Previous discussion: https://news.ycombinator.com/item?id=41669912#41672163
Meta fined $102M for storing passwords in plain text
101–110 of 136 posts
Re: Meta fined $102M for storing passwords in plain text
#102I would hope it's not the authentication team's systems that are logging payloads with passwords.. they should definitely know better. Presumably it happened some infrastructure component owned by another team.
Why are passwords leaving the auth services though?
Re: Meta fined $102M for storing passwords in plain text
#103Earlier quoted context omitted.
I think it's impossible to say there was no breach, given they were exposed for 7 years .
I would agree. Which is why I’m suggesting that the Irish Data Protection Commission and Engadget should refrain from saying that. It’s also impossible to say that I am not responsible for a breach of your private data either. How much should the Irish Data Protection Commission fine me?
"Potentially breached" would probably be an accurate phrasing.
If you had my private data written in the back of a notebook, that you carried around with you to coffee shops, for a few days, I'd feel substantially better than if you did it for a few years.
Likelihood that someone peeked scales with time.
Re: Meta fined $102M for storing passwords in plain text
#104Wow I didn't know this is illegal.
you didn't know that it was illegal to be careless in a way that's well known to cause harm to other people?
Re: Meta fined $102M for storing passwords in plain text
#105Earlier quoted context omitted.
I would agree. Which is why I’m suggesting that the Irish Data Protection Commission and Engadget should refrain from saying that. It’s also impossible to say that I am not responsible for a breach of your private data either. How much should the Irish Data Protection Commission fine me?
"Potentially breached" would probably be an accurate phrasing. If you had my private data written in the back of a notebook, that you carried around with you to coffee shops, for a few days, I'd feel substantially better than if you did it for a few years. Likelihood that someone peeked scales with time.
Sure, and I don’t disagree that it’s a bad situation for Meta to have created. It’s being fined for “potentially violating” a statute that I find objectionable. Being breached implies that some harm befell consumers, this article (and the others I’ve read about this incident) don’t make any reference to an actual harm being uncovered.
Re: Meta fined $102M for storing passwords in plain text
#106I really don't get how companies so large do stupid things like this. Hashing and salting passwords isn't some newly introduced advanced rocket science, it's literally a 101-level "obvious" thing. How can a huge corporation like Meta/Facebook can do this is beyond my imagination.
The usual way this happens is accidentally logging passwords. Or even other cases where passwords happen to be included in something else. It can happen more easily than you think. Like for example, if you collect server side crash dumps, are you really taking care that there is no sensitive information sitting in the memory image stored in them?
the word you should use is carelessly, as in carelessly logging passwords.
When working with data that you can reasonably expect to contain secrets, you should behave as if it does contain secrets. It worries me that you mention you're aware that server side crash dumps may contain sensitive data, but you also speak as if it's reasonable to not protect them knowing they do, or they might. I'd hope or expect anyone would mention or at least imply that it'd be negligent to behave so recklessly with someone else's secrets.
Re: Meta fined $102M for storing passwords in plain text
#107It's mentioned in nested comments, but (as you'd probably expect) meta does not intend to store passwords in plaintext. There was a bug where they were logging plaintext passwords for some period of time e.g., when someone tried to log in etc.,.
[deleted]
Re: Meta fined $102M for storing passwords in plain text
#108This is a very imaginative use of the word “breach”, according to the details reported in the article at least. Internal staff (inadvertently) had access to users plaintext passwords. The article doesn’t mention any use of these credentials in a breach though, and doesn’t make any refutation of Meta’s claim that this never occurred. Internal staff having access to my data is what I would normally expect from a servic…
I don't know about you but if tens of millions of passwords stored in plaintext are accessible to 80k people they're as good as useless now. You're thinking too much like "hacker selling data security" and not enough like "stalker who works at facebook logged into my gmail because I use the same password as my facebook" regular bob security. Just because you didn't end up in a dataset on some forum doesn't mean that…
If this control failure allowed malicious insiders to access private data, and misuse people’s personal accounts, then a data breach would have actually occurred. But I haven’t seen any suggestion that this happened, only references to the possibility that it might have happened. I’m really just thinking like somebody who believes that if the government is going to punish you for something, then I believe the event you’re being punished for should have actually occurred, and also that they should be able to prove it occurred.
If reference to standard security policies formed part of the basis of this decision (as the article states), then the harm that you’re trying to contrive into existence here also has no merit. There is no framework of information security that allows for a password to permanently retain its value as a secret keeping tool. Conventionally passwords have only retained their value for a set period of time, and even the most modern security standards for managing secrets requires you to rotate them at even the most remote possibility that they were exposed. The idea that a password rotation has harmed Facebook users, and the implication that their password was a valuable asset that they could reasonably expect to retain its value forever is quite ridiculous.
Re: Meta fined $102M for storing passwords in plain text
#109Earlier quoted context omitted.
"Potentially breached" would probably be an accurate phrasing. If you had my private data written in the back of a notebook, that you carried around with you to coffee shops, for a few days, I'd feel substantially better than if you did it for a few years. Likelihood that someone peeked scales with time.
Sure, and I don’t disagree that it’s a bad situation for Meta to have created. It’s being fined for “potentially violating” a statute that I find objectionable. Being breached implies that some harm befell consumers, this article (and the others I’ve read about this incident) don’t make any reference to an actual harm being uncovered.
I think there should be a "reasonable expectation" of a breach having happened.
Secrets laying in an accessible place for 7 years... reasonable expectation is someone looked at them.
Re: Meta fined $102M for storing passwords in plain text
#110I really don't get how companies so large do stupid things like this. Hashing and salting passwords isn't some newly introduced advanced rocket science, it's literally a 101-level "obvious" thing. How can a huge corporation like Meta/Facebook can do this is beyond my imagination.
An accidental print statement on the login page. That’s all it takes.