9 ms·

Facebook admits SMS notifications sent using two-factor number was caused by bug

100 points by amingilani 9y ago

greggarious 9y ago
Is "we decided to do this then later decided it was a bad idea" a "bug"? I thought bug implies unintended behavior. Not intended behavior that wasn't fully thought through and may have conflicted with other silos in the org.
- craftyguy 9y ago
  You're absolutely right, but the vast majority of facebook's target audience has come to understand that "bug" is synonymous with "oops, we messed up (pay no attention to whether this was intentional or not)"
jstanley 9y ago
> Facebook uses the automated number 362-65, or “FBOOK,” Without even looking at a phone keypad, how can this make sense? The 3rd and 4th characters can't both be O if they come from different keys. Perhaps they mean 32665?
- Kiro 9y ago
  Pretty sure it's 326-65, yes. Otherwise 2 would be wrong as well.
mtgx 9y ago
Not this excuse again. Everything Facebook has ever been caught doing maliciously was classified as bug - at least until they turned it back on later and called it a "super important security feature the world couldn't live without - so, you're welcome?!", like they did/are doing with the datr cookies. They're also going to get caught using people's supposed "face authentication" biometrics (another recent "security feature", which btw is a stupidly reckless feature even when taken at face-value, because biometrics should be stored client-side not in a centralized database where millions of profiles can get hacked at once) for 100% advertising purposes, and they'll probably call it a bug again if there's strong backlash against it, at least until they make sure they can't get caught the next time they do it.
- drak0n1c 9y ago
  They are probably not lying. If they get sued in a class action lawsuit and this public statement is found to be a fabrication then they will be in way more trouble than this entire issue is causing them in the first place.
  - shakna 9y ago
    "Bug" is a nice wide term covering a lot of things. This could have been a feature that wasn't intended to go live yet. It got exposed early, so that's a bug. Another option: It was supposed to go live everywhere, but only went live in a small area. Still a bug.
philfrasty 9y ago
Reminds me of a seller on Amazon I bought from who misused the customer's phone numbers to ask for reviews (as a seller myself I honestly don't know why Amazon would display them publicly at all). One day I get a 500 character SMS: „Do you want 20 coffee-tabs FOR FREE? Just leave us a 5 star review on XYZ and email xyz@evil.com blablablabalbla“. Turned out to be the quickest 1 star review I had ever given.
- 0x00000000 9y ago
  There is no quicker way to get a 1 star review than spamming me through Amazon marketplace emails to leave a review.
adamjc 9y ago
I find it extremely hard to believe that this was a bug. Obviously without knowing FBs internals we'll never know, but why you'd write software that would have everything wired up together, your SMS notification service has the ability to post notifications on your behalf? I'm not buying it. This was either poor engineers, or they're lying. With the quality stuff FB put out (React, Jester, etc), I find the former to be hard to accept. I'd find it more believable if this wasn't a bug, but something behind a feature toggle that they didn't intend to push live just yet.
- deleted 9y ago
  [deleted]
- franciscop 9y ago
  If this is really a bug, I can see this as a human bug or communication issue. They have their standard sms notification system on one place. The creator(s) of the 2FA system saw a phone field on the profile and just pushed the number there when saving the phone as a 2FA without checking that this would be used for notifications as well. The person checking the code sees a phone number coming in, and it being saved into the phone field, so no issue from this point of view.
  - usrusr 9y ago
    That's a widespread class of bug (deserving of a short, memorable handle like off-by-one, semantic collision perhaps?), but could it apply here? I'd sure hope that the world's most prominent authentication provider would keep their 2FA more isolated than that from their ad pipes.
    - rtpg 9y ago
      Fb is big, but you could imagine 2FA involving maybe 3 pairs of eyeballs to get deployed. That, if combined with less of a sensitivity to the distinction between "profile number" and "auth-related number" , would make this bug almost certain to happen.
