Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Facebook engineer abused access to user data to track down woman

businessinsider.com.au

Post reply on HN
Print view View original

61–70 of 108 posts

Re: A Facebook engineer abused access to user data to track down woman

#61

Post by martincmartin »

herbst wrote: post #51
emtel wrote: post #15

I worked at Facebook for most of 2017 and 2018. In the first week, they made it clear that you would be fired instantly for any improper access of user data. They further said that if you need to access any sensitive personal data, or if you need to log in as a user in order to debug a problem, you need to have approval from your manager _before_ the access, not after. Also, you are not allowed to access the data of…

So did people actually get fired over this? Or do you have any reason to actually believe that they would have noticed?

Yes. There was a public blog post a few year ago from someone complaining about being fired for this.

Re: A Facebook engineer abused access to user data to track down woman

#62

Post by Shish2k »

asdfasgasdgasdg wrote: post #37
emtel wrote: post #15

I worked at Facebook for most of 2017 and 2018. In the first week, they made it clear that you would be fired instantly for any improper access of user data. They further said that if you need to access any sensitive personal data, or if you need to log in as a user in order to debug a problem, you need to have approval from your manager _before_ the access, not after. Also, you are not allowed to access the data of…

I'm surprised that this stuff is audit only. At my company, at least in the past five years or so, this type of access has been forbidden to almost all employees. You need to request access to these types of systems and provide justification for why you should have it. Access is controlled on a per-system basis -- it's not blanket access. Many of the most sensitive systems have auto-expiring access for humans. Nowada…

> I'm surprised that this stuff is audit only

These days things are mostly working the way you describe - I need to request permission to view my own service’s logs, and I’m working in backend infra not going anywhere near user data (logs are like “did we hit any hardware errors when trying to install the OS on this host?”)

Re: A Facebook engineer abused access to user data to track down woman

#63

Post by cfors »

emtel wrote: post #15

I worked at Facebook for most of 2017 and 2018. In the first week, they made it clear that you would be fired instantly for any improper access of user data. They further said that if you need to access any sensitive personal data, or if you need to log in as a user in order to debug a problem, you need to have approval from your manager _before_ the access, not after. Also, you are not allowed to access the data of…

These comment's are all relatively ignorant of the fact that implementing these sorts of privacy controls generally makes your product worse and your engineers miserable.

> Facebook employees were granted user data access in order to “cut away the red tape that slowed down engineers,” the book says.

If we can take a step back, this is a totally reasonable policy. Unfortunately Facebook is facing the reality of the law of large numbers in that once you have 1000+ people the chances of having a bad actor in your system is much higher than 10 people.

Maybe this is a hot take, but I for one prefer that my company trusts me to do the right thing rather than make it hard to do my job. I'm not saying that there isn't a solution for this, but behind the "facebook corporation" there is generally just a bunch of engineers that want to do a good job at work.

Re: A Facebook engineer abused access to user data to track down woman

#64

Post by [deleted] »

herbst wrote: post #51
emtel wrote: post #15

I worked at Facebook for most of 2017 and 2018. In the first week, they made it clear that you would be fired instantly for any improper access of user data. They further said that if you need to access any sensitive personal data, or if you need to log in as a user in order to debug a problem, you need to have approval from your manager _before_ the access, not after. Also, you are not allowed to access the data of…

So did people actually get fired over this? Or do you have any reason to actually believe that they would have noticed?

[deleted]

Re: A Facebook engineer abused access to user data to track down woman

#65

Post by danlugo92 »

Drybones wrote: post #58

I was on vacation in Egypt, this year, with a guy who worked at Facebook, along with a fairly large group of us from the States. He would stalk people's Facebook profiles in our group to find out information on them and even confront them about it, if they made him upset enough. He even messaged them directly on Facebook to tell them off. As a side note, he was mostly only interested in having hook ups and orgies wit…

"Ukrainian women in Egypt" sounds like a pretty niche segment to go after.

Re: A Facebook engineer abused access to user data to track down woman

#66

Post by ryan93 »

antris wrote: post #36
emtel wrote: post #15

I worked at Facebook for most of 2017 and 2018. In the first week, they made it clear that you would be fired instantly for any improper access of user data. They further said that if you need to access any sensitive personal data, or if you need to log in as a user in order to debug a problem, you need to have approval from your manager _before_ the access, not after. Also, you are not allowed to access the data of…

>They further said that if you need to access any sensitive personal data, or if you need to log in as a user in order to debug a problem, you need to have approval from your manager _before_ the access, not after. But were you still able to just look at the data or login as the user without the permission? I think that's the key question. Talk is cheap. As a user it's not good enough for me that people are being tol…

I believe they dont allow you to access peoples public profile while at work.

Re: A Facebook engineer abused access to user data to track down woman

#67

Post by PeterisP »

pm90 wrote: post #12
Guest42 wrote: post #9

Earlier quoted context omitted.

Is it not possible to only have the hashes or does it have to get persisted somewhere in the process?

Only the hashed versions should ever be stored. Like the OP said there is Zero reason to store plaintext user passwords.

There are all kinds of places storing things that aren't explicitly stored. For example, a VM snapshot of a system that was processing a request including a password and had it in the memory at the time, any service (including something that does just network proxying) with a debug mode that logs full request data, etc.

Re: A Facebook engineer abused access to user data to track down woman

#68

Post by asdfasgasdgasdg »

Shish2k wrote: post #62
asdfasgasdgasdg wrote: post #37

Earlier quoted context omitted.

I'm surprised that this stuff is audit only. At my company, at least in the past five years or so, this type of access has been forbidden to almost all employees. You need to request access to these types of systems and provide justification for why you should have it. Access is controlled on a per-system basis -- it's not blanket access. Many of the most sensitive systems have auto-expiring access for humans. Nowada…

> I'm surprised that this stuff is audit only These days things are mostly working the way you describe - I need to request permission to view my own service’s logs, and I’m working in backend infra not going anywhere near user data (logs are like “did we hit any hardware errors when trying to install the OS on this host?”)

Great to hear. I think a lot of big internet companies are moving in this direction, although I don't know if it affects user trust all that much since it isn't publicized. I guess the one thing is that incidents like the one reported here will be avoided in the future, so in ten or twenty years there will have been less reputational damage than in an alternative universe where these controls don't exist.

Re: A Facebook engineer abused access to user data to track down woman

#69

Post by caseysoftware »

While Facebook has a massive pile of data, what about the other massive collectors of data out there?

Do similar processes and consequences apply in the worlds of the your banks, credit card company, Experian, Equifax, the NSA, FBI, and other groups, both government and commercial?

Post reply on HN