4 ms·

There are some relatively easy countermeasures you can put in place to avoid this. Never display identifying information with the images. Never allow analysts t

There are some relatively easy countermeasures you can put in place to avoid this. Never display identifying information with the images. Never allow analysts to freely lookup images from specific profiles. Make sure the terminals that these analysts work on are blocked from internet access, and have no accessible external drives or USB ports (or run a locked down virtual desktop on a thin client). Maintain a no-camera policy in the workspace, and a policy of always having more than one person on duty in the workspace at the same time. Considering that we haven't seen any stories of employees abusing backend access to the Facebook servers, it feel reasonably safe to assume that they have countermeasures like these in place.

JoshMnem 9y ago
That is a disaster waiting to happen.
- mseebach 9y ago
  Not really. This is well-understood problem with well-understood solutions. There is no reason to believe that Facebook doesn't have both the resources and the motivation to get this right.
  - JoshMnem 9y ago
    I'm highly skeptical about it. Everyone has motivation to avoid getting hacked or have employees/contractors do bad things, but it happens.
notyourday 9y ago
Here is counter measure 1: "Don't upload". Though I, personally, prefer counter-measure two: terminate everyone who approved/supported/championed this project
alxlaz 9y ago
First, yes, there are several countermeasures that can be implemented. That is no indication of the fact that they are implemented. There are some relatively easy countermeasures you can put in place to avoid any security incident, and yet hardly a day goes by without reading about one in the news. There are companies that (supposedly) implement various such countermeasures, and have a very strong incentive to do so, as they handle private, and potentially damning data of important people with millions of dollars to lose in case of a data breach. Just look at Panama Papers, Paradise Papers and the like. If that sort of data can be treated carelessly, I find it somewhat unrealistic to expect better treatment (even from Facebook) of private data belonging to terrified teenagers who effectively have no recourse against misuse of their pictures. Second, it took considerable time for the fact that former NSA employees used the agency's surveillance tools to spy on their ex-lovers, too. The fact that we haven't yet seen any stories of employees abusing backend access to the Facebook servers does not tell us much. In fact, given how much information is publicly shared (sometimes unwittingly) via a Facebook account, it may be hard to tell when such an event occurs.

JoshMnem 9y ago

That is a disaster waiting to happen.

mseebach 9y ago
Not really. This is well-understood problem with well-understood solutions. There is no reason to believe that Facebook doesn't have both the resources and the motivation to get this right.
- JoshMnem 9y ago
  I'm highly skeptical about it. Everyone has motivation to avoid getting hacked or have employees/contractors do bad things, but it happens.

notyourday 9y ago

Here is counter measure 1: "Don't upload". Though I, personally, prefer counter-measure two: terminate everyone who approved/supported/championed this project

alxlaz 9y ago

First, yes, there are several countermeasures that can be implemented. That is no indication of the fact that they are implemented. There are some relatively easy countermeasures you can put in place to avoid any security incident, and yet hardly a day goes by without reading about one in the news. There are companies that (supposedly) implement various such countermeasures, and have a very strong incentive to do so, as they handle private, and potentially damning data of important people with millions of dollars to lose in case of a data breach. Just look at Panama Papers, Paradise Papers and the like. If that sort of data can be treated carelessly, I find it somewhat unrealistic to expect better treatment (even from Facebook) of private data belonging to terrified teenagers who effectively have no recourse against misuse of their pictures. Second, it took considerable time for the fact that former NSA employees used the agency's surveillance tools to spy on their ex-lovers, too. The fact that we haven't yet seen any stories of employees abusing backend access to the Facebook servers does not tell us much. In fact, given how much information is publicly shared (sometimes unwittingly) via a Facebook account, it may be hard to tell when such an event occurs.