29 ms·
Facebook Network Breach Impacts Up to 50M Users
- dom96 8y agoSome more details here: https://newsroom.fb.com/news/2018/09/security-update/ https://newsroom.fb.com/news/2018/09/security-update/
- sdwisely 8y ago> But it’s clear that attackers exploited a vulnerability in Facebook’s code that impacted “View As”, a feature that lets people see what their own profile looks like to someone else. This allowed them to steal Facebook access tokens which they could then use to take over people’s accounts oh boy, what a mess.
- erichurkman 8y agoUser impersonation code always terrifies the bajeebus out of me.
- sp332 8y agoYou only get to see your own profile. It's a very useful tool to make sure you're not leaking data you people you'd rather not give it to.
- brown9-2 8y ago> You only get to see your own profile. Well, when it doesn't have a security hole.
- chrisweekly 8y ago... until the mechanism turns out to have an exploit, as just happened here.
- TeMPOraL 8y agoCould have been any other mechanism on the site.
- iamdave 8y ago...but it wasn't. Which is the point, no?
- TeMPOraL 8y agoWhich is why the point doesn't make sense. The article says tokens were leaked. There are plenty other places where such bug could happen, so it shouldn't serve as a strong validation of "User impersonation code always terrifies the bajeebus out of me". (Not to mention it's not really user impersonation, it's just filtering your profile page based on computed access level of one of your friends.)
- jrockway 8y agoI don't think that matters. "I hate travelling by air because the plane can crash" is a true statement for many people... but statistically, that's not the method of transportation that kills people. The fact of the matter is... ACLs are hard to get right. It's even harder when you have various roles that can be checked against the ACL (logged in user, batch job, logged in user impersonating someone, etc.) . But in the end, complexity is what's scary, not some feature that depends on complexity.
- dylan604 8y ago> The fact of the matter is... ACLs are hard to get right This sounds similar to different distros of linux. Some are security focused where nothing is allowed until it is explicitly allowed. Other distros try to be more "user-friendly" and pretty much everything is open. Starting from a wide open starting point and then trying to batten down the hatches afterwards does seem to the harder way to do it, but that's exactly where FB is. They wanted everything open, and then had to decide to start limiting that data. FB was designed as a place to share info. If you posted it, you wanted to share it. I totally get that mentality. However, as devs, I can imagine that we have all built something that the end users use in a way not envisioned, and we've probably all had "you're holding it wrong" lines of thinking. Once you get to that point, you can alienate users by telling them to stop doing it that way or embrace what's happening, and then make it work for them. Seems like the perfect situation to where bugs can get introduced.
- seq 8y agoWell, thanks to Facebooks "View As" functionality, I recently discovered that their privacy setting "Only Me" does not work for only me, if another person is tagged in the picture. Meaning that if I have a picture with my ex somewhere in profile, set to "Only Me", it actually means "Only me... and her".
- sp332 8y agoRight, the interface isn't very clear but instead of "Only Me" it shows "Only Me (+)" and if you hover it says: "Only Me, Anyone tagged."
- daten 8y agoSomething similar happened 8 years ago. https://techcrunch.com/2010/05/05/video-major-facebook-security-hole-lets-you-view-your-friends-live-chats/ https://techcrunch.com/2010/05/05/video-major-facebook-secur...
- ransom1538 8y agoif ( loggedin_user() ) { }.... oh shit wait, since it is viewAs it's not that it's current_user() oops.
- michaelmcmillan 8y agoI think they’ve been breached like this previously. What a mess.
- modeless 8y agoIsn't this the second time this feature has been exploited? I thought I remembered a similar issue from a while ago.
- BillinghamJ 8y agoYes, there have been other cases of exactly the same issue. I recall a case where it was possible to pretend to be people via the chat system while using “View as”.
- Alex3917 8y agoStealing the access token is the worst possible attack, because it wouldn't get logged or lead to any sort of notification. If they were only able to steal the passwords, this would have gotten caught immediately.
- goldenManatee 8y agoAm catching up. Would these tokens be the signed JWT’s, if so am wondering how they were able to figure out the signature part?
- richardowright 8y agoI imagine you just "replay" the issued/signed JWT to Facebook, so you can act like that user.
- jshap70 8y agothis should be the thread link
- stephenhuey 8y agoMove Fast and Fix Things instead?
- snarf21 8y agoSo is this what the hacker was going to livestream the deletion of Zuck's page? In the end, they submitted a bug to FB so I'm assuming this is the exploit that was intended to be used.
- 3K7m7bUZyWA1KCD 8y agoDoes anyone have an idea on how this exploit could have worked? If only the hacker(s) would write a blog article or make a LiveOverflow-style video about it. It would be quite entertaining. I'd be so curious/intrigued to know more about this specific exploit, it's a shame it wasn't a responsible disclosure from a white-hat.
- 1mike12 8y agoOne of the top comments by herpderperator dives into it pretty good. The part that I had questions was where it tied into the increased traffic patterns. But if I'm understanding it correctly, that would be because you're baiscally walking the graph, each token that you compromise, you have to masquerade as that new person to expose more tokens that they are connected to.
- prolikewh0a 8y agoIsn't this what happens at Facebook 24/7/365, just this time it wasn't authorized/paid for?
- coldcode 8y agoDid not mention what was leaked/taken or how 50M and not everyone.
- redlorryyellow 8y agoIt said anyone who has used the "view as" may have been accessed
- jjjjjjjjjjjjjjj 8y ago> Since we’ve only just started our investigation, we have yet to determine whether these accounts were misused or any information accessed. We also don’t know who’s behind these attacks or where they’re based. We’re working hard to better understand these details — and we will update this post when we have more information, or if the facts change. In addition, if we find more affected accounts, we will immediately reset their access tokens. From the press release[0] posted elsewhere in this thread [0] https://newsroom.fb.com/news/2018/09/security-update/ https://newsroom.fb.com/news/2018/09/security-update/
- microwavecamera 8y agoOr why FB waited almost a week to tell us.
- artursapek 8y agoI think a week is pretty reasonable. They were probably investigating to even get an initial understanding of what happened.
- r3bl 8y ago> On the afternoon of Tuesday, September 25, our engineering team discovered a security issue affecting almost 50 million accounts. Now it's 28th, meaning that they've disclosed the breach within 72 hours, as requested by at least one regulation (Article 33 of the GDPR). That's clearly not even half a week.
