8 ms·
Notifications for targeted attacks
- Pyxl101 11y agoWhy state-sponsored hacking specifically, as opposed to any (likely) unauthorized access?
- A_COMPUTER 11y agoIf they have the information, the heads-up could save a life/personal freedom?
- _bpo 11y agoThere are many non-state actors who can threaten life/personal-freedom.
- TeMPOraL 11y agoNot in the same way a state actor can. Especially if it's your own state. An FBI agent won't go to jail for ending your life/personal freedom; he can act in the open.
- saryant 11y agoYes, but the majority of hacking attempts against Facebook accounts are probably just trying to post ads for knock-off Ray-Bans.
- jsprogrammer 11y agoAlso, how will sending a new password to your cell phone help? If you are dealing with state sponsored actors, why not assume they can see all text and email?
- Laforet 11y agoA two-factor authentication token to sent via text, not the actual password. That said, I find SMS-based 2FA to be pretty dodgy as well. Cloudflare was hacked once by somebody who managed gain access to an admin's mobile phone by social engineering their telco. If a site does not offer TOTP based 2FA I usually don't bother using it.
- jsprogrammer 11y agoI didn't say the actual password. The page wasn't very forthcoming on all the details, but a 2FAT is typically just a very short, temporary password.
- suneilp 11y agoHow does TOTP compare to HOTP?
- Laforet 11y agoHOTP tokens does not expire with time, so there is a bigger risk of them being stolen from transit/storage and successfully used.
- johncolanduoni 11y agoIf the actor is not sponsored by a state that would have easy access to your telecom (e.g. you live in the US but the attack is from a hacker sponsored by China) this is still very helpful.
- digital_ins 11y agoit's quite obvious, really. Regular unauthorized access means: batten down the hatches, man battle stations, i.e. change password State-sponsored hacking means: delete social media profile, move residence, change phones, start praying, etc ;-)
- strangecasts 11y agoJames Mickens' "Mossad/not-Mossad" threat model comes to mind: https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf
- iandanforth 11y agoThanks for that, it had honestly never occurred to me that murder for the purpose of buying someone's stuff at an estate sale might be a thing. I have updated my will accordingly.
- vitd 11y agoSeriously? I got through the first page and a half of smarmy pop-culture references and couldn't figure out what the heck the author was talking about, so I just stopped reading. More power to you if you understood it!
- TeMPOraL 11y agoI think it's because of the context it was linked in. Mickens is a pretty smart guy and is known for the series of articles like this one; it's something you read to reflect on in between crying out of laughter.
- wbronitsky 11y agoThat is an incredible essay. Thanks for posting
- ryanlol 11y agoI think they do, they're just being extra helpful here and specifying that they think whoever owned you was a state actor.
- adrianmacneil 11y agoThey already notify you about likely unauthorized access. This is just additional notification for state-sponsored attacks.
- NhanH 11y agoThis question obviously is unlikely to have an answer, but someone has to ask: does "nation-state" include the Western countries, namely the US/EU and friends?
- agorabinary 11y agoOf course not. The only states that do bad things are China, Iran, N.Korea, right?
- Myrmornis 11y agoNo need to downvote this reply. The sarcasm was an effective and appropriate way to communicate a serious point.
- wavefunction 11y agoSincerity does a better job than sarcasm in communicating, usually.
- Myrmornis 11y agoTedious HN thought police. Not everyone, not every culture, shares the aesthetics of communication implied by recent HN directives. I think we should consider the possibility that they are, though well-intentioned, overly prescriptive and ultimately oppressive.
- TeMPOraL 11y agoWe could also consider that HN has a particular culture. No one foces anyone to live here. It's a community you can freely join and leave, which makes it only more important to protect the culture that makes it good.
- wavefunction 11y agoThis is my personal opinion that I've posted you smarmy git.
- aNoob7000 11y agoExcept the USA, of course. :)
- tonyarkles 11y agoYeah, I suspect this wouldn't show up if Facebook received an NSL...
- Myrmornis 11y agoOh? I was hoping that that was one intended use for this. Would such an alert violate the typical terms of an "NSL"?
- thegeomaster 11y agoFrom Wikipedia: NSLs typically contain a nondisclosure requirement, frequently called a ''gag order,'' preventing the recipient of an NSL from disclosing that the FBI had requested the information. ...however: The nondisclosure order must be authorized by the Director of the FBI, and only after he or she certifies "that otherwise there may result a danger to the national security of the United States, interference with a criminal, counterterrorism, or counterintelligence investigation, interference with diplomatic relations, or danger to the life or physical safety of any person. So it seems this is regulated to some degree, though it is unclear what counts as "interference with a criminal, counterterrorism, or counterintelligence investigation".
- TeMPOraL 11y agoI think this alert is sent when they can sense you're being surveilled before they themselves get a NSL. "Targeted by state actor" != "obeyed lawful request for data".
- smprk 11y agoIt is a welcome move if facebook wants to be a true social platform, and increase its acceptance within me than rejection. But this particular change must come with a degree of transparency, which is required IMO to address your humorous but serious comment, and address larger value of this move. - How would facebook detect nation-state attacks? - How do we make the policy around it participative and open? - Etc.
