Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Getting any Facebook user's friend list and partial payment card details

josipfranjkovic.com

Post reply on HN
Print view View original

21–30 of 95 posts

Re: Getting any Facebook user's friend list and partial payment card details

#21

Post by zitterbewegung »

tintor wrote: post #13
tannerc wrote: post #2

Important last-line: "It took Facebook's team 4 hours and 13 minutes to fix the issue - the fastest report-to-fix for me."

".. Facebook's team .." Most likely a single dedicated person at FB.

They have a dedicated Bug report team that sifts through the nonsense so it can't just be one person..

Re: Getting any Facebook user's friend list and partial payment card details

#22

Post by sneak »

tintor wrote: post #13
tannerc wrote: post #2

Important last-line: "It took Facebook's team 4 hours and 13 minutes to fix the issue - the fastest report-to-fix for me."

".. Facebook's team .." Most likely a single dedicated person at FB.

Who sometimes has a day off, or takes a vacation, or has an illness, so you’re looking at a minimum of 3 persons...

Re: Getting any Facebook user's friend list and partial payment card details

#23

Post by stochastic_monk »

aje403 wrote: post #12
cheeze wrote: post #11

Earlier quoted context omitted.

Wow. That is extremely impressive that such a large company is able to get a fix out that quickly.

If it took much longer than that for bugs like this, all of the HN doomsday posts about the Facebook mass exodus might actually come true

I think people leaving facebook en masse would be a good thing (TM) for society, not a doomsday. Fewer echo chambers, less disinformation, and people forced to make effort to contact each other.

Re: Getting any Facebook user's friend list and partial payment card details

#24

Post by ryanbrunner »

guessmyname wrote: post #19
sigsegv0xb wrote: post #17

Earlier quoted context omitted.

Do you mean that FB only has one single dedicated person looking at Whitehat tickets or that a single developer made the fix?

A single developer made the fix.

And in all likelihood, someone else monitored the incoming reports, recognized that this was a high-priority issue, and fast-tracked it to the developer. On top of that, I don't know Facebook's process that well, but releasing something that quickly probably involved some coordination to get it out so fast. Maybe someone else verified it, maybe someone fast-tracked it through the approval / launch process, etc.

Even things like bugfixes are rarely entirely creditable to only developers.

Judging by the name of the endpoint, it probably wasn't a super-complicated fix anyway - just disable / blacklist the endpoint that was obviously a mistake / test.

Re: Getting any Facebook user's friend list and partial payment card details

#25

Post by pinkythepig »

jpollock wrote: post #3
tannerc wrote: post #2

Important last-line: "It took Facebook's team 4 hours and 13 minutes to fix the issue - the fastest report-to-fix for me."

That's because you should never have first 6 and last 4 in the same place at the same time, particularly to someone who is not the owner of the card! That leaves only 6 digits to guess to obtain a valid card, and you're given the check digit to limit the search further.

First 6 is shared across the cards a particular bank issues. Its not a secret as you can google the first 6 to find the bank or even the reverse google the bank to see what BINs they use. Last 4 is intended to be human visible so people can identify the card in use. When you factor in the check digit ruling out 90% of the remaining combinations, there are still 10,000 valid cc combinations plus an expiration date you would have to guess just to get a single acct.

Re: Getting any Facebook user's friend list and partial payment card details

#26

Post by clarkenheim »

stochastic_monk wrote: post #23
aje403 wrote: post #12

Earlier quoted context omitted.

If it took much longer than that for bugs like this, all of the HN doomsday posts about the Facebook mass exodus might actually come true

I think people leaving facebook en masse would be a good thing (TM) for society, not a doomsday. Fewer echo chambers, less disinformation, and people forced to make effort to contact each other.

It will only be replaced with another echo chamber.

Re: Getting any Facebook user's friend list and partial payment card details

#28

Post by user5994461 »

cheeze wrote: post #11
tannerc wrote: post #2

Important last-line: "It took Facebook's team 4 hours and 13 minutes to fix the issue - the fastest report-to-fix for me."

Wow. That is extremely impressive that such a large company is able to get a fix out that quickly.

It's a trivial bug. If the parameter is invalid, return nothing, rather than return all the credit cards.

I'd be worried if any company is not able to understand the problem and publish a patch in a few hours.

Re: Getting any Facebook user's friend list and partial payment card details

#29

Post by yashap »

tannerc wrote: post #2

Important last-line: "It took Facebook's team 4 hours and 13 minutes to fix the issue - the fastest report-to-fix for me."

Agreed! Security bugs are going to happen in any sufficiently large piece of software (that wasn’t written by djb). The important thing is to work hard towards minimizing them, and fixing them quickly once found - seems to me Facebook does a good job on both of these points.
Post reply on HN