- microwavecamera 8y ago
- irishcoffee 8y agoEmpty dupe also on front page: https://news.ycombinator.com/item?id=18094852 https://news.ycombinator.com/item?id=18094852
- sctb 8y agoThanks! We've duped it.
- dawhizkid 8y agoIs it wrong to be glad FB's reputation has tarnished (and stock price sideways) over the past year or so? For so long they've monopolized the talent pool in the Bay Area. If more people decide 1) they don't want to work at FB and 2) FB employees are itching to leave then I see any stain on FB's employment brand as a net positive to the greater tech + startup ecosystem.
- onychomys 8y agoThat's fine, but it would be okay with those of us who live elsewhere if maybe the tarnishing didn't come as a result of things like this.
- teagee 8y agoBased on their privacy issues, influence scandal, etc. its scary to imagine what the company looks like without the best and brightest.
- kidsnow 8y agoSame could be said for Google
- AlexandrB 8y agoI think about this a lot too. All companies eventually decline or go through rough patches. A Google that's fighting for survival and losing money would be much more open to working with the Chinese government or selling user data to the highest bidder. Trusting these entities based on their noble intentions today makes no sense to me if there's no legal agreement or regulation to restrain them tomorrow, when they get desperate.
- stickdogg 8y agoLmao. Very good point.
- 394549 8y ago> Is it wrong to be glad FB's reputation has tarnished (and stock price sideways) over the past year or so? No, not at all. Their positive reputation was in many ways unearned, and it's a good thing to be glad that their own actions and attitudes are finally catching up with them.
- IBM 8y agoIf you watched the Senate hearing on privacy two days ago you'd have seen that they were remarkably on the same page about potential privacy legislation [1]. Facebook's continued fuck ups will only help the cause, and for that I'm grateful. [1] https://www.c-span.org/video/?451963-1/google-apple-amazon-tech-companies-testify-data-privacy https://www.c-span.org/video/?451963-1/google-apple-amazon-t...
- nv-vn 8y agoOf course they're on the same page. They can afford the best lawyers and as much infrastructure as they need to fulfill the requirements, while every new competitor gets sued from all angles. I'd be very surprised if any of that regulation actually serves the user in any positive way.
- IBM 8y agoI was talking about the Senators.
- rajathagasthya 8y ago> This attack exploited the complex interaction of multiple issues in our code. It stemmed from a change we made to our video uploading feature in July 2017, which impacted “View As.” Obviously, Facebook is an extremely complicated system. But I find it hard to believe a video uploading feature would impact 'View As'.
- mic47 8y agoMayve it has some complicated privacy rules?
- rajathagasthya 8y agoPossible. Some more technical details would be nice, but I doubt Facebook releases the post-mortem to the public.
- throwawaymath 8y agoIt's very easy for me to believe. "View As" is an authorization and authentication sensitive, limited user impersonation feature. Video uploading interacts with, and complicates, authorization in an application with fine grained privacy and permission models. It's intuitively straightforward that modifying code for uploading videos could (read: not should) have authorization and authentication ramifications. One of those ramifications could then result in a vulnerability chain compromising user impersonation functionality. I have seen far, far more incredulous head scratchers in penetration tests and code reviews. The interaction boundaries of, or middleware between, two seemingly unrelated systems is generally a good start to look for a security vulnerability.
- rajathagasthya 8y ago> It's intuitively straightforward that modifying code for uploading videos could (read: not should) have authorization and authentication ramifications. I get this part. But why would it affect only videos and not other entities (photos, status etc.)? I would think creating (or uploading) any of the entities have the same authorization and authentication ramifications. What could be different for videos? Unless the privacy models are so fine grained that you can have different privacy settings for different entities (haven't used Facebook in years, so I don't really know). Your explanation makes sense, I'm just looking for a concrete example.
- losvedir 8y agoI wonder where the "50M users" estimate comes from. It seems like the feature that caused it, "View As", is probably available to more than that many people. Does this mean that they managed to trace the attacker capturing the access tokens of 50M users? Even allowing for the bug in the first place, it seems like exploiting it should be detected before 50M uses.
- moltar 8y agoProbably they have stats on how many people actually used the feature.
- tlobes 8y agoMost likely this. I have a few dev accounts, one which I know I used the feature at some point, another few which did not and those were not reset.
- cryptozeus 8y agoThey have different versions of code base deployed to different areas of the world all the time. They can reduce the user base nuber based on where the code was deployed and how much is the usage
- jzawodn 8y agoSo that's why I had to re-login this morning.
- raleigh_user 8y agoI h8 them
- rvnx 8y agoThe interesting part is that it is the second time (at least) that this is happening. In the past, when you were using "View As" you could read private messages without doing anything malicious (you were actually logged on victim's Messenger account).
- samfriedman 8y agoRelated to the recent black-hat turned white-hat episode with the guy who was going to delete Zuck's page, perhaps?
- murph-almighty 8y agoThat was my immediate thought. Is the livestream cancelled?
- simonswords82 8y agoI heard on Reddit that it had been cancelled as he'd been paid out by FB.
- EGreg 8y agoOn the one hand, every time another scandal or breach is revealed about centralized networks, I want to post this and have everyone recognize the root problem and the solution: https://Qbix.com https://Qbix.com (see the video) On the other hand, I feel like I’m shamelessly promoting/shilling my own company. How to do it in a classy way? I really believe that there is a problem people are not recognizing enough to do something about it (Diaspora and Mastodon and Solid are exceptions). And I spent the last 7 years and $700K of our company’s profits solving it. So it’s now solved. If Mastodon is “a decentralized Twitter creation kit” where you own your own data, then Qbix is a “decentralized Facebook creation kit” where you can assemble social apps from a growing marketplace of reusable components, some of which don’t exist anywhere. Here for example is a Group Rides plugin that basically makes a social Uber, and ANYONE can have it on their OWN social network: https://youtu.be/Z7Q7IzVv1VU https://youtu.be/Z7Q7IzVv1VU OK, but we are perfectionists and are spending months polishing “the other 90%” so it’s not a flop when we release it to the public to create their own facebooks. We need really clean onboarding and measure engagement metrics and fix bugs etc. It took 7 years thus far. For example this was last year, we are way more advanced now: https://vimeo.com/208438090 https://vimeo.com/208438090 So, advice would be appreciated from people who have successfully done before. Maybe contact me (qbix.com/about has my email link). How do we get the story out there that Qbix is being built to FIX the underlying root problem of decentralizing social networking, so people’s data isn’t in one place? Please if you have some knowledge about this, take a look at the above videos and let us know what advice you have to get stories actually published. PS: one more thing, we managed to get tons of inadvertent press back in March including BBC and Newsweek, which you will find if you search for “calendar mining” or “qbix calendar”. BUT when I reached back out to thise journalists to cover an actual story of Qbix is actually doing, none of them replied. Many of them just want to break the sensational controversy because that brings notoriety. How do you make them write about SOLUTIONS to problems?
