Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Meta fined $102M for storing passwords in plain text

engadget.com

Post reply on HN
Print view View original

21–30 of 136 posts

Re: Meta fined $102M for storing passwords in plain text

#21

Post by rjzzleep »

can16358p wrote: post #8

I really don't get how companies so large do stupid things like this. Hashing and salting passwords isn't some newly introduced advanced rocket science, it's literally a 101-level "obvious" thing. How can a huge corporation like Meta/Facebook can do this is beyond my imagination.

Most of the times it's when people reinvent stuff from scratch. That's why I'm always careful when people implement their own framework in the next shiny thing. Lack of hashing, CSRF, basic XSS issues happen all the time in rust, golang and especially the node.js web crowd.

Re: Meta fined $102M for storing passwords in plain text

#22

Post by AmericanChopper »

shprd wrote: post #18
AmericanChopper wrote: post #4

This is a very imaginative use of the word “breach”, according to the details reported in the article at least. Internal staff (inadvertently) had access to users plaintext passwords. The article doesn’t mention any use of these credentials in a breach though, and doesn’t make any refutation of Meta’s claim that this never occurred. Internal staff having access to my data is what I would normally expect from a servic…

> This is a very imaginative use of the word “breach” You're mistaken. You might be thinking of breach in terms of "hacking into", but they used it as: personal data breach Which accurately means "unauthorised access to personal data"[0] and seem to be the language used by the DPC. [0] - https://ico.org.uk/for-organisations/law-enforcement/guide-t...

That describes an entirely different incident to the one referenced in this article.

Re: Meta fined $102M for storing passwords in plain text

#23

Post by AmericanChopper »

ethbr1 wrote: post #20
AmericanChopper wrote: post #17

Earlier quoted context omitted.

It’s a control failure, not a breach. It would also be an incident, one that could result in a subsequent breach, or one that warrants some work to be done to ensure it does not turn into a breach. But it has not resulted in an unauthorised party gaining access to the data, and is therefor not a breach.

I think it's impossible to say there was no breach, given they were exposed for 7 years .

I would agree. Which is why I’m suggesting that the Irish Data Protection Commission and Engadget should refrain from saying that.

It’s also impossible to say that I am not responsible for a breach of your private data either. How much should the Irish Data Protection Commission fine me?

Re: Meta fined $102M for storing passwords in plain text

#24

Post by bongodongobob »

can16358p wrote: post #8

I really don't get how companies so large do stupid things like this. Hashing and salting passwords isn't some newly introduced advanced rocket science, it's literally a 101-level "obvious" thing. How can a huge corporation like Meta/Facebook can do this is beyond my imagination.

I'm honestly never surprised by any of this stuff. I've done some contracting and file access is always a shitshow.

Picture this:

> Intern or contractor gets hired.

> Someone runs a script to create the user because permissions have turned into a rats nest that no human can understand

> No one knows how the script works anymore, it's probably outdated and only does 60% of the job

> User is added to a quagmire of groups

> I cant access the Citrix apps

> "Oh you don't have access and I'm waiting on that app owner to give you access, give me a few days"

> Ok it works but I don't have a login for "the program I need"

> "Looks like there's a licensing issue, give me a few days"

> Ok it works but I don't have credentials for the database connection

> "It's legitimately complicated, give me a few days"

> IT gets tired of fucking with the back and forth on this 13 day old ticket "Just give him everything, so he can get X done"

> Get access

> Finally. Let's just dump this out into another file/folder/location so I don't have to go through hoops again and I can actually do my job.

Now that dump is in a remote profile folder or /temp folder somewhere in a 100TB blob that will be backed up for 7 years or more. I've been on both sides.

Re: Meta fined $102M for storing passwords in plain text

#26

Post by chrismorgan »

DexesTTP wrote: post #3

Context: This is for a 2019 data breach on a system that was created in 2012. The GDPR was instated in 2018 (has it really been that long? Wow feels like yesterday) and Meta failed to disclose the 2019 data breach properly under GDPR, hence the fine.

I was concerned, reading your thing first, that the title (“Meta fined $102M for storing passwords in plain text”) was going to be false—that they were actually only fined for not disclosing the breach. But the article says the decision also claimed a GDPR violation for storing the passwords in plaintext, so that’s good:

> The DPC found that Meta violated several GDPR rules related to the breach. It determined that the company failed to "notify the DPC of a personal data breach concerning storage of user passwords in plaintext" without undue delay and failed to "document personal data breaches concerning the storage of user passwords in plaintext." It also said that Meta violated the GDPR by not using appropriate technical measures to ensure the security of users' passwords against unauthorized processing.

Re: Meta fined $102M for storing passwords in plain text

#29

Post by [deleted] »

AmericanChopper wrote: post #17
nomilk wrote: post #11

Earlier quoted context omitted.

In many senses, internal staff having access to plaintext passwords is a breach.

It’s a control failure, not a breach. It would also be an incident, one that could result in a subsequent breach, or one that warrants some work to be done to ensure it does not turn into a breach. But it has not resulted in an unauthorised party gaining access to the data, and is therefor not a breach.

[deleted]

Re: Meta fined $102M for storing passwords in plain text

#30

Post by tjpnz »

can16358p wrote: post #8

I really don't get how companies so large do stupid things like this. Hashing and salting passwords isn't some newly introduced advanced rocket science, it's literally a 101-level "obvious" thing. How can a huge corporation like Meta/Facebook can do this is beyond my imagination.

When you select candidates based on whether they know how to invert a BST and other trivia it's not terribly surprisingly.
Post reply on HN