Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Facebook engineer abused access to user data to track down woman

businessinsider.com.au

Post reply on HN
Print view View original

91–100 of 108 posts

Re: A Facebook engineer abused access to user data to track down woman

#91

Post by _jal »

LanceH wrote: post #80
BigBubbleButt wrote: post #71

Earlier quoted context omitted.

This is completely unethical and unreasonable. It's like arguing that police don't need more accountability because it makes it harder for them to do their jobs, and most of them aren't bad people, so who cares about a few bad apples? Yeah it sucks, but it's part of the job. Start thinking about the people you're supposedly serving instead of yourself first. I'm pretty sure that the overwhelming majority of facebook…

They are well audited already. Does every step possible need to be taken to ensure that no data can be leaked ever? No. You can walk out your door right now and hop on a bus. That driver has a CDL, a good first step. But how do we know that the driver isn't drunk? Through threat of possible audit (breathalyzer) after any incident. We don't test them before handing them the keys every day. We trust people all the time…

> Does every step possible need to be taken to ensure that no data can be leaked ever? No.

Which person you're replying to demanded perfect security?

> This seems to be influenced by the belief that tech is some utopia where everything is solvable and the world will be a better place.

I am not the person you're replying to, but the claim has nothing to do with utopianism. It has to do with the claim that reasonable safeguards and auditing when dealing with sensitive data is possible, so that users can have (some degree of) confidence in the operation while workers go about their authorized jobs. This is hardly rocket surgery. Or novel.

What some people seem to be taking issue with is that their company might not trust them as much as they think they should be trusted. My advice to them would be to stay in small companies - if you're below the Dunbar number, you can personally evaluate each other and develop trust that way. In larger orgs, you need policy and enforcement, it is just how people are wired.

Re: A Facebook engineer abused access to user data to track down woman

#92

Post by Jwarder »

herbst wrote: post #60
_wolfie_ wrote: post #38

Earlier quoted context omitted.

Usually it's in the logs. So small number of SREs can sometimes access them (if there are logged). And even if they are not logged, they can always show up during tcpdump debugging of network issues and such. Client side hashing could solve this, but almost no one does it.

> Usually it's in the logs. That is definitely not usual

Facebook reported that they logged passwords in plaintext by accident a couple of years ago.

https://about.fb.com/news/2019/03/keeping-passwords-secure/

Re: A Facebook engineer abused access to user data to track down woman

#93

Post by cycomanic »

LanceH wrote: post #80
BigBubbleButt wrote: post #71

Earlier quoted context omitted.

This is completely unethical and unreasonable. It's like arguing that police don't need more accountability because it makes it harder for them to do their jobs, and most of them aren't bad people, so who cares about a few bad apples? Yeah it sucks, but it's part of the job. Start thinking about the people you're supposedly serving instead of yourself first. I'm pretty sure that the overwhelming majority of facebook…

They are well audited already. Does every step possible need to be taken to ensure that no data can be leaked ever? No. You can walk out your door right now and hop on a bus. That driver has a CDL, a good first step. But how do we know that the driver isn't drunk? Through threat of possible audit (breathalyzer) after any incident. We don't test them before handing them the keys every day. We trust people all the time…

If we take your argument further all engineers should be given the root password to all production servers and we should simply trust them (and keep logs) to not use the password?

Access control is something so central to IT systems that I'm frankly dumbstruck that someone would argue against them on HN.

Re: A Facebook engineer abused access to user data to track down woman

#94

Post by underseacables »

bluefirebrand wrote: post #82
jeffbee wrote: post #77

Earlier quoted context omitted.

There are no “architect” roles at google. Most people outside anti-abuse roles have no access to user data, and even the abuse people use audited frontend tools that formalize the policy that the viewer must reference the ticket they are working on and the limited data they need to see. People with direct access to production data streams mostly see encrypted data. There’s a big, annoying technical scheme in place to…

> There are no “architect” roles at google In this case I suspect "The Architect" is a reference to the character in the Matrix films. The character who has visibility into every corner of the Matrix and full knowledge about everything going on inside it. Could be wrong. Either way I very much doubt it is related to a specific role at Google.

Sorry yes, you are correct. He wanted to be the Matrix architect

Re: A Facebook engineer abused access to user data to track down woman

#95

Post by edmundsauto »

jsbdk wrote: post #73
darkwizard42 wrote: post #72

Earlier quoted context omitted.

Disclaimer: was at FB in 2014 You could at the time start trying to log in as a user and MULTIPLE red warnings came up that proceeding further would automatically notify your manager and skip of access and a reminder of data policies. Now at that point I did not go further but I did know that content moderation and security teams had special access so I imagine they did both, heavily warn avg FB eng AND restrict acce…

How about people with direct database access?

I am close with some people who worked there until recently. All data access is audited; production access is limited via ACLs in both the main data storage system as well as all the others like the warehouse, realtime ingestion, etc.

FB appears to take this extremely seriously. I just pinged my friends and they said the only way people get fired is for sexual harassment or improper data access. And the second is the one that gets audited and monitored every day.

