Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Two More Cases of Third-Party Facebook App Data Exposure

upguard.com

Post reply on HN
Print view View original

31–40 of 48 posts

Re: Two More Cases of Third-Party Facebook App Data Exposure

#31

Post by lacker »

mattnewton wrote: post #15
nerdjon wrote: post #10

Earlier quoted context omitted.

"Millions of Facebook Records Found on Amazon Cloud Servers" was the original headline. That headline the first thing you would likely think is Facebook was using AWS and left some data open somewhere. It 100% implied Facebook was doing more wrong now, instead of the companies that already had the data from the previous issues were not handling the data correctly. Yes this news is still notable. But the headline gave…

Eh, I don’t really care if it is a failure on the point of Facebook engineers or a failure on the point of Facebook data policy that allowed other engineers to post data about me in an insuecure manner. Seems like splitting hairs here.

In this case I think it is a failure on the part of a third-party application developer, rather than any failure on Facebook's part.

Re: Two More Cases of Third-Party Facebook App Data Exposure

#32

Post by lacker »

ChrisCinelli wrote: post #25
SpicyLemonZest wrote: post #20

Earlier quoted context omitted.

Facebook used to be much better at locking down third-party exfiltration. But back in the early 2010s, the zeitgeist was against it; there were countless articles in the genre of "I'm a random third party developer, and Facebook is trying to stop me from exfiltrating massive dumps of my user's data! How anticompetitive!" So they decided to start being more open.

Can you provide one or two of those articles?

Look for articles like this one:

https://www.adweek.com/digital/facebook-and-zynga-battle-ove...

Many of the initial adopters of the Facebook platform were companies like Zynga that were reliant on specific details of the platform, and got very frustrated by platform changes. Many but not all of the changes that Facebook wanted to make during this period were ones that kept data more private.

Re: Two More Cases of Third-Party Facebook App Data Exposure

#33

Post by AdmiralAsshat »

Since there are many anecdotal reports of Facebook failing to delete the profile history data even after closing your account, is there a better way people should be scrubbing their data? Some kind of tool, perhaps, that edits all of your posts and replaces them with scrambled / gibberish text?

Re: Two More Cases of Third-Party Facebook App Data Exposure

#34

Post by sucrose »

jrochkind1 wrote: post #19

Wait, how the heck did "At the Pool" get plaintext fb passwords?

Well, the 2nd paragraph explains that: "The passwords are presumably for the “At the Pool” app rather than for the user’s Facebook account, but would put users at risk who have reused the same password across accounts."

Re: Two More Cases of Third-Party Facebook App Data Exposure

#35

Post by fixermark »

jsgo wrote: post #28
fixermark wrote: post #22

Earlier quoted context omitted.

Not at all; they'd be responsible for bundling that data in a well-defined format into a blob of some kind that the user can request be exfiltrated (after providing their credentials to authenticate the request). The third-party would then have to digest said blob. Users assume trust of the third-party regarding responsibility for data misuse when they feed the third-party the blob (same as if they'd hand-entered the…

Say there's a startup that is going to revolutionize date keeping and events and scheduling and all that, for the sake of aping a common naming scheme, call them Calendr[1]. Only drawback is that their security is an afterthought, but they're not promoting that. So a Facebook user that is friends with you on Facebook says to Calendr, "scan my contacts and generate a calendar that already has my contacts' birthdays an…

They may not be able to prevent it without refusing to exfiltrate that data. But then they maintained clear resopnsibility (at the cost of usability) for the user's data. Excellent example though, because it highlights a real joint-ownership problem in data on a social network (the aggrieved fixermark in this case certainly couldn't have stopped his friend from hand-entering the details of the super-secret party into FakeCalendr without consent either; to a certain extent, sharing information always implies trust of the recipient to store that information responsibly).

Unfortunately, privacy / usability is the tradeoff. Facebook had clear incentives to simplify usability at the cost of privacy. But as a result, these breaches continued to happen.

(I use the past tense here because I don't know what their app ecosystem looks like now. When I was using it, it was extremely easy to do a full friends-of-friends data exfiltration, with the only guard against it being "Don't do that and then dump it publicly for all to see").

Re: Two More Cases of Third-Party Facebook App Data Exposure

#36

Post by SpicyLemonZest »

ChrisCinelli wrote: post #25
SpicyLemonZest wrote: post #20

Earlier quoted context omitted.

Facebook used to be much better at locking down third-party exfiltration. But back in the early 2010s, the zeitgeist was against it; there were countless articles in the genre of "I'm a random third party developer, and Facebook is trying to stop me from exfiltrating massive dumps of my user's data! How anticompetitive!" So they decided to start being more open.

Can you provide one or two of those articles?

My favorite is this one, where a guy complained Facebook wouldn't let his extension export all your friends' email addresses.

https://www.zdnet.com/article/facebook-blocks-google-chrome-...

Re: Two More Cases of Third-Party Facebook App Data Exposure

#37

Post by traek »

seandougall wrote: post #27
ChrisCinelli wrote: post #24

Earlier quoted context omitted.

They did not. I think those are their own passwords if the user used directly the app without FB login

Not to discount the possibility that the article could be incorrect about this, but it makes the claim quite unambiguously: "it contains plaintext (i.e. unprotected) Facebook passwords for 22,000 users"

They have updated the article to say

> it contains plaintext (i.e. unprotected) passwords for 22,000 users

and

> The passwords are presumably for the “At the Pool” app rather than for the user’s Facebook account, but would put users at risk who have reused the same password across accounts.

Re: Two More Cases of Third-Party Facebook App Data Exposure

#38

Post by [deleted] »

AdmiralAsshat wrote: post #33

Since there are many anecdotal reports of Facebook failing to delete the profile history data even after closing your account, is there a better way people should be scrubbing their data? Some kind of tool, perhaps, that edits all of your posts and replaces them with scrambled / gibberish text?

[deleted]

Re: Two More Cases of Third-Party Facebook App Data Exposure

#39

Post by libso »

AdmiralAsshat wrote: post #33

Since there are many anecdotal reports of Facebook failing to delete the profile history data even after closing your account, is there a better way people should be scrubbing their data? Some kind of tool, perhaps, that edits all of your posts and replaces them with scrambled / gibberish text?

Facebook sure as hell won't create such a tool. If you do, open source it and I shall use it for sure.

Re: Two More Cases of Third-Party Facebook App Data Exposure

#40

Post by socialhack3r »

lacker wrote: post #30
socialhack3r wrote: post #21

This other article that got posted today might explain why this happened in more detail: https://medium.com/@six4three/deceit-by-design-zucks-dirty-s... Seems to suggest that FB platform apis were designed to not share any privacy metadata with devs. Maybe not the same as how apps like At The Pool stored that data, but might explain the firehose of data that FB gave devs and now they will point the finger and say it…

Developers would have to intentionally write extra code to respect privacy metadata, so it seems unlikely that would have made a difference.

Oh jeez. So you think that medium article is accurate? It would be pretty nuts if what they are saying is true. Makes something like Cambridge Analytica and whatever happened today with At The Pool be a question of "when" and not "if" when it comes to the leaking of FB user data.
Post reply on HN