9 ms·

I find it extremely hard to believe that this was a bug. Obviously without knowing FBs internals we'll never know, but why you'd write software that would have

by adamjc 9y ago

I find it extremely hard to believe that this was a bug. Obviously without knowing FBs internals we'll never know, but why you'd write software that would have everything wired up together, your SMS notification service has the ability to post notifications on your behalf? I'm not buying it. This was either poor engineers, or they're lying. With the quality stuff FB put out (React, Jester, etc), I find the former to be hard to accept. I'd find it more believable if this wasn't a bug, but something behind a feature toggle that they didn't intend to push live just yet.

deleted 9y ago
[deleted]
franciscop 9y ago
If this is really a bug, I can see this as a human bug or communication issue. They have their standard sms notification system on one place. The creator(s) of the 2FA system saw a phone field on the profile and just pushed the number there when saving the phone as a 2FA without checking that this would be used for notifications as well. The person checking the code sees a phone number coming in, and it being saved into the phone field, so no issue from this point of view.
- usrusr 9y ago
  That's a widespread class of bug (deserving of a short, memorable handle like off-by-one, semantic collision perhaps?), but could it apply here? I'd sure hope that the world's most prominent authentication provider would keep their 2FA more isolated than that from their ad pipes.
  - rtpg 9y ago
    Fb is big, but you could imagine 2FA involving maybe 3 pairs of eyeballs to get deployed. That, if combined with less of a sensitivity to the distinction between "profile number" and "auth-related number" , would make this bug almost certain to happen.
  - rando444 9y ago
    The phone number is too important to them for tracking purposes. It allows them to tie your instagram usage to your facebook account to your whatsapp conversations even if none of them are linked together, and then create a big map of all of the people you interact with on the different platforms. The more phone number information they have, the more powerful their map.
- FLUX-YOU 9y ago
  "Every wrong-doing as a bug" would be a brilliant PR strategy.
kd5bjo 9y ago
Facebook uses low-priority bugfixes as training tasks for junior developers. It's entirely possible this was somebody 6 weeks out of university who sent the notification to the first phone record they came across. Not many people have different 2fac and SMS numbers set up, so this could easily get through testing. As for the SMS reply posting back to Facebook, that's been a live feature for about a decade. It was long defunct when 2fac was introduced, so I'm not surprised there are odd interactions there.
- vvanders 9y ago
  Get through testing sure, but their metrics should have shown a massive spike in SMS once it started rolling out. That seems like the thing you'd want to trigger automatic rollbacks on.
  - UncleMeat 9y ago
    Of course. But do you really not know anybody who has fucked up a canary rollout or had a rollback system with a flaw that prevented an automatic rollback?
zimbatm 9y ago
It seems to be consistent with the explanation that the SMS messaging system has been re-purposed. Old system: send updates via SMS, post replies onto the wall. New system: send 2-factor authentication codes. Now mix both and you get what was happening here. I bet the engineer who thought of doing that was feeling very smart. Not having to setup a whole new secure SMS delivery infrastructure. It might not be true but I like the irony of it :)
karmakaze 9y ago
The word 'admits' in the title stuck out as not verifiably true. Like Apple protecting old phones from battery damage. What I mean by it is that seems like some great spin, to concede a fault and try and appear humble.
- gwright 9y ago
  I'm automatically suspicious of headlines that use "admit". It almost always indicates a judgmental pre-conception of the activity rather than unbiased reporting. If "confirms" or "acknowledges" had been used instead it would be a much more neutral report.
JoshMnem 9y ago
> I find it extremely hard to believe that this was a bug. It reminds me of this comment: "Whoops, I accidentally inserted 350 lines of code across some .java and .xml files and linked a vendor's library and when my hand slipped I accidentally registered API keys and inserted them into the metadata of the program, and when it went to code review and production release, they accidentally accepted it and uploaded it to their distribution server." https://www.reddit.com/r/Android/comments/6nrv88/htc_says_keyboard_ads_were_an_error/ https://www.reddit.com/r/Android/comments/6nrv88/htc_says_ke...
- Vendan 9y ago
  Which is a bit of an exaggeration, when you also include the reply: "To be fair, HTC has apparently partnered with the 3rd party keyboard TouchPal for their device keyboard, who also do an ad supported version. I can imagine a situation where TouchPal/HTC accidentally released an ad supported build instead of the HTC specific build."
booleandilemma 9y ago
Are they expecting us to shrug and say “Hanlon’s razor”?
- UncleMeat 9y ago
  Yes? I'm frankly baffled that people on hn cannot seem to see how this could be a bug.
  - jacquesm 9y ago
    Because it's Facebook and they have a pretty long history of sleazy behavior.
    - nugi 9y ago
      Exactly. Logic and history dictate they fall on the far end of the razor by default now. Anything less is frankly, nieve.
toomanybeersies 9y ago
I believe that it was a bug, because SMS notifications have been a feature on FB for a very long time. They just haven't been relevant for half a decade due to the introduction of smart phones. I remember using Facebook via SMS back when I was in high school c. 2010 on a flip phone. I can't see this as FB trying to push a feature on people, because this feature is so old, almost antiquated. I was surprised to discover that it even existed any more.
- jacquesm 9y ago
  It actually could be a bug. And for many other companies I'd be happy to believe them. But just like for bitcoin exchanges 'we've been hacked' is no longer believable FB has a problem when they wish to attribute to accident what could also be attributed to malice. Remember the time when they started messing with the emotional state of their users in the name of an undisclosed scientific experiment? That's roughly when they lost the benefit of the doubt about 'accidents'. https://www.theguardian.com/technology/2014/oct/02/facebook-sorry-secret-psychological-experiment-users https://www.theguardian.com/technology/2014/oct/02/facebook-...
  - tedunangst 9y ago
    Did they later claim their study was done by accident?
    - jacquesm 9y ago
      The point is, in case I'm not making it clear enough, that 'accident' is just another convenient excuse to trot out when caught doing something unsavory, tasteless, creepy or downright illegal. FB has plenty of examples along those lines so I will no longer give them the benefit of the doubt on any claims like these. For that to work you have to have a documented track record of building trust rather than a documented track record of transgressions.
      - tedunangst 9y ago
        Doing something shitty and doing something shitty then lying about the cause are two different things. I think you're smart enough to know the difference. This is sloppy logic.
ec109685 9y ago
Why is it easier to believe that Facebook would want to ask for a user’s phone number twice: one for 2 factor verification purposes and one for notification purposes, rather than storing it just once? Given it was obvious they would get crucified by folks for spamming a 2FA number, why do you believe Alex Stamos and Facebook (a public company with React, Jester, etc.) are now lying to the public rather than this being an actual bug?
tehlike 9y ago
I believe it is a bug. Not hard to see. Fb uses a number to send 2fa, but also messages sent to the same number is posted on status page. Probably routing conflict was not caught by presubmit tests. I can imagine one system can bind to outgoing and incoming separately.