- lukebennett 8y agoSeeing as you asked... your website's terrible UX doesn't help. I just took a look and moved on within 30 seconds - a dated look and feel (that also feels targeted at primary school teachers), walls of text, broken links, no clear route back to the homepage to reorient yourself (can't click the logo), no clear waypoints to follow... You only get one chance to make a first impression. I'm afraid the first impression I got means I'm unlikely to return. I suspect the same applies to all those who took a look in March.
- red_admiral 8y agoI find facebook's effects on privacy and democracy as scary as the next person, but so far their secure coding standards have been extremely high. They're one of the few big names NOT on haveibeenpwned.com, they run their passwords through a KDF and then encrypt the result with a hardware security module, and a whole lot of other good things. I guess even the best (at secure coding) sometimes mess up.
- 51lver 8y agoMany users are still going to use the same password for their FB account and email account. All the security in the world won't fix people.
- ilaksh 8y agoPervasive biometric security may be the next step. I know it's scary and could actually be abused but it also can generally increase the level of security for everyone.
- lurker456 8y agoIf your password is leaked, then you can still reset it. If your fingerprint signature leaks, you're out of options.
- why_only_15 8y agoBurn your fingers!
- red_admiral 8y agoThis may be an urban legend, but I've heard there was once a bank robber who dipped his fingertips in acid. After a few months, his fingers healed, and the prints were exactly the same as before.
- sorokod 8y ago
- riquito 8y ago90 millions, the title should be updated (50 millions certainly affected + 40 millions for precaution (so far))
- wfwefwef32 8y agoRecently talked to 2 friends working for fb. According to them, the culture there is very toxic. For a master's degree, once get in, you need to get promoted in 22 months (I might misremember the actual number.) or you will have to leave. Debugging is never counted as a real work, so for quick promotion, nobody wants to solve bugs unless a bug becomes too obvious. And they also complained about no work-life balance. They got pushed to check-in code at 12a.m. for example.
- quotemstr 8y agoWhat, exactly, is wrong with the expectation that people make senior level eventually? What exactly is wrong with being able to work at any time? I worked there for years, and if I was landing code at 12am, it was because I was excited about what I was doing. It was wonderful being able to work with people from all over the world on high-impact projects, and fixing important bugs was definitely high-impact. People who fixed vexsome bugs were heroes.
- twoheadedboy 8y agoWhat you call being "excited about working at 12am" I call "accepting being a corporate slave".
- quotemstr 8y agoI don't think you can so glibly dismiss enthusiasm as Stockholm syndrome. Passionate people push the world forward, and mocking passion is a recipe for mediocrity and stagnation.
- mancerayder 8y agoOn the flip side celebrating a culture where (allegedly) people are expected to toss out their personal lives and time (what is sometimes referred to as passion in some circles) is a race to the bottom. It means colleagues who DON'T do this are punished or replaced. Perhaps that's what you refer to as mediocrity, the unwillingness to put in long workdays that extend into night.
- seem_2211 8y agoFacebook is really getting hammered in the press this week.
- deleted 8y ago[deleted]
- sabalaba 8y agoLooks like they're clearing out compromised sessions. https://twitter.com/facebook/status/1045722820582432768 https://twitter.com/facebook/status/1045722820582432768 I was logged out of Facebook about 30 minutes ago.
- dylan604 8y agoWhy not just clear out 100% of sessions?
- jpdb 8y agoI am speculating, but perhaps, "Thundering Herd,"[0] concerns? [0] https://en.wikipedia.org/wiki/Thundering_herd_problem https://en.wikipedia.org/wiki/Thundering_herd_problem
- SilasX 8y agoBecause they're too smart to have missed any. They hire only the best and wouldn't miss something like this.
- aviv 8y ago> The company is in the beginning stages of its investigation. This is code for "this is much worse than we are telling you now, we just can't reveal it all at once". I dislike Facebook as much as the next person.. but I have to say, Facebook Ads are a goldmine if you know what you're doing. It's not going to be that way forever.
- IvyMike 8y agoSo here is a question: my girlfriend only uses FB on her laptop, and always logs out when she's done. I usually make fun of her for doing this. But does this mean most of the time that there was no active access token and she is mostly safe? (Excluding the windows of time where she was actively using FB) Do I have to take back all of my teasing?
- modeless 8y agoI doubt it. The "View As" feature does not require the target to be currently logged in to Facebook AFAIK.
- IvyMike 8y agoThis is an interesting point. Right now, I can't reconcile the "we canceled active sessions thus logging people out" as a fix with the fact that "View As" was the attack vector.
- rstupek 8y agoIt's likely the fix required the kill active sessions which cause new keys to be generated on sign in
- leddt 8y agoI'm guessing they invalidated all access tokens for accounts that have been used as "View As" targets since the issue was introduced. They also disabled "View As" which is the actual fix for the time being.
- kidsnow 8y agoOnly if the act of logging out explicitly invalidates the token on the server side
- dylan604 8y agoThis is something I would suspect doesn't actually happen. FB wants to track all of the user's browsing habits, so maybe they just make the actual FB UI look logged out? Security-wise, it would seem to be more complicated by their desire to never let a user be logged out, and looks like it's complicated enough it is biting them in the backside. Oops?!
- enitihas 8y agoWas everyone logged out automatically or only those who were affected? Is anyone here who wasn't logged out today?
- Strongerpass 8y agoI'm logged on on my phone and hane not seen any security notices in my feed. Have not been logged out. Edit: Same on my PC. Still logged on.
- bonniemuffin 8y agoI was still logged in. I just went and did the "log out all my active sessions" thing just for good measure, even though I didn't see anything unusual there.
