5 ms·
I lead Security and Privacy Engineering at Facebook and wanted to chime in on this thread. As soon as we found the vulnerability, our first priority was to det
by pcanahuati 8y ago
I lead Security and Privacy Engineering at Facebook and wanted to chime in on this thread.
As soon as we found the vulnerability, our first priority was to determine how we could protect people most effectively. If we had closed the vulnerability immediately, the attackers could have escalated their attack to modify information or post as someone else by using the access tokens they had already acquired before we reset them. Instead, we determined all the potentially affected accounts and reset their access tokens in a coordinated way to prevent further misuse of the vulnerability.
We haven't reset 90M accounts all at once before. Identifying the attackers, defining our remediation, validating that it would work, and closing the vulnerability while simultaneously ensuring all accounts were secure is complex to do at scale.
- trevyn 8y ago>our first priority was to determine how we could protect people most effectively. You could have taken the site down until it was fixed. So protecting people was your second priority.
- btian 8y ago+1 Everything should be in lock down mode while accessing vulnerability and working on a fix.
- shawn 8y agoWhen you respond like this, you discourage comments like the parent from being posted to HN. It would be fine if your point was reasonable. But it's not. It's little more than an excuse to hate on Facebook.
- ric2b 8y agoHe's just tearing down the PR speak.
- maslam 8y agoYes exactly. A rational response to this is to delete your FB account.
- ariwilson 8y agoI've been involved in incident response where that was actually the decision made, so this is a real choice (extremely costly, obviously).
- deleted 8y ago[deleted]
- Balgair 8y agoLook, I know you are going to get hammered here, but on the off chance you'll see this, can I make a recommendation? You all need to read up on war; because, let's face it, y'all are in one. Here are good starting texts for the cyberwar: https://www.amazon.com/Art-War-Sun-Tzu/dp/1599869772 https://www.amazon.com/Art-War-Sun-Tzu/dp/1599869772 (the parts on the type of ground are very good and should be instructive to y'all) https://www.artofmanliness.com/articles/ooda-loop/ https://www.artofmanliness.com/articles/ooda-loop/ (It seems you guys have been 'looped' pretty badly, this will start the process of fixing that) https://www.amazon.com/War-Carl-von-Clausewitz/dp/1469947021 https://www.amazon.com/War-Carl-von-Clausewitz/dp/1469947021 (the sections on 'fog of war' should help you all out, the text in general is informative)
- trhway 8y agoIf you're for real I wonder whether your posting here obeys the company external communication policy :)
- fossuser 8y agoThanks for responding here with your thinking around the issue - I know there's always strong pressure to not engage or that any talking to the public will just backfire/make things worse, but I appreciate the insight into how you're thinking about these things and the complexity around the tradeoffs.
- rachelbythebay 8y agoThat sounds like a difficult thing to do in under a year. Why push the issue?
- XJOKOLAT 8y agoLOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOL