A Facebook engineer abused access to user data to track down woman • Hacker News Board

Re: A Facebook engineer abused access to user data to track down woman

#71

Post by BigBubbleButt » Wed, Jul 14, 2021, 2:56 PM UTC

cfors wrote: post #63

emtel wrote: post #15

I worked at Facebook for most of 2017 and 2018. In the first week, they made it clear that you would be fired instantly for any improper access of user data. They further said that if you need to access any sensitive personal data, or if you need to log in as a user in order to debug a problem, you need to have approval from your manager _before_ the access, not after. Also, you are not allowed to access the data of…

These comment's are all relatively ignorant of the fact that implementing these sorts of privacy controls generally makes your product worse and your engineers miserable. > Facebook employees were granted user data access in order to “cut away the red tape that slowed down engineers,” the book says. If we can take a step back, this is a totally reasonable policy. Unfortunately Facebook is facing the reality of the la…

This is completely unethical and unreasonable. It's like arguing that police don't need more accountability because it makes it harder for them to do their jobs, and most of them aren't bad people, so who cares about a few bad apples?

Yeah it sucks, but it's part of the job. Start thinking about the people you're supposedly serving instead of yourself first. I'm pretty sure that the overwhelming majority of facebook users want to hear about tighter privacy protections at facebook, not fewer.

Re: A Facebook engineer abused access to user data to track down woman

#72

Post by darkwizard42 » Wed, Jul 14, 2021, 2:57 PM UTC

antris wrote: post #36

emtel wrote: post #15

I worked at Facebook for most of 2017 and 2018. In the first week, they made it clear that you would be fired instantly for any improper access of user data. They further said that if you need to access any sensitive personal data, or if you need to log in as a user in order to debug a problem, you need to have approval from your manager _before_ the access, not after. Also, you are not allowed to access the data of…

>They further said that if you need to access any sensitive personal data, or if you need to log in as a user in order to debug a problem, you need to have approval from your manager _before_ the access, not after. But were you still able to just look at the data or login as the user without the permission? I think that's the key question. Talk is cheap. As a user it's not good enough for me that people are being tol…

Disclaimer: was at FB in 2014

You could at the time start trying to log in as a user and MULTIPLE red warnings came up that proceeding further would automatically notify your manager and skip of access and a reminder of data policies. Now at that point I did not go further but I did know that content moderation and security teams had special access so I imagine they did both, heavily warn avg FB eng AND restrict access.

Re: A Facebook engineer abused access to user data to track down woman

#73

Post by jsbdk » Wed, Jul 14, 2021, 3:02 PM UTC

darkwizard42 wrote: post #72

antris wrote: post #36

Earlier quoted context omitted.

>They further said that if you need to access any sensitive personal data, or if you need to log in as a user in order to debug a problem, you need to have approval from your manager _before_ the access, not after. But were you still able to just look at the data or login as the user without the permission? I think that's the key question. Talk is cheap. As a user it's not good enough for me that people are being tol…

Disclaimer: was at FB in 2014 You could at the time start trying to log in as a user and MULTIPLE red warnings came up that proceeding further would automatically notify your manager and skip of access and a reminder of data policies. Now at that point I did not go further but I did know that content moderation and security teams had special access so I imagine they did both, heavily warn avg FB eng AND restrict acce…

How about people with direct database access?

Re: A Facebook engineer abused access to user data to track down woman

#74

Post by agumonkey » Wed, Jul 14, 2021, 3:02 PM UTC

Cthulhu_ wrote: post #21

agumonkey wrote: post #10

Earlier quoted context omitted.

Was it a social network thing too or a totally different market ?

I don't think it actually matters much; your database is your core business and access to it should be restricted. Same as your machines. To the point where, if you have everything set up right (which is a big if, granted), NOBODY should need physical access to ANY machine or database. All access through the application's management interface, where access can be finely tuned and access logs can be used to hold peopl…

it was mostly a question of scale, that a business mishandle 500 customers data is one thing, but 100k feels different to me.

Re: A Facebook engineer abused access to user data to track down woman

#75

Post by sthatipamala » Wed, Jul 14, 2021, 3:06 PM UTC

underseacables wrote: post #41

cmrdporcupine wrote: post #29

Pretty inexcusable by 2015. FB was hardly a new company at that point. Every Googler gets the message that you keep your mitts off private information in logs (or get terminated) drilled into them in their first week of training. Logs access is a) restricted b) audited c) tiered and d) enforced . That was the case in 2011 when I started and it's the case now. Not saying Google is perfect, but it's not like companies…

I know an engineer, a security engineer at Google who is pretty well-known, who went to work at Google specifically so he could get at peoples personal data. I don’t know if he actually does it, but he boasted quite openly for years that he wanted to be the “architect“ and see everything and know everyone’s secrets. He is now a highly placed Google security employee.

If that was his plan, he picked the entirely wrong company to accomplish it. There are many layers of access control at Google that would make that impossible regardless of how highly placed he is. He'd be better off at a smaller company with less mature security tools.

Re: A Facebook engineer abused access to user data to track down woman

#76

Post by [deleted] » Wed, Jul 14, 2021, 3:08 PM UTC

BigBubbleButt wrote: post #71

cfors wrote: post #63

Earlier quoted context omitted.