- testplzignore 8y agoFun fact: https://newsroom.fb.com/news/2018/09/security-update/ https://newsroom.fb.com/news/2018/09/security-update/ was published at 16:42:44. https://www.nytimes.com/2018/09/28/technology/facebook-hack-data-breach.html https://www.nytimes.com/2018/09/28/technology/facebook-hack-... was published at 16:45:41. NYT writes fast :)
- laken 8y agoIn the journalism world, pre-written articles are apparently quite common. I assume they had a boilerplate already for the next Facebook controversy, and just wrote 2-3 opening paragraphs that were relevant for this one. CNN many years ago accidentally left some of their pre-written obituaries for (living) world figures publically accessible. https://en.wikipedia.org/wiki/List_of_premature_obituaries#The_CNN.com_incident https://en.wikipedia.org/wiki/List_of_premature_obituaries#T...
- refurb 8y agoThe FB press release was probably shared early with the agreement it would be embargoed by the media until FB made it official. It's not uncommon. It's how you build "friendly" relationships with the media. I scratch your back, you scratch mine.
- the_clarence 8y agoThis is probably not at all what happened. Things get heard and articles get quickly written. In this case it can even be the company spreading the news to key media companies in order to control the spreading of the news.
- reaperducer 8y agoIn the journalism world, pre-written articles are apparently quite common. Actually, not "common" at all. Obituaries for famous people are often done in advance, since everyone dies. It used to be one of the things that young journalists/interns did to cut their teeth. But not every company has a massive security breach, so this was not pre-written. It's not uncommon for big companies to fax (yes, fax) bad news to news organizations a few hours or days before posting it on their own web sites. In the past, there would be embargoes on the information, but in the case of bad news, those are routinely ignored.
- 0xmohit 8y agoWhy do I get a feeling that this "breach" notification is related to the following news that appeared a day earlier? “Facebook Is Giving Advertisers Access to Your Shadow Contact Information” Source: https://gizmodo.com/facebook-is-giving-advertisers-access-to-your-shadow-co-1828476051 https://gizmodo.com/facebook-is-giving-advertisers-access-to...
- itsdrewmiller 8y agoFun quotes from all of two months ago: 'Facebook is clearly aware that losing its chief security officer and dissolving its dedicated security team, in the middle of all that’s going on, is not a great look. So many of the company’s statements today are clearly designed to address obvious concerns that arise. “We expect to be judged on what we do to protect people’s security, not whether we have someone with a certain title,” a spokesperson said. In another statement, Facebook said it is “investing heavily in security to address new types of threats” and that its new security structure has “helped us do more to keep people safe.”' Source: https://www.theverge.com/2018/8/1/17640852/facebook-cso-alex-stamos-departing-no-replacement https://www.theverge.com/2018/8/1/17640852/facebook-cso-alex...
- quotemstr 8y agoIt is essential that tech companies, especially ones that provide critical infrastructure, place technical excellence above other priorities. Denigrating meritocracy is like pollution: the impact may not be immediate, and in the short term, it may look like you can have your cake and eat it too, but the universe is not caring and not kind, and if you forget about the need for excellence in the continual struggle against entropy, nature will eventually get around to teaching you a harsh and remedial lesson.
- gaahrdner 8y agoIs Facebook now considered critical infrastructure?
- fareesh 8y agoAccording to some in the US government, Facebook can change the result of an election, so I guess that would qualify
- JumpCrisscross 8y ago> According to some in the US government, Facebook can change the result of an election, so I guess that would qualify Essential infrastructure describes "assets that are essential for the functioning of a society and economy" [1]. Not things that can cause a lot of damage. Bombers aren't essential infrastructure. Facebook is non-essential. [1] https://en.wikipedia.org/wiki/Critical_infrastructure https://en.wikipedia.org/wiki/Critical_infrastructure
- rachelbythebay 8y agoDon’t chase away the fixers.
- lemming 8y agoI'm glad this doesn't affect me since I don't use Facebook. Oh, wait, it doesn't matter since they move heaven and earth to collect and store my data anyway, and of course I can't get them to delete it. Seriously, fuck Facebook.
- inglor 8y agoRandom question - is there a way to naturalize in the EU and use GDPR to ask Facebook to remove your data? (For example an Estonian digital citizenship) I might be way way off and I am (obviously) not a lawyer but interested in material about this.
- arprocter 8y agoI believe it only applies if you are physically in Europe
- qwertay 8y agoThe GDPR only says "EU citizens" Doesn't mention if that means you have to be in the EU or not currently.
- latexr 8y agoThat’s an interesting tactic. I’m a EU citizen and I’ve always been intrigued by Estonia’s digital citizenship. I’ve only picked a few tidbits about how it works and they may be wrong, so take this with a grain of salt. From what I understand, a digital citizenship is different from a normal citizenship. It allows you to, for example, open a company, but I don’t know if it gives you enough to make you a EU citizen. In Portugal there’s a bit of a kerfuffle about the Golden Visa programme[1] because it’s seen as a way to buy EU citizenship for cheap[2] and cause problems for nationals[3]. I’m not aware of the same happening through Estonia, so it makes it me think it doesn’t give you EU citizenship. In addition, you have to actually go to Estonia to set up the digital citizenship; it’s not something you can do completely offline and be done with it. Methods such as marriage are not that effective in Portugal, at least at the moment. I know of two people with legitimate reasons to get Portuguese citizenship and the process has been a chore, taking years. [1]: https://en.wikipedia.org/wiki/Portugal_Golden_Visa https://en.wikipedia.org/wiki/Portugal_Golden_Visa [2]: Yes, you need to invest, but you keep your investment. [3]: House prices in major cities and surrounding areas are through the roof.
- gouggoug 8y agoFrom Facebook's announcement: "After they have logged back in, people will get a notification at the top of their News Feed explaining what happened." I personally did not get any explanation as to why I had to log back in. It did surprise me to be logged out this morning and was wondering why.
- tmalsburg2 8y agoThis is how you are treated when you're not a customer. Glad I left a couple of years back.
- dylan604 8y agoLogged out of and back into what? Your mobile app? Your web browser tab that is left open indefinitely? I no longer use FB, so just curious. I know people that never log out of FB, and have closed their browser window/tab thinking that was good enough even though the "remember me" type option was checked. Opening a new window/tab to FB would show their account just like nothing happened because they did not log out. I know this is to FB's advantage of tracking all the things, but wow what a security nightmare.
- kilpikaarna 8y agoThere's no remember me option antymore, it always remembers. You have to log out manually and/or set your browser to delete the cookies and/or use Ghostery if you don't want FB tracking you all over the web...