by adamjc 9y ago

deleted 9y ago

[deleted]

franciscop 9y ago

If this is really a bug, I can see this as a human bug or communication issue. They have their standard sms notification system on one place. The creator(s) of the 2FA system saw a phone field on the profile and just pushed the number there when saving the phone as a 2FA without checking that this would be used for notifications as well. The person checking the code sees a phone number coming in, and it being saved into the phone field, so no issue from this point of view.

usrusr 9y ago
That's a widespread class of bug (deserving of a short, memorable handle like off-by-one, semantic collision perhaps?), but could it apply here? I'd sure hope that the world's most prominent authentication provider would keep their 2FA more isolated than that from their ad pipes.
- rtpg 9y ago
  Fb is big, but you could imagine 2FA involving maybe 3 pairs of eyeballs to get deployed. That, if combined with less of a sensitivity to the distinction between "profile number" and "auth-related number" , would make this bug almost certain to happen.
- rando444 9y ago
  The phone number is too important to them for tracking purposes. It allows them to tie your instagram usage to your facebook account to your whatsapp conversations even if none of them are linked together, and then create a big map of all of the people you interact with on the different platforms. The more phone number information they have, the more powerful their map.
FLUX-YOU 9y ago
"Every wrong-doing as a bug" would be a brilliant PR strategy.

kd5bjo 9y ago

Facebook uses low-priority bugfixes as training tasks for junior developers. It's entirely possible this was somebody 6 weeks out of university who sent the notification to the first phone record they came across. Not many people have different 2fac and SMS numbers set up, so this could easily get through testing. As for the SMS reply posting back to Facebook, that's been a live feature for about a decade. It was long defunct when 2fac was introduced, so I'm not surprised there are odd interactions there.

vvanders 9y ago
Get through testing sure, but their metrics should have shown a massive spike in SMS once it started rolling out. That seems like the thing you'd want to trigger automatic rollbacks on.
- UncleMeat 9y ago
  Of course. But do you really not know anybody who has fucked up a canary rollout or had a rollback system with a flaw that prevented an automatic rollback?