    - rando444 9y ago
imron 9y ago
And let me guess, it was an intern who did it (or a 3rd party contractor).
eitland 9y ago
Same company that bought the privacy-oriented communication startup WhatsApp, changed the terms with default opt-in and started feeding data back to themselves. Bug this time? Maybe. Maybe not. To me it seems some parts of that company are constantly lying and pushing the boundaries of creepy (while other parts are doing somewhat useful stuff).
- p49k 9y ago
  Default opt-in for existing accounts, complete inability to opt out for new accounts.
scotthtaylor 9y ago
cough bullst cough
0x00000000 9y ago
Yeah I'm sure it's a "bug" that they spam you with irrelevant push notifications ("did you see X commented on Y's photo?") even when you have push notifications turned off in account settings. I'm sure it's also a bug that the screen on the app that let you select a recent notification and say "don't show me notifications like this" also disappeared
- UncleEntity 9y ago
  Maybe that's the team where the Microsoft ME devs they poached back in the day go to retire? I jest, I jest... It is crazy annoying how needy they are with their "engagement" emails though.
deleted 9y ago
[deleted]
scrollaway 9y ago
It's not just the notifications. I don't like how they require a number for SMS fallback when TOTP is set up. SMS for 2FA is insecure and I specifically do not want to use it, I only want TOTP. And yet, every single code I generate on my authenticator also gets sent to my SMS number. It's incredibly annoying. Anyone from Facebook who worked on/with this care to comment?
- dublinben 9y ago
  If you add a U2F security key to your account as well (which you really ought to) you can turn SMS fallback off.
  - scrollaway 9y ago
    I don't have a U2F key (for various reasons) and while I appreciate that the option is there for those that use one, it's really no excuse.
    - tuxxy 9y ago
      Sorta unrelated, but mind commenting on why you don't have one? Is it a security thing or do you just not have one/like one?
      - scrollaway 9y ago
        Not enough support to warrant having it for basically only my google and github accounts. I use keepassxc totp which gives me reliable seed backups etc, and still gives me 95% the same level of security.
username223 9y ago
Way back when FB rolled out 2FA, I weighed the additional security of that over a strong random password, versus the obvious downside of them having my phone number. Basically, it was a small chance of some weirdo hijacking an account containing nothing sensitive (FB doesn't have my credit card, either), versus a large chance of a giant ad/surveillance company using my phone number to make money. I ultimately chose not to set up 2FA, and now I think that was a good decision for exactly the reasons I predicted. I'm also very skeptical of the "bug" explanation, given how persistently they have been asking for my phone number lately.
bitL 9y ago
FB PM's algorithm: If a feature is a success, boast about how you created it from the scratch and take all the credit (ofc giving brownie points upwards in the hierarchy). If a feature is a disaster, claim it's a bug and scorn a developer scapegoat!
mikeash 9y ago
Why is this “admits”? This is the kindest possible explanation for them. “Admits” would be if they said they did it on purpose.
- dilap 9y ago
  Yeah, I think "claims" would fit a lot better here.
pfarnsworth 9y ago
Why do people keep misusing the word “deprecate”? Everyone I know seems to think deprecate means “to desupport” or to “end functionality” but it means “to discourage its use”. When someone says “we plan to deprecate it soon” they really mean “we plan to remove the feature soon”, since it’s already likely deprecated.
- toomanybeersies 9y ago
  In the tech community, deprecate has had the meaning of "end functionality" for at least a decade.
jotm 9y ago
Yes, "a bug". How convenient.
tempodox 9y ago
What a lame and transparent excuse. They “admit” it was a “bug” so they don't have to admit they got caught.
deleted 9y ago
[deleted]
m3kw9 9y ago
Most responses here days by these companies is that this was a bug and we will fix it after being caught
retox 9y ago
Every time they get caught doing something shady it's a 'bug'. Same for Google sniffing up all the WiFi signal data from the streetview cars. It fucking stinks.
vincengomes 9y ago
"Bug"

