191–200 of 331 posts
Earlier quoted context omitted.
Similar punishment for similar transgressions is how the law is supposed to work.
> Similar punishment for similar transgressions is how the law is supposed to work. Facebook and Equifax did not commit similar transgressions, and to say to is misleading.
Earlier quoted context omitted.
I've worked for multiple Fortune 25 companies, and that excuse does not fly. Not in banking or healthcare, where breaches of privacy/confidentiality are actually illegal, rather than merely distasteful. Small teams and careless devs doing that sort of bad logging will be caught and corrected by strict security oversight. This is the sort of thing that leads the HN crowd to sneer at the old, slow ways of the enterpris…
The passwords in plaintext wasn't a breach or a leak. If you punish Facebook for it, they would be less inclined to share such information in the future.
What's to stop a malicious ex-lover from grabbing a FB password and reading that person's private messages? If FB didn't even know there were passwords in plaintext, they very likely weren't auditing log access as much as was needed.
[1] https://www.theverge.com/2019/3/21/18275837/facebook-plain-t...
Earlier quoted context omitted.
> will not acknowledge any wrongdoing as part of the settlement This bugs the heck out of me (in general, not specific to this case). What is point of letting them claim innocence? How does this benefit the consumer? I can see occasional exceptions where it's clearly a case of misunderstandings so you don't want to bring down the full hammer...but I honestly can't remember more than one such case where someone DID ac…
If Facebook admits wrongdoing they will lose every lawsuit brought against them going forward, which means they will contest the charges instead of settling. The FTC doesn’t want that, because an actual court case means they might lose, which would be bad for the careers of everyone involved. They’d rather just take the guaranteed W by offering FB a palatable settlement.
The title of this post/story, should be "Facebook Expects to be Fined Not More Than $5B by FTC," because a $5B fine would be extremely not-painful; there would be zero deterrent effect from a fine of this size.
Seems like they should add another 0 to the fine after the recent hat trick: 1) Prompting users to give Facebook their email passwords.[0] 2) Using that email access to "inadvertently" upload the information of their email contacts.[1] 3) Storing said passwords and others in plaintext. [2] It's pretty impressive that a company could do something so brazenly malevolent and be confident that they will escape with no mo…
Before this thread becomes a Facebook bashing session, please keep in mind that Equifax leaked all your SSN data along with names and addresses and got away with no fines.
The Equifax matter is far from over, they are being investigated by: 48 state Attorneys General offices, the District of Columbia, the FTC, the CFPB, the SEC, the Department of Justice, other U.S. state regulators, certain Congressional committees of both the Senate and House of Representatives, the Office of the Privacy Commissioner of Canada, and the U.K.’s Financial Conduct Authority.
Not to mention they made a recent SEC filing acknowledging they expect fines from FTC and CFPB.
Earlier quoted context omitted.
You speak with the hubris of a man that's never been in the arena.
Facebook hires some of the top software developers and engineers on the planet, if not leaking plaintext passwords is too high of an expectation for them then nothing that isn't public knowledge should ever be put into any computer system. As a profession we should demand our peers do better than this.
Earlier quoted context omitted.
If you're a small business - I get it, it's good to whitelist whatever information you're logging explicitly, but for smaller teams a hard to diagnose issue might lead the team to "log everything so we can sort it out later". Facebook is Facebook, whether this decision was the product of the corporation as a whole, a small dev team, or a highly paid consultant/third party, Facebook is a big enough company that they d…
I'm on a small team (5 engineers) that is GDPR compliant so no PII is logged. It's not hard if you care.
Earlier quoted context omitted.
Gonna have to disagree. I think it would be way worse if we found out they were storing passwords were plaintext in the database in 2019. Even if the security implications are the same/worse, the policy/decision making of such a revelation would be beyond terrible. edit: To put it another way, remote code execution flaws are terrible but they can happen. However it would be way worse if someone put in a static userna…
As is the policy/decision making that results in logs having the passwords - you can still have very locked down database access. Logs tend to get spread around all sorts of systems, and access control for logs is almost ALWAYS lower than DB keys. They're also cached for search-ability on any number of elasticsearch or business intelligence platforms, so getting rid of them after the fact is even harder. At the very…
Seems like they should add another 0 to the fine after the recent hat trick: 1) Prompting users to give Facebook their email passwords.[0] 2) Using that email access to "inadvertently" upload the information of their email contacts.[1] 3) Storing said passwords and others in plaintext. [2] It's pretty impressive that a company could do something so brazenly malevolent and be confident that they will escape with no mo…
I remember the era started by Sean Parker with Plaxo: https://en.wikipedia.org/wiki/Plaxo ... Everybody was doing it: https://blog.codinghorror.com/please-give-us-your-email-pass...
Shutting down these options, even if it is the right things to do for the users, is effectively increasing the barriers of entry and reducing the growing speed of new companies. The result is that those companies will maintain a dominant position on the market.