7 ms·

Facebook posting: https://newsroom.fb.com/news/2018/10/update-on-security-issue/ https://newsroom.fb.com/news/2018/10/update-on-security-issu... Check if you a

Facebook posting: https://newsroom.fb.com/news/2018/10/update-on-security-issue/ https://newsroom.fb.com/news/2018/10/update-on-security-issu... Check if you are affected here: https://www.facebook.com/help/securitynotice https://www.facebook.com/help/securitynotice (posting because it took 10+ mins to find it - many media outlets are not linking directly to it)

ryandrake 8y ago
They should not require you to log in to their site to look up whether they have victimized you. I used to have a FB account but threw the random password away. Was I affected? No way to know?
- EnFinlay 8y ago
  Likewise. They should send a notification to all e-mails on record for compromised accounts.
- marricks 8y ago
  Not to mention those of us with deleted Facebook accounts. It looks like I’m not affected but to anyone who had an account during those dates and deleted it since, how do they find out? Yet another reason they should email affected users, guess they care more about not publicizing bad information than taking responsibility.
  - staticassertion 8y ago
    They explicitly state they will email impacted users.
    - coreypreston 8y ago
      Does a user with a deleted account qualify as an impacted user? I think the visibility is an issue. As one of those people, this summer I encountered a spotify issue where my spotify would randomly start playing Cannabis Club ATL. Others had the same issue. Perhaps unrelated, too difficult to tell, especially if FB doesn't consider me an active user.
      - lostlogin 8y ago
        Does a user with a deleted account qualify as an impacted user? If they still store some user details (which it seems they do) and then this leaks - absolutely. What about those who have never been users yet Facebook stores plenty of information about?
    - nabaraz 8y ago
      Does that mean they are still storing my email address? I deleted my account 2 years ago.
      - staticassertion 8y ago
        I don't know? I don't see you would be impacted without an account.
- staticassertion 8y ago
  I guess they may be concerned with unauthenticated users checking if others are compromised.
dhimes 8y ago
FB should timestamp these articles. It happened a couple of weeks ago, or is this new news?
- crunchlibrarian 8y ago
  This is new, particularly the details around search history and location data being stolen, as of an hour ago.
  - what_ever 8y ago
    I think it's the security incident that happened couple of weeks ago and they have more details now?
- philsnow 8y ago
  Everybody should timestamp all articles. People don't want to because they want their content to be "evergreen" and they think that if there's a date that's more than a year or so old, people will disregard / discount the content. So by default many blog CMSs default to not showing the date of any articles.
  - coliveira 8y ago
    Facebook is not a small blog operator. They should view this as a professional communications medium.
    - staticautomatic 8y ago
      Someone in Facebook's PR department is reading this part of the thread and saying "it's working!"
  - andrewflnr 8y ago
    If your content is "evergreen", show me a "last updated" timestamp in the last year. /grump
- mygo 8y ago
jxramos 8y ago
I forget what the text looks like in your second link when you're not logged in but after I logged in the verification text appears as follows: """ Is my Facebook account impacted by this security issue? Based on what we've learned so far, your Facebook account has not been impacted by this security incident. If we find more Facebook accounts were impacted, we will reset their access tokens and notify those accounts. """
- godelmachine 8y ago
  I see the same thing. Wonder if anyone was informed that actually had been affected.
  - teovoinea 8y ago
    I have been affected, quoting text: Is my Facebook account impacted by this security issue? Yes. Based on what we've learned so far in our investigation, attackers accessed the following Facebook account information: Name. Email addresses. Phone number. Based on what we've learned so far in our investigation, the attackers did not gain access to certain information, such as: Account passwords. Payment card or credit card information.
    - thomasahle 8y ago
      Mine continues: Additionally, the attackers also accessed other account information, including: - The following information associated with your Facebook account: - Username. - Date of birth. - Gender. - Types of the devices you've used to access Facebook. - The language you choose to use Facebook in. - If you previously added this specific information to your Facebook account, it was also accessed: - Relationship status. - Religion. - Hometown. - Current city. - Work. - Education. - Website. - The 10 most recent locations you've checked in to or been tagged in. These locations are determined by the places named in the posts, such as a landmark or restaurant, not location data from a device. - The 15 most recent searches you've entered into the Facebook search bar. - People or Pages you follow on Facebook.
sctb 8y ago
Here's the discussion on the Facebook post: https://news.ycombinator.com/item?id=18202589 https://news.ycombinator.com/item?id=18202589.
hikerclimb 8y ago
the best way to keep your passwords secure is the old fashioned way. Write them down and put them in a lock box. I only access my financial information from one computer. Perhaps I am paranoid.
- fjsolwmv 8y ago
  True but not relevant at all to the current discussion.
clubm8 8y ago
How do I check if I've deleted Facebook? Does deleting Facebook mean I no longer have a right to know if my data was breached while I was a member?
- rdtsc 8y ago
  What if I never signed up. I am sure they know about me. Wonder if there is a way to request that information from them...
  - askmike 8y ago
    Yes they do, it's called a shadow profile[1]. If you're in Europe you might have some some recourse (GDPR and such), but if you're from the US you are most likely out of luck. Regardless, Facebook might have a detailed profile on you but not know your name. I doubt there is much you can do. [1]: https://theconversation.com/shadow-profiles-facebook-knows-about-you-even-if-youre-not-on-facebook-94804 https://theconversation.com/shadow-profiles-facebook-knows-a...
    - Rjevski 8y ago
      On the other hand, there's no way to log into a shadow profile, and shadow profile information is never displayed to any logged in user, so you're safe against this particular exploit.
  - stickdogg 8y ago
    If any of your other apps are connected to fb then all your info was likely granted to fb as well .
bsimpson 8y ago
It's such bullshit that they put the info into a card that disappears street the first time you read it.
zepearl 8y ago
Thx for the check-link :) I understand in general that only "pure" facebook users were impacted and that "WhatsApp" users aren't? (not sure how integrated WhatsApp is with the Facebook infrastructure - I do use WhatsApp but I don't have a Facebook account)

ryandrake 8y ago

They should not require you to log in to their site to look up whether they have victimized you. I used to have a FB account but threw the random password away. Was I affected? No way to know?

