Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ex-WhatsApp cybersecurity head says Meta endangered billions of users

theguardian.com

Post reply on HN
Print view View original

131–140 of 192 posts

Re: Ex-WhatsApp cybersecurity head says Meta endangered billions of users

#131

Post by bcye »

alex1138 wrote: post #94
gerdesj wrote: post #53

"He also claimed the company failed to remedy the hacking and takeover of more than 100,000 accounts each day, ignoring his pleas and proposed fixes and choosing instead to prioritize user growth." There is no oversight of these monstrosities of any sort. I doubt anyone would have issues with the thesis that Meta would implement anything that might curb their user numbers unless it was mandated. Why would they? They…

Zuckerberg has a different class of shares And not every CEO begins life in their company with "if you need any info just ask, they trust me, dumb fucks"

Where is that quote from?

Re: Ex-WhatsApp cybersecurity head says Meta endangered billions of users

#132

Post by RyJones »

thaumasiotes wrote: post #98
cataflam wrote: post #31

Earlier quoted context omitted.

> outside of the West you probably mean outside of the USA, it's huge in Europe/UK (which doesn't contradict your main point)

I would have thought he meant "inside of the West". Outside of the West you have other channels. Russia: Telegram Taiwan: Line Japan: Line By contrast, WhatsApp is best known to me for being used in Europe, Australia, and India.

Japan is mostly Instagram, line, WhatsApp, telegram, in that order, for me.

For business comms drop instagram and move WhatsApp to first.

For Singapore it seems LinkedIn messages are the go to IM for business.

Europe p2p: telegram number one by a huge margin, then WhatsApp. B2b: WhatsApp, period.

Re: Ex-WhatsApp cybersecurity head says Meta endangered billions of users

#133

Post by testdelacc1 »

imiric wrote: post #108
United857 wrote: post #86

That's rather surprising about the accessing user data bit. When I was at Meta, the quickest way to get fired as an engineer was to access user data/accounts without permission or business reason. Everything was logged/audited down to the database level. Can't imagine that changing and the rules are taught very early on in the onboarding/bootcamp process.

Whatever Meta says publicly about this topic, and whatever its internal policies may be, directly contradicts its behavior. So any attempt to excuse this is nothing but virtue signalling and marketing. The privacy violations and complete disregard for user data are too numerous to mention. There's a Wikipedia article that summarizes the ones we publicly know about. Based on incentives alone, when the company's primar…

There’s a meaningful difference in a company wanting to exploit user data to enrich itself and allowing employees to engage in voyeurism. The latter doesn’t make the company money, and therefore can be penalised at no cost.

Your comment talks about incentives, but you haven’t actually made a rational argument tying actual incentives to behaviour.

Re: Ex-WhatsApp cybersecurity head says Meta endangered billions of users

#134

Post by sulandor »

dijit wrote: post #130
lordofgibbons wrote: post #5

Given how WhatsApp is the de-facto way to communicate outside of the West and China, these security/data-handling "weaknesses" are most likely a feature, not a bug. An absolute bonanza for the certain intelligence services. Remember, kids: End to end encryption is useless if the "ends" are fully controlled by an (untrustworthy) third party.

> End to end encryption is useless if the "ends" are fully controlled by a (..) third party. YES!

although e2ee does raise the cost for an attacker, the perceived gain in trustworthiness of the system is unjustified

Re: Ex-WhatsApp cybersecurity head says Meta endangered billions of users

#135

Post by ThePowerOfFuet »

bcye wrote: post #131
alex1138 wrote: post #94

Earlier quoted context omitted.

Zuckerberg has a different class of shares And not every CEO begins life in their company with "if you need any info just ask, they trust me, dumb fucks"

Where is that quote from?

https://www.businessinsider.com/well-these-new-zuckerberg-im...

Re: Ex-WhatsApp cybersecurity head says Meta endangered billions of users

#136

Post by simmerup »

aprilthird2021 wrote: post #127
United857 wrote: post #86

That's rather surprising about the accessing user data bit. When I was at Meta, the quickest way to get fired as an engineer was to access user data/accounts without permission or business reason. Everything was logged/audited down to the database level. Can't imagine that changing and the rules are taught very early on in the onboarding/bootcamp process.

Everything is logged, but no one really cares, and the "business reasons" are many and extremely generic. That being said, maybe I'm dumb but I guess I don't see the huge risk here? I could certainly believe that 1500 employees had basically complete access with little oversight (logging and not caring isn't oversight imo). But how is that a safety risk to users? User information is often very important in the day to…

You really don't see the safety risk?

If you have a sister,imagine her being stalked by an employee?

If you have crypto, imagine an employee selling your information to a third party?

Re: Ex-WhatsApp cybersecurity head says Meta endangered billions of users

#137

Post by dns_snek »

dijit wrote: post #128
MrDresden wrote: post #123

Earlier quoted context omitted.

But the crucial bit to know here would be if that data was readable in anyway in case it was accessed? Personally it doesn't matter if there are auditing systems in place, if the data is readable in any way, shape or form.

is that really true? I haven’t touched a lot of these cyber security parts of industry: especially policies for awhile… … but I do recall that auditing was a stronger motivator than preventing. There were policies around checking the audit logs, not being able to alter audit logs and ensuring that nobody really knew exactly what was audited. (Except for a handful of individuals of course.) I could be wrong, but “obse…

As a customer I'm angry that businesses get to use "hope and pray" as their primary data protection measure without being forced to disclose it. "Motivators" only work on people who value their job more than the data they can access and I don't believe there's any organization on this planet where this is true for 100% of the employees, 100% of the time.

That strategy doesn't help a victim who's being stalked by an employee, who can use your system to find their new home address. They often don't care if they get fired (or worse), so the motivator doesn't work because they aren't behaving rationally to begin with.

Re: Ex-WhatsApp cybersecurity head says Meta endangered billions of users

#138

Post by tgsovlerkhgsel »

> including contact information, IP addresses and profile photos “without detection or audit trail”.

As many holes as WhatsApp's "E2E" encryption has, this shows how valuable it still is. It's all metadata, not message content.

Re: Ex-WhatsApp cybersecurity head says Meta endangered billions of users

#139

Post by [deleted] »

saagarjha wrote: post #64
lordofgibbons wrote: post #5

Given how WhatsApp is the de-facto way to communicate outside of the West and China, these security/data-handling "weaknesses" are most likely a feature, not a bug. An absolute bonanza for the certain intelligence services. Remember, kids: End to end encryption is useless if the "ends" are fully controlled by an (untrustworthy) third party.

Ok, what do you suggest instead?

[deleted]

Re: Ex-WhatsApp cybersecurity head says Meta endangered billions of users

#140

Post by tgsovlerkhgsel »

lordofgibbons wrote: post #5

Given how WhatsApp is the de-facto way to communicate outside of the West and China, these security/data-handling "weaknesses" are most likely a feature, not a bug. An absolute bonanza for the certain intelligence services. Remember, kids: End to end encryption is useless if the "ends" are fully controlled by an (untrustworthy) third party.

E2EE is likely the reason why this supposedly includes "contact information, IP addresses and profile photos" and not message content.
Post reply on HN