- LukeWalsh 8y agoThis was the unit I received: https://imgur.com/G7sBbwX https://imgur.com/G7sBbwX It linked here: https://www.facebook.com/help/2687943754764396?ref=comms https://www.facebook.com/help/2687943754764396?ref=comms
- alberts00 8y agoSame situation here, I was logged out of all sessions and did not receive any notice.
- 8y ago
- jt3 8y agoBeing an application security consultant, I see this stuff a lot unfortunately. Just takes a missing authorization check on the feature, then you got the keys to the kingdom.
- erjohnson 8y agoWhat are some secure Facebook Messenger alternatives to use? The only reason I currently have Facebook is because of the ease behind Messenger but I do not want to continue using their services. I also need to be able to convince my friends to try a different platform since I want to be able to continue to communicate with them. Any advice?
- albertgoeswoof 8y agoTotally understand, instead you can use WhatsApp Or Instagram has great messaging, and if you’re brave oculus can do great VR chat!
- lgeorget 8y agoThere are some well-known alternatives: Signal, Telegram, any XMPP server (which you can host)... As for convincing your friends to switch to it, there's no one-size-fit-all method.
- 8y ago
- SketchySeaBeast 8y ago2.23 billion active users, 50 million affected. ~2% of their user base. Wow, that's a lot of people affected, and somehow just a tiny sliver of their user base.
- lima 8y agoWorst case: the attacker now has 90 million user's messaging history. Fun times.
- propman 8y ago...is that seriously possible with this scope and such little time?
- millzlane 8y agoI know for sure that you can view all of the pictures sent in a conversation if you have never "ended" the conversation. All I can think about is all of my partners who have sent x rated photos using messenger. It could very well be the next "fappening" and tied to real identities.
- lima 8y agoYes, we don't know how much time the attacker had.
- kossTKR 8y agoA few thoughts and observations: 1) I was logged out randomly of messenger on my iPhone for the first time ever, i think a week ago. Like messenger completely reset for no reason, and i had to put in my cellphone number again. I don't know if this has to do with the breach. Also i received several snapchat 2-factor codes without requesting them on my cellphone. 2) If the message history has leaked it will absolutely unimaginable consequences for many people, myself included. Nothing incriminating but enough to make me paranoid and make loads of people shameful, loose their partners, loose their friends, loose their employment, have their reputation tainted forever. It's absolutely insane if it shows up in an indexed fashion somewhere. Black mirror is becoming real. 3) For the first time i am actually thinking about seriously migrating from "all corporate services" - and only searching through TOR through VPN on duckduckgo if i have to search for something personal. 4) I will probably forget all about migrating to privacy oriented services in a few days. 5) Living these days can make me slightly paranoid, a new feeling i guess, that has not been experienced by most humans before. The feeling of being watched constantly, of being potentially revealed in some vague fashion. A strange and unhealthy feeling for sure, no matter how banal your life probably is to the rest of the world. Now everyone knows how it is to live in eastern germany under STASI, or like in Iraq or Syria before the breakdowns, - just potentially worse if these leaks get real. I think "privacy" is a basic human necessity right at the bottom of the Maslow pyramid even though a common trope in pop culture is that privacy is a new phenomenon. I think that is utterly wrong, a tribe back in the days was like an organism, an extension of the self, that also required privacy from other tribes. Regardless of who requires it, right from the earliest, animals and humans have been hiding them selves both from predators and from their prey. Later the mammalian brain extended this need for privacy as a basic necessity in the interaction in basic civilisation, from politics, to civic life, in family life and in war. It's all a game of showing and telling. This vague fuzzy paranoid panopticon feeling is devastating. 6) In a few years neural nets will trawl the net and run stylometric analysis - everyone will be ranked and have complete psychological profiles created, all their whereabouts will be mapped completely by inference, you will know everything everyone has done for the last 20 years in complete detail including their desires and emotions. Lol
- anontechworker 8y agoI have some friends who were new grads and put on the security team. My first thought was, why put new grads on the security team? Do they really have the experience to protect this sort of data?
- pdeuchler 8y agoSaid this yesterday in the other Facebook thread, and I'll say it again. Working for Facebook is a morally bankrupt position. If you are an engineer you have plenty of job opportunities available to you and there is no excuse for you to continue contributing your labor and time to a wholly malignant organization. At a certain point one has to ask how we as an industry will start dealing with those who continue to take a paycheck from Facebook even in the face of constant and horrific evidence of wholesale ethical violations and negligence.
- justtopost 8y agoDownvoting this makes it no less true. You are personally reponsible for every project you enable.
- chronid 8y agoSo is working at Google, Amazon and probably 90% of the big corps of the world in many sectors - from oil to finance to pharmaceutical to telecommunications and so on. And we can include the government. If you're a subcontrator or sold in body rental (modern IT slavery) you're also in the same position as an employee, so you're enabling their evils. Also, if one of those companies is a client of your company you're also enabling them (or a client of a client of your company? How many layers of separation should exist between you and Walmart before you stop being an accomplice in enabling their abuse of workers?). Your point? Should we stop working in IT and go back to the fields? Also, I fear that HN somewhat forgets the world is not SF, in Europe going to work for Facebook/Google/Amazon is a enormous bump (we're speaking 2-4x) of salary for many people, which in some cases means you can buy an house after 3-4 years even with the crazy rents back in your home country - and that's HUGE. Why should those people spend their time slaving as a subcontractor for yet another TLC/bank trying to squeeze their customers dry at the first occasion while getting 25% the salary and zero benefits? Are those less evil? What needs to happen is that people keep applying pressure so facebook is forced to adapt its business model even if it hits their bottom line - which is already happening apparently.
- enraged_camel 8y ago>>in Europe going to work for Facebook/Google/Amazon is a enormous bump (we're speaking 2-4x) of salary for many people, which in some cases means you can buy an house after 3-4 years even with the crazy rents back in your home country - and that's HUGE. So this is how we justify it now? “But it will allow me to buy a house in 3-4 years”?
- thegeomaster 8y agoThe "View As" feature has caused a massive vulnerability in the past: https://techcrunch.com/2010/05/05/video-major-facebook-security-hole-lets-you-view-your-friends-live-chats/ https://techcrunch.com/2010/05/05/video-major-facebook-secur... I bet they're now really regretting keeping it around.
- xeromal 8y agoYeah, I thought this was old news I heard years ago, but I guess the broke it again.
