I wonder what the `CSPlaygroundGraphQLFriendsQuery` query is meant for. It sounds like some testing/development thing.
Getting any Facebook user's friend list and partial payment card details
31–40 of 95 posts
Re: Getting any Facebook user's friend list and partial payment card details
#32Earlier quoted context omitted.
I think people leaving facebook en masse would be a good thing (TM) for society, not a doomsday. Fewer echo chambers, less disinformation, and people forced to make effort to contact each other.
It will only be replaced with another echo chamber.
Hopefully multiple smaller ones.
Re: Getting any Facebook user's friend list and partial payment card details
#33Re: Getting any Facebook user's friend list and partial payment card details
#34Earlier quoted context omitted.
That's because you should never have first 6 and last 4 in the same place at the same time, particularly to someone who is not the owner of the card! That leaves only 6 digits to guess to obtain a valid card, and you're given the check digit to limit the search further.
First six and last four are the limits for display set out by the PCI Security Standards Council. The things you should never store with the PAN are the PIN/PIN block or CVC/CVV. https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storag...
While it complies with PCI standards, knowing first6+last4, plus contact information, you can be much more successful at phishing against the target.
First6 will give you ability to know the issuing bank of the card (so an email can be crafted to look like those banks emails). Plus last4 tends to be used by banks as a "hey, we know who you are!" when they send emails.
Re: Getting any Facebook user's friend list and partial payment card details
#35Earlier quoted context omitted.
That's because you should never have first 6 and last 4 in the same place at the same time, particularly to someone who is not the owner of the card! That leaves only 6 digits to guess to obtain a valid card, and you're given the check digit to limit the search further.
First six and last four are the limits for display set out by the PCI Security Standards Council. The things you should never store with the PAN are the PIN/PIN block or CVC/CVV. https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storag...
How does that work? If you can't store the CVC/CVV, how come I don't have to re-enter it when I re-order form say Amazon or Foodora? Or maybe I do have to enter it? Don't remember :|
Re: Getting any Facebook user's friend list and partial payment card details
#36Earlier quoted context omitted.
Wow. That is extremely impressive that such a large company is able to get a fix out that quickly.
It's a trivial bug. If the parameter is invalid, return nothing, rather than return all the credit cards. I'd be worried if any company is not able to understand the problem and publish a patch in a few hours.
The fix isn't the hard part. It's the deployment and validation that can take time.
Pretty impressive.
Re: Getting any Facebook user's friend list and partial payment card details
#37Earlier quoted context omitted.
It's a trivial bug. If the parameter is invalid, return nothing, rather than return all the credit cards. I'd be worried if any company is not able to understand the problem and publish a patch in a few hours.
The fix isn't the hard part. It's the deployment and validation that can take time. Pretty impressive.
Yep, clearly shows the value of a properly configured CI/CD pipeline.
Re: Getting any Facebook user's friend list and partial payment card details
#38Earlier quoted context omitted.
It's a trivial bug. If the parameter is invalid, return nothing, rather than return all the credit cards. I'd be worried if any company is not able to understand the problem and publish a patch in a few hours.
The fix isn't the hard part. It's the deployment and validation that can take time. Pretty impressive.
The deployment and the validation should be trivial if the fix is trivial.
The difficult part is having someone who reads the report and escalates it, preferably in a timely manner.
Re: Getting any Facebook user's friend list and partial payment card details
#39Earlier quoted context omitted.
The fix isn't the hard part. It's the deployment and validation that can take time. Pretty impressive.
The deployment and the validation should be trivial if the fix is trivial. The difficult part is having someone who reads the report and escalates it, preferably in a timely manner.
The world is littered with the smoking, segfaulted, hulks of programs that were quickly deployed after an obvious fix.
Re: Getting any Facebook user's friend list and partial payment card details
#40Earlier quoted context omitted.
Wow. That is extremely impressive that such a large company is able to get a fix out that quickly.
If it took much longer than that for bugs like this, all of the HN doomsday posts about the Facebook mass exodus might actually come true
I've been following Josip's work on and off for years now (he's probably on every big white hat hall of fame there is), and I'm pretty sure he wouldn't go public even if it took them a month to fix this.
If he said in a public blog post that it took them a month to fix something so simple, I could see the shit storm aimed at Facebook on social networks (including here), but I highly doubt any user would be compromised.