- canow 11y agoThis is so stupid since they can be forced to give information with no hacking involved...
- pearlsteinj 11y agoWill it disregard National Security Letters to notify users?
- aNoob7000 11y agoI doubt it. This is just propaganda by Facebook showing everyone that it cares about your privacy. Unfortunately, I believe government all around the world are going to have a talk with Facebook about what is acceptable levels of privacy.
- johncolanduoni 11y agoThe focus seems to be on "state-sponsored actors", not the states themselves. My guess is this is targeted at completely illegal and disavowed actors, not those that have the luxury of being able to issue a NSL.
- TeMPOraL 11y agoI don't think you have to comply with NSL before you get it. If Facebook is able to detect pre-NSL surveillance (I doubt government just sends batch NSLs as a prelude to investigating potential targets), they can alert you before an official gag order tells them to shut up.
- corndoge 11y agoWhy so many naysayers? I can't see this having any detrimental effects, regardless of how effective it is in practice.
- smtddr 11y agoOne possible argument would be that having a false sense of security is worse than no security at all.
- TeMPOraL 11y agoPeople are biased about Facebook for various reasons, including $privacy-issue-of-the-day; no matter what they do they get to be the villan. That is, unless we're talking about their newest PHP optimizer or ad toolkit.
- wadetandy 11y agoThat's no good either, because then they are just giving it to you so they can sure you later and steal your startup due to the PATENTS file.
- TeMPOraL 11y agoDon't forget to post that the next time there's a Facebook tech thread :).
- bostik 11y ago> People are biased about Facebook for various reasons, including $privacy-issue-of-the-day" While FB as a company certainly is not altruistic, they employ quite a few privacy-minded engineers. Data leaks to the outside of their walled garden are very likely treated as company-wide problems, but as the LGBT doxes showed, there are wide implications even within their walls. [0] As they try to capture ever larger parts of the online population, they will* keep colliding with non-Western, non-SV norms. The privacy issues may be nothing but a canary in the goldmine, because they are mostly an expression of non-SV values. For example, I have my doubts about how long images of traditional Hindu artwork would be allowed to stay up... 0: http://www.huffingtonpost.com/2015/03/27/facebook-authentic-identity-policy_n_6949318.html http://www.huffingtonpost.com/2015/03/27/facebook-authentic-...
- fahimulhaq 11y ago"we strongly encourage affected people to take the actions necessary to secure all of their online accounts." This is an important aspect. The affected individual might be using several other services that don't have the sophistication of Facebook's security team. Facebook might have been able to thwart the attack but his/her other online accounts might have been compromised.
- xname2 11y agoSuckerberg loves Xi jinping, read Xi's book, and even want Xi's wife to name his daughter. How much bend over he would want to give to the Chinese government if facebook is allowed to operate in China? Will facebook block all human right activists in China, or send their information to the Chinese government?
- joenathan 11y agoI've been getting regular emails from Facebook saying "sorry you've been having trouble logging in to your account". I haven't been trying to login to my account, I deactivated it years ago. Don't think there is anything I can do about it.
- eadz 11y agoYou can delete your account. https://en-gb.facebook.com/help/125338004213029 https://en-gb.facebook.com/help/125338004213029
- Glyptodon 11y agoThe comments (on Facebook) are surreal.
- cjslep 11y agoImagine if this alert system were too liberal at labeling things "nation-state" and a significant proportion of users saw this notice: I imagine the general populous would be much more concerned about internet security than they are now.
- ryanlol 11y agoThis is a good move by facebook and does have the potential to save lives, but the fact that they don't provide any details about the attack or the supposed attacker definitely makes it significantly harder for potential victims to act on this information. Imagine getting a message like this out of the blue, not even knowing who's after you. What are you going to do? It's hard to fight a faceless enemy, especially when you can't even be sure if they really exist.
- nness 11y agoI wrote a long response to this but decided to simply ask, what can a person do to act on the information, if it were provided? Protestors in Syria or China could probably already guess what such a message means, so I'm curious as to the amount of information needed for a person to be able to act on it?
- ryanlol 11y agoProtestors in Syria or China aren't the only people getting these. As Snowden demonstrated there's no lack of westerners being spied on just because they happen to work at a telecom company. The fact that there's no more information provided makes it far too easy for those people to just ignore these warnings as mistakes and go on with their lives.
- nness 11y agoThat's true, but I suppose its a lot easier for Facebook to show warnings when actors like Syria or China are the culprits since they have no requirement to abide by their law. Where as, as Snowden has shown, the US and EU can stipulate whatever policy they want and require that Facebook can not disclose anything about it. I'm just skeptical anyone in the US or EU will see this warning.
- ryanlol 11y agoI've, as a white EU citizen, received similar warnings from google. I don't know if Facebook is going to be showing this to any western people, but when google showed me their version of the warning there was very little I could do with it since looking through my logs and emails showed no signs of any attempted attacks.
- Johnny555 11y agoRather than stealing your password so they can log in to your Facebook account, won't these state sponsored hackers just steal the authentication cookie that your browser sends to show that it's been authorized by MFA?