100 points by amingilani 9y ago

Is "we decided to do this then later decided it was a bad idea" a "bug"? I thought bug implies unintended behavior. Not intended behavior that wasn't fully thought through and may have conflicted with other silos in the org.

craftyguy 9y ago
You're absolutely right, but the vast majority of facebook's target audience has come to understand that "bug" is synonymous with "oops, we messed up (pay no attention to whether this was intentional or not)"

jstanley 9y ago

> Facebook uses the automated number 362-65, or “FBOOK,” Without even looking at a phone keypad, how can this make sense? The 3rd and 4th characters can't both be O if they come from different keys. Perhaps they mean 32665?

Kiro 9y ago
Pretty sure it's 326-65, yes. Otherwise 2 would be wrong as well.

mtgx 9y ago

Not this excuse again. Everything Facebook has ever been caught doing maliciously was classified as bug - at least until they turned it back on later and called it a "super important security feature the world couldn't live without - so, you're welcome?!", like they did/are doing with the datr cookies. They're also going to get caught using people's supposed "face authentication" biometrics (another recent "security feature", which btw is a stupidly reckless feature even when taken at face-value, because biometrics should be stored client-side not in a centralized database where millions of profiles can get hacked at once) for 100% advertising purposes, and they'll probably call it a bug again if there's strong backlash against it, at least until they make sure they can't get caught the next time they do it.

drak0n1c 9y ago
They are probably not lying. If they get sued in a class action lawsuit and this public statement is found to be a fabrication then they will be in way more trouble than this entire issue is causing them in the first place.
- shakna 9y ago
  "Bug" is a nice wide term covering a lot of things. This could have been a feature that wasn't intended to go live yet. It got exposed early, so that's a bug. Another option: It was supposed to go live everywhere, but only went live in a small area. Still a bug.

philfrasty 9y ago

Reminds me of a seller on Amazon I bought from who misused the customer's phone numbers to ask for reviews (as a seller myself I honestly don't know why Amazon would display them publicly at all). One day I get a 500 character SMS: „Do you want 20 coffee-tabs FOR FREE? Just leave us a 5 star review on XYZ and email xyz@evil.com blablablabalbla“. Turned out to be the quickest 1 star review I had ever given.

0x00000000 9y ago
There is no quicker way to get a 1 star review than spamming me through Amazon marketplace emails to leave a review.

adamjc 9y ago

I find it extremely hard to believe that this was a bug. Obviously without knowing FBs internals we'll never know, but why you'd write software that would have everything wired up together, your SMS notification service has the ability to post notifications on your behalf? I'm not buying it. This was either poor engineers, or they're lying. With the quality stuff FB put out (React, Jester, etc), I find the former to be hard to accept. I'd find it more believable if this wasn't a bug, but something behind a feature toggle that they didn't intend to push live just yet.

deleted 9y ago
[deleted]
franciscop 9y ago
If this is really a bug, I can see this as a human bug or communication issue. They have their standard sms notification system on one place. The creator(s) of the 2FA system saw a phone field on the profile and just pushed the number there when saving the phone as a 2FA without checking that this would be used for notifications as well. The person checking the code sees a phone number coming in, and it being saved into the phone field, so no issue from this point of view.
- usrusr 9y ago
  That's a widespread class of bug (deserving of a short, memorable handle like off-by-one, semantic collision perhaps?), but could it apply here? I'd sure hope that the world's most prominent authentication provider would keep their 2FA more isolated than that from their ad pipes.
  - rtpg 9y ago
    Fb is big, but you could imagine 2FA involving maybe 3 pairs of eyeballs to get deployed. That, if combined with less of a sensitivity to the distinction between "profile number" and "auth-related number" , would make this bug almost certain to happen.
  - rando444 9y ago

imron 9y ago

And let me guess, it was an intern who did it (or a 3rd party contractor).