These comment's are all relatively ignorant of the fact that implementing these sorts of privacy controls generally makes your product worse and your engineers miserable. > Facebook employees were granted user data access in order to “cut away the red tape that slowed down engineers,” the book says. If we can take a step back, this is a totally reasonable policy. Unfortunately Facebook is facing the reality of the la…

This is completely unethical and unreasonable. It's like arguing that police don't need more accountability because it makes it harder for them to do their jobs, and most of them aren't bad people, so who cares about a few bad apples? Yeah it sucks, but it's part of the job. Start thinking about the people you're supposedly serving instead of yourself first. I'm pretty sure that the overwhelming majority of facebook…

[deleted]

Re: A Facebook engineer abused access to user data to track down woman

#77

Post by jeffbee » Wed, Jul 14, 2021, 3:13 PM UTC

underseacables wrote: post #41

cmrdporcupine wrote: post #29

Pretty inexcusable by 2015. FB was hardly a new company at that point. Every Googler gets the message that you keep your mitts off private information in logs (or get terminated) drilled into them in their first week of training. Logs access is a) restricted b) audited c) tiered and d) enforced . That was the case in 2011 when I started and it's the case now. Not saying Google is perfect, but it's not like companies…

I know an engineer, a security engineer at Google who is pretty well-known, who went to work at Google specifically so he could get at peoples personal data. I don’t know if he actually does it, but he boasted quite openly for years that he wanted to be the “architect“ and see everything and know everyone’s secrets. He is now a highly placed Google security employee.

There are no “architect” roles at google. Most people outside anti-abuse roles have no access to user data, and even the abuse people use audited frontend tools that formalize the policy that the viewer must reference the ticket they are working on and the limited data they need to see.

People with direct access to production data streams mostly see encrypted data. There’s a big, annoying technical scheme in place to make sure private or sensitive data is elided whenever a message is printed in plain text to a log. It stretches from the protocol compiler all the way down to C++ stream operators.

I’m not saying nobody ever sees user data. Sometimes you need to find out why an email is crashing the mailer. But those accesses are limited in scope, auditable, and available to relatively few people.

In my opinion it isn’t really the Facebooks and Googles of the world you need to worry about, it’s the companies with massive collections of user data and without the technical chops to protect it. Like Dropbox.

Re: A Facebook engineer abused access to user data to track down woman

#78

Post by panic » Wed, Jul 14, 2021, 3:17 PM UTC

emtel wrote: post #15

I worked at Facebook for most of 2017 and 2018. In the first week, they made it clear that you would be fired instantly for any improper access of user data. They further said that if you need to access any sensitive personal data, or if you need to log in as a user in order to debug a problem, you need to have approval from your manager _before_ the access, not after. Also, you are not allowed to access the data of…

If you know the right people, can you be taken off the audit list? I remember in the early days of Facebook, access to everyone’s account was seen as an unofficial perk of the job; the cynic in me would say that this perk still exists but is only given to people who can be trusted to never talk about it.

Re: A Facebook engineer abused access to user data to track down woman

#79

Post by ericbarrett » Wed, Jul 14, 2021, 3:20 PM UTC

aaronmdjones wrote: post #5

> At the time, more than 16,000 employees had access to users’ private data, according to the book. > Stamos suggested tightening access to fewer than 5,000 employees and fewer than 100 for particularly sensitive information like passwords. I'm sorry, what? I can tell you the number of legitimate engineers that should have access to user's passwords. It's a nice, round number. It's zero.

A long time ago I managed FB's udb backups, the central MySQL schema around which all other services were strung. Even from the beginning FB never stored plaintext passwords. Can't say there weren't log excursions or the like, but when found these would have been critical bugs and fixed immediately.

Re: A Facebook engineer abused access to user data to track down woman

#80

Post by LanceH » Wed, Jul 14, 2021, 3:24 PM UTC

BigBubbleButt wrote: post #71

cfors wrote: post #63

Earlier quoted context omitted.

These comment's are all relatively ignorant of the fact that implementing these sorts of privacy controls generally makes your product worse and your engineers miserable. > Facebook employees were granted user data access in order to “cut away the red tape that slowed down engineers,” the book says. If we can take a step back, this is a totally reasonable policy. Unfortunately Facebook is facing the reality of the la…

This is completely unethical and unreasonable. It's like arguing that police don't need more accountability because it makes it harder for them to do their jobs, and most of them aren't bad people, so who cares about a few bad apples? Yeah it sucks, but it's part of the job. Start thinking about the people you're supposedly serving instead of yourself first. I'm pretty sure that the overwhelming majority of facebook…

They are well audited already. Does every step possible need to be taken to ensure that no data can be leaked ever? No.

You can walk out your door right now and hop on a bus. That driver has a CDL, a good first step. But how do we know that the driver isn't drunk? Through threat of possible audit (breathalyzer) after any incident. We don't test them before handing them the keys every day.

We trust people all the time with things far more critical than a facebook user's data, and we audit them far more loosely, if at all.

"completely unethical and unreasonable" > This seems to be influenced by the belief that tech is some utopia where everything is solvable and the world will be a better place. There is room for good enough in trust.

There is a big difference between throwing guardrails up so people don't do wrong and beating them down with requests for permission over and over all day during their work, driving home the point they can't be trusted. Eight hours a day of being told you can't be trusted is about more than the worker's convenience -- it's about their morale at least and possibly their mental health. It also instills the attitude of "if I can do it, it's legal, because otherwise they would have stopped me from doing it."