- arduinomancer 8y agoDoes anyone else get the feeling that maybe security just doesn't scale for sites like this? You have facebook being this huge target for attacks and you combine that with 10,000 engineers with likely not a lot of security training. Even a single point of failure could compromise the whole site, what are the chances that no one makes a mistake? Its like the bigger your company grows while still having a single product, the higher the probability something like this happens...
- RoadieRoller 8y agoMy mind has fashioned me to think that these leaks, so called, are planned. To why I think so, is simple. When you, as Facebook, sell user data to other companies/third parties/countries, then it is crime, or is subject to investigation when it is known. But these so called leaks, are deemed "we are sorry, we will fix it, but we are so sorry about the data". And that is it. No one is responsible. Now you have 50 million people's data for sale. Are you in that 50 million? You don't know or you will never know. Connected incidents - British Airways Data Leak, Equifax, Uber Data Theft Cover Up, Air Canada, T-Mobile, Dixons Carphone......how many such. All of them soon will be available for sale, with no one to blame for.
- maym86 8y agoWild speculation. Any evidence? I don't think there has been much stopping these companies selling the data up to this point. That's been the issue with Facebook and others, they have happily sold peoples data with little legal protection for the people whose data they sell. There is no crime in just selling the data within the US so your theory doesn't hold up. Never attribute to conspiracy that which is adequately explained by incompetence.
- RoadieRoller 8y agoI don't have any evidence. But I just like to think it that way. Also it could be because I finished reading most of the books mentioned here https://news.ycombinator.com/item?id=17749283 https://news.ycombinator.com/item?id=17749283 BTW there are people who need data, not just people within US. https://www.nytimes.com/2018/09/26/world/asia/trump-china-election.html https://www.nytimes.com/2018/09/26/world/asia/trump-china-el... "Mr. Trump did not suggest that China’s behavior was on the scale of Russia’s sophisticated campaign of manipulating social media and the release of hacked emails during the 2016 presidential election." https://www.rappler.com/technology/news/211276-facebook-twitter-testimony-us-senate-september-5-2018 https://www.rappler.com/technology/news/211276-facebook-twit... Sen. Richard Burr, R-N.C., the chairman of the Senate Intelligence Committee, opened the hearing by citing the promise of social media before adding, "But we've also learned about how vulnerable social media is to corruption and misuse. The very worst examples of this are absolutely chilling and a threat to our democracy." Already, Russia and Iran have sought to interfere by passing themselves off as American groups or people to shape the views of American voters, say lawmakers and technology executives. Facebook, Google and Twitter together took down hundreds of accounts tied to the two countries last month, a move that prompted Burr to open the hearing Wednesday by expressing fear that "more foreign countries are now trying to use your products to shape and manipulate American political sentiment as an instrument of statecraft." Cambridge Analytica - Worked with some Indian Political Parties or the Government itself too. Lawmakers aren't limited in the questions they can pose Facebook and Twitter. Sandberg's boss, Facebook CEO Mark Zuckerberg, faced questions in April hearings that extended far beyond the reason the hearing was called: Facebook's entanglement with Cambridge Analytica, a political consultancy that improperly accessed 87 million users' personal information. Sandberg could also face questions on Cambridge Analytica.
- securityn00b 8y agoAnother big bummer for FB
- carrja99 8y agoWell thank goodness I left facebook a year ago. Never regret it! Now I can interact with people in person in peace vs. heated online debates about DJT that make me want to avoid them in person.
- jimnotgym 8y agoThe billion dollar question: are any of the affected users EU citizens?
- bartcobain 8y agoyes
- seq 8y agoDefinitely yes, and plenty enough.
- genzoman 8y agoUntil they can provide some data that say the 50 million number is a fact, I don't believe it's that low. Every breach starts out on the low end, and miraculously ends up being double or triple as they do "more research" and the initial anger dies down.
- dylan604 8y agoBut in today's reality, that revised number is framed as fake news. Somebody has an axe to grind, and is artificially inflating the numbers. I am totally baffled in the post-fact world.
- ddebernardy 8y agoIt's only a post-fact world on a handful of media outlets.
- dylan604 8y agoSadly, where I live, Texas, that handful of media outlets is what is viewed by the majority. Also, relating back to FB, it has become an echo chamber. Most people lock into one source, and once they are locked in, that information becomes gospel. They favorite/like/follow these sources, and that's all they will accept. Before I left FB, I was inundated with other people's posts from this handful of media outlets. People I know and consider friends, but this is what they are into. It was tiresome and baffling.
- sct202 8y agoI'm pretty sure they logged out more than <5% (90m of 2B) of their users, because of the people I talk to on a daily basis on Messenger like well over 2/3s got logged out. I could see if they meant 90m of American users or something.
- arnaudsm 8y agoWhy the downvotes ? This is important data, and no one gave this information in the whole thread.
- leothekim 8y agoThe security update was written by.. a VP of product management[1]. I would have thought they'd have a bigger bench for their security team. [1] https://newsroom.fb.com/news/2018/09/security-update/ https://newsroom.fb.com/news/2018/09/security-update/
- erikpukinskis 8y agoLike a dedicated security UI person? Or a security writer? What kind of role are you imagining?
- cheeze 8y agoI'd expect a notification about a breach to come from * CSO * VP of security * CEO/CTO
- jzl 8y agoYou know they just lost their highly revered head of security and said there would be no replacement, right? https://www.theverge.com/2018/8/1/17640852/facebook-cso-alex-stamos-departing-no-replacement https://www.theverge.com/2018/8/1/17640852/facebook-cso-alex...
- leothekim 8y agoYep. Doesn't mean there isn't a bench.
- spike021 8y agoAh, so this is why I was force-logged out everywhere for my two accounts in the past day or so.
- wil3 8y agoWould it be premature to change my account password in response to this? Also, does anyone know if phone numbers associated with accounts are included in this breach?
- cheeze 8y agoRotating your password is never a bad thing
- Xyik 8y agoIts sad that everytime there is a post about Facebook the comments are extremely toxic and negative, and don't really even discuss the article itself. I would argue that 80% of all tech companies are doing close to 0 in making the world a 'better place'.
- drb91 8y agoSeems like the sad thing is that SV companies are actively making the world worse, not that reaction to this is negative.
- lern_too_spel 8y agoBut few are actively making the world a worse place.