eitland 9y ago

Same company that bought the privacy-oriented communication startup WhatsApp, changed the terms with default opt-in and started feeding data back to themselves. Bug this time? Maybe. Maybe not. To me it seems some parts of that company are constantly lying and pushing the boundaries of creepy (while other parts are doing somewhat useful stuff).

p49k 9y ago
Default opt-in for existing accounts, complete inability to opt out for new accounts.

scotthtaylor 9y ago

cough bullst cough

0x00000000 9y ago

Yeah I'm sure it's a "bug" that they spam you with irrelevant push notifications ("did you see X commented on Y's photo?") even when you have push notifications turned off in account settings. I'm sure it's also a bug that the screen on the app that let you select a recent notification and say "don't show me notifications like this" also disappeared

UncleEntity 9y ago
Maybe that's the team where the Microsoft ME devs they poached back in the day go to retire? I jest, I jest... It is crazy annoying how needy they are with their "engagement" emails though.

deleted 9y ago

[deleted]

scrollaway 9y ago

It's not just the notifications. I don't like how they require a number for SMS fallback when TOTP is set up. SMS for 2FA is insecure and I specifically do not want to use it, I only want TOTP. And yet, every single code I generate on my authenticator also gets sent to my SMS number. It's incredibly annoying. Anyone from Facebook who worked on/with this care to comment?

dublinben 9y ago
If you add a U2F security key to your account as well (which you really ought to) you can turn SMS fallback off.
- scrollaway 9y ago
  I don't have a U2F key (for various reasons) and while I appreciate that the option is there for those that use one, it's really no excuse.
  - tuxxy 9y ago
    Sorta unrelated, but mind commenting on why you don't have one? Is it a security thing or do you just not have one/like one?
    - scrollaway 9y ago
      Not enough support to warrant having it for basically only my google and github accounts. I use keepassxc totp which gives me reliable seed backups etc, and still gives me 95% the same level of security.

username223 9y ago

Way back when FB rolled out 2FA, I weighed the additional security of that over a strong random password, versus the obvious downside of them having my phone number. Basically, it was a small chance of some weirdo hijacking an account containing nothing sensitive (FB doesn't have my credit card, either), versus a large chance of a giant ad/surveillance company using my phone number to make money. I ultimately chose not to set up 2FA, and now I think that was a good decision for exactly the reasons I predicted. I'm also very skeptical of the "bug" explanation, given how persistently they have been asking for my phone number lately.

bitL 9y ago

FB PM's algorithm: If a feature is a success, boast about how you created it from the scratch and take all the credit (ofc giving brownie points upwards in the hierarchy). If a feature is a disaster, claim it's a bug and scorn a developer scapegoat!

mikeash 9y ago

Why is this “admits”? This is the kindest possible explanation for them. “Admits” would be if they said they did it on purpose.

dilap 9y ago
Yeah, I think "claims" would fit a lot better here.

pfarnsworth 9y ago

Why do people keep misusing the word “deprecate”? Everyone I know seems to think deprecate means “to desupport” or to “end functionality” but it means “to discourage its use”. When someone says “we plan to deprecate it soon” they really mean “we plan to remove the feature soon”, since it’s already likely deprecated.

toomanybeersies 9y ago
In the tech community, deprecate has had the meaning of "end functionality" for at least a decade.

jotm 9y ago

Yes, "a bug". How convenient.

tempodox 9y ago

What a lame and transparent excuse. They “admit” it was a “bug” so they don't have to admit they got caught.

deleted 9y ago

[deleted]

m3kw9 9y ago

Most responses here days by these companies is that this was a bug and we will fix it after being caught

retox 9y ago

Every time they get caught doing something shady it's a 'bug'. Same for Google sniffing up all the WiFi signal data from the streetview cars. It fucking stinks.

vincengomes 9y ago

"Bug"