A Facebook engineer abused access to user data to track down woman • Hacker News Board

Re: A Facebook engineer abused access to user data to track down woman

#21

Post by Cthulhu_ » Wed, Jul 14, 2021, 2:22 PM UTC

agumonkey wrote: post #10

GrumpyNl wrote: post #6

Earlier quoted context omitted.

Company i used to work for gave almost every employee full access to the db through phpmyadmin.

Was it a social network thing too or a totally different market ?

I don't think it actually matters much; your database is your core business and access to it should be restricted. Same as your machines. To the point where, if you have everything set up right (which is a big if, granted), NOBODY should need physical access to ANY machine or database. All access through the application's management interface, where access can be finely tuned and access logs can be used to hold people accountable.

Re: A Facebook engineer abused access to user data to track down woman

#22

Post by flak48 » Wed, Jul 14, 2021, 2:22 PM UTC

pm90 wrote: post #18

emtel wrote: post #15

I worked at Facebook for most of 2017 and 2018. In the first week, they made it clear that you would be fired instantly for any improper access of user data. They further said that if you need to access any sensitive personal data, or if you need to log in as a user in order to debug a problem, you need to have approval from your manager _before_ the access, not after. Also, you are not allowed to access the data of…

There’s a difference between having an audit trail and actually using it. I would be interested to know how often Facebook analyzes this data and actually fires people for improper usage.

The article does mention more than 50 people being fired for it between 2014 and Aug 2015

Re: A Facebook engineer abused access to user data to track down woman

#23

Post by mrits » Wed, Jul 14, 2021, 2:23 PM UTC

There is 0% chance this article is correct. No employees at facebook had access to passwords for obvious reasons. Someone is trying to sell a book.

Re: A Facebook engineer abused access to user data to track down woman

#24

Post by sschueller » Wed, Jul 14, 2021, 2:23 PM UTC

Does anyone remember Uber's "god view". That has privacy violations written all over it, I wonder what happened to it.

Re: A Facebook engineer abused access to user data to track down woman

#25

Post by emtel » Wed, Jul 14, 2021, 2:23 PM UTC

pm90 wrote: post #18

emtel wrote: post #15

I worked at Facebook for most of 2017 and 2018. In the first week, they made it clear that you would be fired instantly for any improper access of user data. They further said that if you need to access any sensitive personal data, or if you need to log in as a user in order to debug a problem, you need to have approval from your manager _before_ the access, not after. Also, you are not allowed to access the data of…

There’s a difference between having an audit trail and actually using it. I would be interested to know how often Facebook analyzes this data and actually fires people for improper usage.

I don’t have proof, but we were told that every access of sensitive data was actively audited. It’s very rare to need to do this for your job, so I don’t imagine it’s a huge volume of events to be audited.

Re: A Facebook engineer abused access to user data to track down woman

#26

Post by mtmail » Wed, Jul 14, 2021, 2:23 PM UTC

pm90 wrote: post #18

emtel wrote: post #15

I worked at Facebook for most of 2017 and 2018. In the first week, they made it clear that you would be fired instantly for any improper access of user data. They further said that if you need to access any sensitive personal data, or if you need to log in as a user in order to debug a problem, you need to have approval from your manager _before_ the access, not after. Also, you are not allowed to access the data of…

There’s a difference between having an audit trail and actually using it. I would be interested to know how often Facebook analyzes this data and actually fires people for improper usage.

> I would be interested to know how often Facebook analyzes this data and actually fires people for improper usage.

From the article: Facebook fired 52 people from 2014 to August 2015 for abusing access to user data

Re: A Facebook engineer abused access to user data to track down woman

#27

Post by whatshisface » Wed, Jul 14, 2021, 2:24 PM UTC

emtel wrote: post #15

I worked at Facebook for most of 2017 and 2018. In the first week, they made it clear that you would be fired instantly for any improper access of user data. They further said that if you need to access any sensitive personal data, or if you need to log in as a user in order to debug a problem, you need to have approval from your manager _before_ the access, not after. Also, you are not allowed to access the data of…

There's a certain trend in most companies that every bureaucratic rule can be traced back to a specific event where someone caused a problem by doing what the rule was written to forbid - so it's possible that you were indirectly told about four incidents.

Re: A Facebook engineer abused access to user data to track down woman

#28

Post by staticassertion » Wed, Jul 14, 2021, 2:24 PM UTC

In a sane world this would be a company-ending event, or at least seriously impact their stock and C level execs.

The idea that:

a) User data access is not just allowed but normal (or at least that it was at one point)

b) That it's allowed at all so widely

c) That (a) and (b) are true despite repeated abuse

is absolutely insane. "Nearly every month" is insane. It should be criminal, but it isn't.

Sadly, it's all too common for engineers to have way more access than is necessary, though this seems extreme. I see no reason why any engineer, outside of extreme circumstances that should set off alarm bells, should have access to sensitive user data like passwords. It should generally not be the case that direct access of data is needed at all.

Re: A Facebook engineer abused access to user data to track down woman

#29

Post by cmrdporcupine » Wed, Jul 14, 2021, 2:25 PM UTC

Pretty inexcusable by 2015. FB was hardly a new company at that point.

Every Googler gets the message that you keep your mitts off private information in logs (or get terminated) drilled into them in their first week of training. Logs access is a) restricted b) audited c) tiered and d) enforced. That was the case in 2011 when I started and it's the case now.

Not saying Google is perfect, but it's not like companies like FB didn't have a template for privacy standards that they could have followed.

All that said, but back then I just personally assumed that this is how FB was operating :-( I am hoping they've improved since.

Re: A Facebook engineer abused access to user data to track down woman

#30

Post by staticassertion » Wed, Jul 14, 2021, 2:25 PM UTC

emtel wrote: post #15

I worked at Facebook for most of 2017 and 2018. In the first week, they made it clear that you would be fired instantly for any improper access of user data. They further said that if you need to access any sensitive personal data, or if you need to log in as a user in order to debug a problem, you need to have approval from your manager _before_ the access, not after. Also, you are not allowed to access the data of…

Those policies will only catch someone after the fact. Firing someone is the bare minimum, it prevents a single repeat offender, but they could already do damage.

None of this should even be possible.