- minikites 8y agoI wouldn't limit that 80% to the technology industry. Capitalism isn't optimized for human or societal welfare, it's optimized for resource extraction and the production of disposable goods.
- genericone 8y agoFacebook's goal: Connect all the people Google's goal: Organize all the information Amazon's goal: Sell all the merchandise ----------- Taken at face value, all those companies were/are all trying to make the world a better place in the ways available to them. But when the externalities of those goals affect other people, they will become hated. Everyone has a different opinion of what 'better' means. Since giant companies are most able to execute their vision of better, they will get most of the hate from people who have a different opinion of better. Looks to me like its all just a battle for power: People with ideas but lacking implementation and execution, vs Companies with ideas, implementation, execution, AND momentum. Let's not forget all the different forms of government either...
- deleted 8y ago[deleted]
- 8y ago
- iMuzz 8y agoHere's the banner that they put up on peoples newsfeeds: https://imgur.com/G7sBbwX https://imgur.com/G7sBbwX Nowhere on that banner does Facebook make it clear that there was recently a severe security issue that may have resulted in the loss of personal user information (Making it much less likely for the user to actually click 'Learn More'). It's misleading to title this with just "An Important Security Update" and make it seem like they've just updated their systems. No mention of the recent compromise until you click 'Learn More'.
- jazoom 8y agoThey've been showing me that banner for a while. In fact, they stopped showing it to me about a week ago. Are your sure it's related?
- KyeRussell 8y agoThis is 100% the banner I have received. The call to action directs you to this page: https://www.facebook.com/help/2687943754764396?ref=comms https://www.facebook.com/help/2687943754764396?ref=comms Which is the issue at hand.
- jazoom 8y agoOkay. That's very deceptive of Facebook. Also, it's "100%" the banner I saw for several days last week. Make of that what you will. I didn't click it so I don't know what it pointed towards.
- angusb 8y agoThis banner is crazily insufficient. It disappears forever after you visit any other page, without you having to acknowledge its existence. I just checked fb, and went quickly to my first notification. I didn't really register what the banner was until maybe a second after it loaded - at which point I had already clicked on my first notification. By that point, the banner is gone forever. I can't find any way to get it back. It's so, so easy to miss this message.
- sct202 8y agoAre they under-estimating that 90 million people (out of 2 billion accounts) have to log back in? I had to log back in and so did 6 out of the 8 people I've asked so far. Purely anecdotal, but it just seem unusual that if only 5% of accounts are affected that so many of the people I talk to would be potentially affected.
- DickVanDyke 8y agoWhere are you located, I suspect it is related to location.
- Globz 8y agoWhat really freaks me out is the day Facebook die, what will happen to all of this data? If you heard about the NCIX story where they basically abandoned their servers filled with users data (over 13 years of data) and someone scooped them up and tried to resell them on the black market, one could think that a similar fate is possible. source : https://www.privacyfly.com/articles/ncix_breach/ https://www.privacyfly.com/articles/ncix_breach/ Obviously if Facebook was going under it would probably trigger a huge legal process on how to handle the data but it clearly doesn't happen for smaller businesses...
- mtrn 8y ago> What really freaks me out is the day Facebook die, what will happen to all of this data? Interestingly, Facebook owns your data. I believe if they wanted to, they could close the company tomorrow and put a facebook.tar.xz of everything they collected on archive.org or somewhere else.
- kotajacob 8y agoI wonder if archive.org could actually store that much data.. and how long it would take to create a tar.xz of it.
- jrowley 8y agoWhat file systems would support a tar that big?
- birracerveza 8y agohttps://en.wikipedia.org/wiki/ZFS https://en.wikipedia.org/wiki/ZFS
- Symbiote 8y agoIf they did that with any European data, they would soon face criminal charges. (Except if a European office of Facebook did it, then the nationality doesn't matter.)
- RobertSmith 8y agoEven after two grilled Senate hearings in this year, Facebook has not taken things seriously
- saagarjha 8y agoThey weren’t really grilled at the hearings at all. I heard maybe two “difficult” questions from Senators, and both ended up getting the response “we’ll follow up later”.
- dillondoyle 8y agoMy session was reset. I don't remember using view as feature in probably at least a year or two (I haven't actually use FB web/app over the last year or two). But my company does buy political ads and I have gone through the affidavit/id verification. I wonder if FB reset all political buyer accounts too just to be safe?
- shanemlk 8y agoI read that article about how the Whatsapp founder got screwed over by Facebook. Facebook is sad company. I'd much rather pay for a quality product, then be a pawn in this data collection crap.
- zinssmeister 8y agoWe compiled details on this breach here, including some insights on the attack vector https://breachroom.templarbit.com/facebook-is-breached-by-hackers-putting-50-million/ https://breachroom.templarbit.com/facebook-is-breached-by-ha...
- ehsankia 8y agoIs this in any way related to the person earlier who said they would livestream hacking Zuckerberg's account?
- zinssmeister 8y agoNo, but that sounds entertaining!
- ianamartin 8y agoIt's not 50 million users. It's all of them. The numbers will go up and up and up in small increments until they basically just admit that it's everyone. They break the news in the middle of a national political event, minimize the numbers, and that's the worst of it. The coming ripples that up the numbers will be mostly ignored.
- stretchwithme 8y agoIt sounds like users might be more susceptible if they recently had a birthday or know someone that did. Of course, birthdays aren't the only reason the uploader is active. "But for certain types of posts on users' timelines, such as prompts to post happy birthday greetings, the video uploader function was shown as active."
- herpderperator 8y agoExcerpts from the press call transcript [1] by Guy Rosen explaining what lead to this breach being possible: > The first bug was that, when using the View As function to look at your profile as another person would, the video uploader shouldn’t have actually shown up at all. But in a very specific case, on certain types of posts that are encouraging people to post happy birthday greetings, it did show up. > The second bug was that this video uploader incorrectly used the single signon functionally, and it generated an access token that had the permissions of the Facebook mobile app. And that’s not the way the single sign-on functionality is intended to be used. > The third bug was that, when the video uploader showed up as part of View As -- which it wouldn’t do were it not for that first bug -- and it generated an access token which is -- again, wouldn’t do, except for that second bug -- it generated the access token, not for you as the viewer, but for the user that you are looking up. > It’s the combination of those three bugs that became a vulnerability. Now, this was discovered by attackers. Those attackers then, in order to run this attack, needed not just to find this vulnerability, but they needed to get an access token and then to pivot on that access token to other accounts and then look up other users in order to get further access tokens. This is the vulnerability that, yesterday, on Thursday, we fixed that, and we’re resetting all of those access tokens to protect security of people’s accounts so that those access tokens that may have been taken are not usable anymore. This is what is also causing people to be logged out of Facebook to protect their accounts. [1] https://fbnewsroomus.files.wordpress.com/2018/09/9-28-press-call-transcript.pdf https://fbnewsroomus.files.wordpress.com/2018/09/9-28-press-...
