably, that at least one person from every class was fired within hours for looking up the accounts of someone they knew or a celebrity.

While I don't doubt people do this for real, staging something like that might actually be pretty effective.

Re: A Facebook engineer abused access to user data to track down woman

#103

Post by darkwizard42 »

jsbdk wrote: post #73
darkwizard42 wrote: post #72

Earlier quoted context omitted.

Disclaimer: was at FB in 2014 You could at the time start trying to log in as a user and MULTIPLE red warnings came up that proceeding further would automatically notify your manager and skip of access and a reminder of data policies. Now at that point I did not go further but I did know that content moderation and security teams had special access so I imagine they did both, heavily warn avg FB eng AND restrict acce…

How about people with direct database access?

Pretty strict. You don't get direct db access unless in a very specific team/role. You have to request access to tables on a per-table basis.

I believe this is similar to how Google does it.

Re: A Facebook engineer abused access to user data to track down woman

#104

Post by Arainach »

LanceH wrote: post #97
cycomanic wrote: post #93

Earlier quoted context omitted.

If we take your argument further all engineers should be given the root password to all production servers and we should simply trust them (and keep logs) to not use the password? Access control is something so central to IT systems that I'm frankly dumbstruck that someone would argue against them on HN.

If you don't need access, you shouldn't have it. If you do need it to do your job, you shouldn't have to run to your manager several times a day to make a request to do it. You should have root or whatever is necessary and it can be audited. I'm not arguing against access control. I'm arguing for those with responsibility to work to be given the commensurate authority to do their work -- with auditing even.

Who are these hypothetical employees who need to access customer data multiple times per day? If there are more than 5 of them in your O(1000) organization you have serious issues.

For 99.9% of employees, accessing customer data should absolutely be a "talk to your manager" level of occurrence, and each time it happens the manager should ask why it was necessary and what logging you need to add such that you don't need to do it again.

Re: A Facebook engineer abused access to user data to track down woman

#105

Post by BoiledCabbage »

cfors wrote: post #101
BoiledCabbage wrote: post #98

Earlier quoted context omitted.

> Maybe this is a hot take, but I for one prefer that my company trusts me to do the right thing rather than make it hard to do my job. Yes and banks shouldn't lock their vaults or safe deposit boxes because and just trust that all of their employees just want to do their jobs.

Let me be clear here, I'm not advocating for ZERO access control or audit logs here! Let's take that bank argument, I'm definitely not advocating for not locking vaults or safe deposit boxes. But somebody has access to those, and when they need access they have a process for getting to it. Frankly, it definitely can be abused and banks wouldn't know for the better until after the abuse when the employee would be term…

> a point in our careers where knowing the piece of information about a user that might have gotten them into a certain state is occasionally a valuable debugging tool.

Exactly - that's the problem with the mentality in tech right now. Just because something might make your life easier doesn't mean you get to have it. Trading user privacy is not ok because it's "occasionally a valuable debugging tool". That is exactly the problem.

Too many people in tech companies show no responsibility for the data they have privilege to - and treat privacy as absolutely minimal.

You're a parent, you wonder what's going on in your daughter's life and she isn't talking to you about it. You don't then get to break into her diary and read it all because it might give you a tip on being a better parent to her. Yes if she's for example suicidal and there is an urgent situation where reading it might help save her, then of course access it. But corporations don't get to toss aside privacy just because "it might occasionally be a valuable debugging tool".

Write a debug helper tool to clone all of a users state with lorem ipsum.

Re: A Facebook engineer abused access to user data to track down woman

#106

Post by k12sosse »

na85 wrote: post #90
emtel wrote: post #15

I worked at Facebook for most of 2017 and 2018. In the first week, they made it clear that you would be fired instantly for any improper access of user data. They further said that if you need to access any sensitive personal data, or if you need to log in as a user in order to debug a problem, you need to have approval from your manager _before_ the access, not after. Also, you are not allowed to access the data of…

Meanwhile the CEO volunteered early on to dox people at Harvard pretty much for funsies[0]. Yet TFA contains a quote about how abusing personal data is "against Mark's DNA". Horseshit. Facebook is the enemy. [0] https://www.esquire.com/uk/latest-news/a19490586/mark-zucker...

Didn't it start as a hotornot clone using girls pictures without their approval?

Never understood why anyone would trust this guy if that was the case. Pervs are some of the most reliably untrustables on the planet.

Re: A Facebook engineer abused access to user data to track down woman

#107

Post by cfors »

BoiledCabbage wrote: post #105
cfors wrote: post #101

Earlier quoted context omitted.

Let me be clear here, I'm not advocating for ZERO access control or audit logs here! Let's take that bank argument, I'm definitely not advocating for not locking vaults or safe deposit boxes. But somebody has access to those, and when they need access they have a process for getting to it. Frankly, it definitely can be abused and banks wouldn't know for the better until after the abuse when the employee would be term…

> a point in our careers where knowing the piece of information about a user that might have gotten them into a certain state is occasionally a valuable debugging tool. Exactly - that's the problem with the mentality in tech right now. Just because something might make your life easier doesn't mean you get to have it. Trading user privacy is not ok because it's "occasionally a valuable debugging tool". That is exactl…

I don't need to know anything about user123 outside of the fact that they are located in Perth, Australia.

Nothing else matters to me for this, I don't have access to any PII data like email or device (look, I know user ID's can technically be considered PII depending on which infosec person you're talking too).

Is this still a problem?

I understand your metaphors but without knowing that user123, who created a ticket in our system, is in Perth Australia (which for some reason that locality in my own metaphorical example is having issues processing payments) how we're supposed to resolve this.

Maybe I'm just hopelessly optimistic that people aren't as awful as we want them to be, or naive.

Re: A Facebook engineer abused access to user data to track down woman

#108

Post by harrisrobin »

emtel wrote: post #15

I worked at Facebook for most of 2017 and 2018. In the first week, they made it clear that you would be fired instantly for any improper access of user data. They further said that if you need to access any sensitive personal data, or if you need to log in as a user in order to debug a problem, you need to have approval from your manager _before_ the access, not after. Also, you are not allowed to access the data of…

The issue is that this is even a possibility. It should not be possible to access user data, even if a manager approves it.
Post reply on HN