zimbatm 9y ago

It seems to be consistent with the explanation that the SMS messaging system has been re-purposed. Old system: send updates via SMS, post replies onto the wall. New system: send 2-factor authentication codes. Now mix both and you get what was happening here. I bet the engineer who thought of doing that was feeling very smart. Not having to setup a whole new secure SMS delivery infrastructure. It might not be true but I like the irony of it :)

karmakaze 9y ago

The word 'admits' in the title stuck out as not verifiably true. Like Apple protecting old phones from battery damage. What I mean by it is that seems like some great spin, to concede a fault and try and appear humble.

gwright 9y ago
I'm automatically suspicious of headlines that use "admit". It almost always indicates a judgmental pre-conception of the activity rather than unbiased reporting. If "confirms" or "acknowledges" had been used instead it would be a much more neutral report.

JoshMnem 9y ago

> I find it extremely hard to believe that this was a bug. It reminds me of this comment: "Whoops, I accidentally inserted 350 lines of code across some .java and .xml files and linked a vendor's library and when my hand slipped I accidentally registered API keys and inserted them into the metadata of the program, and when it went to code review and production release, they accidentally accepted it and uploaded it to their distribution server." https://www.reddit.com/r/Android/comments/6nrv88/htc_says_keyboard_ads_were_an_error/ https://www.reddit.com/r/Android/comments/6nrv88/htc_says_ke...

Vendan 9y ago
Which is a bit of an exaggeration, when you also include the reply: "To be fair, HTC has apparently partnered with the 3rd party keyboard TouchPal for their device keyboard, who also do an ad supported version. I can imagine a situation where TouchPal/HTC accidentally released an ad supported build instead of the HTC specific build."

booleandilemma 9y ago

Are they expecting us to shrug and say “Hanlon’s razor”?

UncleMeat 9y ago
Yes? I'm frankly baffled that people on hn cannot seem to see how this could be a bug.
- jacquesm 9y ago
  Because it's Facebook and they have a pretty long history of sleazy behavior.
  - nugi 9y ago
    Exactly. Logic and history dictate they fall on the far end of the razor by default now. Anything less is frankly, nieve.

toomanybeersies 9y ago

I believe that it was a bug, because SMS notifications have been a feature on FB for a very long time. They just haven't been relevant for half a decade due to the introduction of smart phones. I remember using Facebook via SMS back when I was in high school c. 2010 on a flip phone. I can't see this as FB trying to push a feature on people, because this feature is so old, almost antiquated. I was surprised to discover that it even existed any more.

jacquesm 9y ago
It actually could be a bug. And for many other companies I'd be happy to believe them. But just like for bitcoin exchanges 'we've been hacked' is no longer believable FB has a problem when they wish to attribute to accident what could also be attributed to malice. Remember the time when they started messing with the emotional state of their users in the name of an undisclosed scientific experiment? That's roughly when they lost the benefit of the doubt about 'accidents'. https://www.theguardian.com/technology/2014/oct/02/facebook-sorry-secret-psychological-experiment-users https://www.theguardian.com/technology/2014/oct/02/facebook-...
- tedunangst 9y ago
  Did they later claim their study was done by accident?
  - jacquesm 9y ago
    The point is, in case I'm not making it clear enough, that 'accident' is just another convenient excuse to trot out when caught doing something unsavory, tasteless, creepy or downright illegal. FB has plenty of examples along those lines so I will no longer give them the benefit of the doubt on any claims like these. For that to work you have to have a documented track record of building trust rather than a documented track record of transgressions.
    - tedunangst 9y ago
      Doing something shitty and doing something shitty then lying about the cause are two different things. I think you're smart enough to know the difference. This is sloppy logic.

ec109685 9y ago

Why is it easier to believe that Facebook would want to ask for a user’s phone number twice: one for 2 factor verification purposes and one for notification purposes, rather than storing it just once? Given it was obvious they would get crucified by folks for spamming a 2FA number, why do you believe Alex Stamos and Facebook (a public company with React, Jester, etc.) are now lying to the public rather than this being an actual bug?

tehlike 9y ago

I believe it is a bug. Not hard to see. Fb uses a number to send 2fa, but also messages sent to the same number is posted on status page. Probably routing conflict was not caught by presubmit tests. I can imagine one system can bind to outgoing and incoming separately.