3 ms·
I certainly wouldn't consider dumping credentials to test for reuse/continued use a privacy violation. If FB wants people not to dump data, they need to make t
by dogecoinbase 11y ago
I certainly wouldn't consider dumping credentials to test for reuse/continued use a privacy violation. If FB wants people not to dump data, they need to make that explicit and specific.
- foldr 11y agoReally? The article states: "To say that I had gained access to basically all of Instagram's secret key material would probably be a fair statement". How on earth would holding on to that data not be a privacy violation?
- dogecoinbase 11y agoHolding credentials is not violating privacy. It would be possible to use those credentials to violate privacy, but merely having them is not that act.
- dsacco 11y agoHolding sensitive credentials is absolutely a violation of privacy. This is like saying that having a user's password is not a privacy violation unless you use it to gain access to their account.
- enixn 11y agoSo would you agree that holding the keys to someone's house is also a privacy violation? What if instead of keys, you were holding a set of lockpicks? Would everyone's privacy of home be immediately violated?
- foldr 11y agoIt's all a question of intent. If you keep the lockpicks so that you can pick locks, then yes. If you're a lockpick collector, then no.
- Gravityloss 11y agoI understood it was employee credentials, not customer.
- comex 11y agoHolding a manually chosen password can be a privacy violation because it's a small peek into the user's psyche. (I wouldn't say the employee "changeme", "instagram" etc. passwords count, although the act of running a password cracking tool meant that he could have seen a more personal password.) Holding some randomly generated numbers that could be used to access a server is not.
- Cakez0r 11y agoSurely they would have to revoke all the keys anyway as they would have no idea if a blackhat got their first and took the keys before the vulnerability was reported?
- bigiain 11y agoAccording to the timeline, Instagram have known about the ssl keys since 1 Dec. My browser is currently showing an ssl cert for instagram.com that was issued in April and expires on Dec 31. Doesn't look like they're in any hurry to revoke that one. (I guess like Alex Stamos told his employer - it's "trivial and of little value"...)