Re: A Facebook engineer abused access to user data to track down woman

#96

Post by guenthert »

version_five wrote: post #46
pm90 wrote: post #12

Earlier quoted context omitted.

Only the hashed versions should ever be stored. Like the OP said there is Zero reason to store plaintext user passwords.

Related anecdote, when I was in university, I had changed my university IT services password to something "offensive" (had the F word in it) after getting frustrated trying to find one that met the novelty and entropy requirements. I was contacted later by IT to tell me that was an inappropriate password and to change it. I found it much more offensive to know that IT could see my password in plain text, than I would…

The password probably was not stored in plaintext (if you've been to University in the last thirty years), but IT staff might have periodically ran a password-cracking tool in order to find weak passwords (and swear words in various languages will certainly be in their dictionary). They alert the user and request the password to be changed (might disable the weak one) in order to safeguard their network.

Re: A Facebook engineer abused access to user data to track down woman

#97

Post by LanceH »

cycomanic wrote: post #93
LanceH wrote: post #80

Earlier quoted context omitted.

They are well audited already. Does every step possible need to be taken to ensure that no data can be leaked ever? No. You can walk out your door right now and hop on a bus. That driver has a CDL, a good first step. But how do we know that the driver isn't drunk? Through threat of possible audit (breathalyzer) after any incident. We don't test them before handing them the keys every day. We trust people all the time…

If we take your argument further all engineers should be given the root password to all production servers and we should simply trust them (and keep logs) to not use the password? Access control is something so central to IT systems that I'm frankly dumbstruck that someone would argue against them on HN.

If you don't need access, you shouldn't have it.

If you do need it to do your job, you shouldn't have to run to your manager several times a day to make a request to do it. You should have root or whatever is necessary and it can be audited.

I'm not arguing against access control. I'm arguing for those with responsibility to work to be given the commensurate authority to do their work -- with auditing even.

Re: A Facebook engineer abused access to user data to track down woman

#98

Post by BoiledCabbage »

cfors wrote: post #63
emtel wrote: post #15

I worked at Facebook for most of 2017 and 2018. In the first week, they made it clear that you would be fired instantly for any improper access of user data. They further said that if you need to access any sensitive personal data, or if you need to log in as a user in order to debug a problem, you need to have approval from your manager _before_ the access, not after. Also, you are not allowed to access the data of…

These comment's are all relatively ignorant of the fact that implementing these sorts of privacy controls generally makes your product worse and your engineers miserable. > Facebook employees were granted user data access in order to “cut away the red tape that slowed down engineers,” the book says. If we can take a step back, this is a totally reasonable policy. Unfortunately Facebook is facing the reality of the la…

> Maybe this is a hot take, but I for one prefer that my company trusts me to do the right thing rather than make it hard to do my job.

Yes and banks shouldn't lock their vaults or safe deposit boxes because and just trust that all of their employees just want to do their jobs.

Re: A Facebook engineer abused access to user data to track down woman

#99

Post by siftyy »

na85 wrote: post #90
emtel wrote: post #15

I worked at Facebook for most of 2017 and 2018. In the first week, they made it clear that you would be fired instantly for any improper access of user data. They further said that if you need to access any sensitive personal data, or if you need to log in as a user in order to debug a problem, you need to have approval from your manager _before_ the access, not after. Also, you are not allowed to access the data of…

Meanwhile the CEO volunteered early on to dox people at Harvard pretty much for funsies[0]. Yet TFA contains a quote about how abusing personal data is "against Mark's DNA". Horseshit. Facebook is the enemy. [0] https://www.esquire.com/uk/latest-news/a19490586/mark-zucker...

While sure I think it’s wise to stay weary of any company you give your data to, Mark said that when he was 19 and Facebook was limited to students. I think it’s disingenuous to use a quote from 2004 to represent his thinking today.

Re: A Facebook engineer abused access to user data to track down woman

#100

Post by version_five »

guenthert wrote: post #96
version_five wrote: post #46

Earlier quoted context omitted.

Related anecdote, when I was in university, I had changed my university IT services password to something "offensive" (had the F word in it) after getting frustrated trying to find one that met the novelty and entropy requirements. I was contacted later by IT to tell me that was an inappropriate password and to change it. I found it much more offensive to know that IT could see my password in plain text, than I would…

The password probably was not stored in plaintext (if you've been to University in the last thirty years), but IT staff might have periodically ran a password-cracking tool in order to find weak passwords (and swear words in various languages will certainly be in their dictionary). They alert the user and request the password to be changed (might disable the weak one) in order to safeguard their network.

This is an interesting point, and I did consider it as I was typing the comment. If I remember correctly, the password was fuckStateU+1 with my university name (abbreviation) subbed in (like I said, I was getting angry trying to meet the special character etc requirements). Do you think password cracking software they use would break suck a password any faster than brute force? I suppose its possible but I'd discounted it.

This was about 15-16 years ago I think.

Post reply on HN