- 0xmohit 8y agoFacebook is blocking users from posting stories about its security breach Some users are reporting that they are unable to post today’s big story about a security breach affecting 50 million Facebook users. The issue appears to only affect particular stories from certain outlets, at this time one story from The Guardian and one from the Associated Press, both reputable press outlets. ... The situation is another example of Facebook’s automated content flagging tools marking legitimate content as illegitimate, in this case calling it spam. https://techcrunch.com/2018/09/28/facebook-blocks-guardian-story/ https://techcrunch.com/2018/09/28/facebook-blocks-guardian-s...
- yuliyp 8y agoWhich posts are being blocked? The Guardian one and the AP one linked at the top of that post work fine for me.
- myth_buster 8y agoThose articles were hitting their spam filter (not sure why reliable news sources won't be whitelisted) which prevented users from posting and deleted posts that were already made. They may have fixed the "bug" now.
- kderbyma 8y agoIt's because the Guardian is not a 'Reputable' new site wholly. It is still remotely published stories that aren't under employees or constant people. I am pretty sure associated Press is the same. They are better than say Rebel, but not much better
- oliveshell 8y ago> pretty sure associated Press is the same. You’re joking, right?
- chottocharaii 8y agoLol
- sonnyblarney 8y agoinevitable
- ouid 8y ago>One of the challenges for Facebook’s chief executive Mark Zuckerberg is convincing users that the company handles their data responsibly.
- lorinm 8y agoMove fast and break things...
- hvass 8y agoI was logged out of my account, but reviewing logs of devices that are using/have used my account in the past I don't see anything suspicious. What is the likelihood that the account was breached and accessed without triggering any of those systems? Is it plausible to speculate that it was possible for accounts to have been accessed without users receiving emails from Facebook?
- hestefisk 8y agoI am so glad I shut down my fb account six months ago.
- a_imho 8y agoMore probable you gave up access to your account six months ago. Imo it is worth considering keeping it around and actually obfuscating its content.
- sp527 8y agoThey logged me out of all my accounts and now I can't log back in because of their ridiculous 2FA setup. I never provided them my phone number, so they need me to use their code generator via an active login...except of course I no longer have any active logins. This is the most ridiculous possible edge case for a $X00B firm. #SoftwareIsHard
- bogomipz 8y ago>"“This is another sobering indicator that Congress needs to step up and take action to protect the privacy and security of social media users,” Senator Mark Warner, a Democrat from Virginia and one of Facebook’s most vocal critics in Congress, said in a statement." What an ass. It's simply amazing that he makes a statement like that when Congress hasn't bothered to "stand up" to Equifax, Experian and TransUnion yet. Not once. Maybe look into protecting privacy and security of people period, FB and social media are but one component of that.
- bogomipz 8y agoSo "View As" a tool intended to help you prevent leaking data about yourself was used by others to leak your data. What a complete shit show this company has become.
- dwighttk 8y agoI was just logged out of my account hours after this story broke... that "50M users" is probably going to go up...
- DickVanDyke 8y agoI think the total number of 'affected' users is 90M. The reason for this is they KNOW of 50 million, but there are an additional 40 M logged out "just in case".
- DickVanDyke 8y agoThose of you that did have to login again, where are you located?
- rrdharan 8y agoI'm in the US (NY).
- daveheq 8y agoThe more popular something is, the more it's a target.
- tflinton 8y agoi know i'm a jerk for thinking this but "what do you expect from PHP"
- Zelphyr 8y agoI'm no fan of how bad PHP code is often written but between the choice of laying blame on PHP or Facebook's "Move fast and break shit" philosophy, I'm choosing the latter.
- kgc 8y agoMaybe 'view as' should just return a static page.
- chrdlu 8y agoMy girlfriend and I experienced a really weird bug in the past. We would see that Facebook said we were active in the middle of the night when we were definitely asleep. It didn't make too much sense then, but now its possible that those instances might have occurred due to someone else accessing our accounts? Both of our accounts were logged out. Did anyone else experience anything like that?
- bedivere 8y agofriend, I might have some bad news for you...
- SubMachineGhost 8y agoAFAIK if you have messenger installed and you have internet connection, Facebook displays your status as active.
- doubtfuluser 8y agoFacebook can be so happy, that this always happens on Fridays... unthinkable what might happen with the stock price if things would happen on other days. As a responsible company they would never ever postpone publication for sure.
- tempodox 8y agoI'd be curious to know how much information was stolen on people who aren't even FB users.
- umbula 8y agoDeeper analysis from Brian Krebs: https://krebsonsecurity.com/2018/09/facebook-security-bug-affects-90m-users/ https://krebsonsecurity.com/2018/09/facebook-security-bug-af...
- zaman8040 8y agoThe second bug was that this video uploader incorrectly used the single signon functionally, and it generated an access token that had the permissions of the Facebook mobile app. And that’s not the way the single sign-on functionality is intended to be used. Is it just me or does this sound like an terrible idea in the first place? Guess we can't know for sure, but why would anything unrelated to authentication generate access tokens?
- Tade0 8y agoIn my case during re-log-in the second factor of 2FA didn't appear at all. My frist thought was that I must've had turned it off at some point, but I just checked and that isn't the case.
- tatar 8y ago2fa and access tokens are probably stored separately, no?
- humanbeinc 8y agoWas affected by this. Hacker used the token to run rogue Ads on my business manager account. They were pretty clever, because they used proxies in my region so facebook wouldnt send me automatic warnings. I can only encourage everyone to check their running Ads & campaigns and check the audit history log at business.facebook.com asap! Facebook support sucks (also for business users) so dont expect to get your money back.
- hmate9 8y agoGood time to buy facebook shares
- raffael-vogler 8y agoWhy is this not listed on hckrnews.com?
- raffael-vogler 8y agowhy the downvotes?
- allthecybers 8y agoIt's pretty sad that FB still has 50 million users to compromise.