EnFinlay 8y ago
Likewise. They should send a notification to all e-mails on record for compromised accounts.
marricks 8y ago
Not to mention those of us with deleted Facebook accounts. It looks like I’m not affected but to anyone who had an account during those dates and deleted it since, how do they find out? Yet another reason they should email affected users, guess they care more about not publicizing bad information than taking responsibility.
- staticassertion 8y ago
  They explicitly state they will email impacted users.
  - coreypreston 8y ago
    Does a user with a deleted account qualify as an impacted user? I think the visibility is an issue. As one of those people, this summer I encountered a spotify issue where my spotify would randomly start playing Cannabis Club ATL. Others had the same issue. Perhaps unrelated, too difficult to tell, especially if FB doesn't consider me an active user.
    - lostlogin 8y ago
      Does a user with a deleted account qualify as an impacted user? If they still store some user details (which it seems they do) and then this leaks - absolutely. What about those who have never been users yet Facebook stores plenty of information about?
  - nabaraz 8y ago
    Does that mean they are still storing my email address? I deleted my account 2 years ago.
    - staticassertion 8y ago
      I don't know? I don't see you would be impacted without an account.
staticassertion 8y ago
I guess they may be concerned with unauthenticated users checking if others are compromised.

dhimes 8y ago

FB should timestamp these articles. It happened a couple of weeks ago, or is this new news?

crunchlibrarian 8y ago
This is new, particularly the details around search history and location data being stolen, as of an hour ago.
- what_ever 8y ago
  I think it's the security incident that happened couple of weeks ago and they have more details now?
philsnow 8y ago
Everybody should timestamp all articles. People don't want to because they want their content to be "evergreen" and they think that if there's a date that's more than a year or so old, people will disregard / discount the content. So by default many blog CMSs default to not showing the date of any articles.
- coliveira 8y ago
  Facebook is not a small blog operator. They should view this as a professional communications medium.
  - staticautomatic 8y ago
    Someone in Facebook's PR department is reading this part of the thread and saying "it's working!"
- andrewflnr 8y ago
  If your content is "evergreen", show me a "last updated" timestamp in the last year. /grump
mygo 8y ago

jxramos 8y ago

I forget what the text looks like in your second link when you're not logged in but after I logged in the verification text appears as follows: """ Is my Facebook account impacted by this security issue? Based on what we've learned so far, your Facebook account has not been impacted by this security incident. If we find more Facebook accounts were impacted, we will reset their access tokens and notify those accounts. """

godelmachine 8y ago
I see the same thing. Wonder if anyone was informed that actually had been affected.
- teovoinea 8y ago
  I have been affected, quoting text: Is my Facebook account impacted by this security issue? Yes. Based on what we've learned so far in our investigation, attackers accessed the following Facebook account information: Name. Email addresses. Phone number. Based on what we've learned so far in our investigation, the attackers did not gain access to certain information, such as: Account passwords. Payment card or credit card information.
  - thomasahle 8y ago
    Mine continues: Additionally, the attackers also accessed other account information, including: - The following information associated with your Facebook account: - Username. - Date of birth. - Gender. - Types of the devices you've used to access Facebook. - The language you choose to use Facebook in. - If you previously added this specific information to your Facebook account, it was also accessed: - Relationship status. - Religion. - Hometown. - Current city. - Work. - Education. - Website. - The 10 most recent locations you've checked in to or been tagged in. These locations are determined by the places named in the posts, such as a landmark or restaurant, not location data from a device. - The 15 most recent searches you've entered into the Facebook search bar. - People or Pages you follow on Facebook.

sctb 8y ago

Here's the discussion on the Facebook post: https://news.ycombinator.com/item?id=18202589 https://news.ycombinator.com/item?id=18202589.

hikerclimb 8y ago

the best way to keep your passwords secure is the old fashioned way. Write them down and put them in a lock box. I only access my financial information from one computer. Perhaps I am paranoid.

fjsolwmv 8y ago
True but not relevant at all to the current discussion.

clubm8 8y ago

How do I check if I've deleted Facebook? Does deleting Facebook mean I no longer have a right to know if my data was breached while I was a member?

rdtsc 8y ago
What if I never signed up. I am sure they know about me. Wonder if there is a way to request that information from them...
- askmike 8y ago
  Yes they do, it's called a shadow profile[1]. If you're in Europe you might have some some recourse (GDPR and such), but if you're from the US you are most likely out of luck. Regardless, Facebook might have a detailed profile on you but not know your name. I doubt there is much you can do. [1]: https://theconversation.com/shadow-profiles-facebook-knows-about-you-even-if-youre-not-on-facebook-94804 https://theconversation.com/shadow-profiles-facebook-knows-a...
  - Rjevski 8y ago
    On the other hand, there's no way to log into a shadow profile, and shadow profile information is never displayed to any logged in user, so you're safe against this particular exploit.
- stickdogg 8y ago
  If any of your other apps are connected to fb then all your info was likely granted to fb as well .

bsimpson 8y ago

It's such bullshit that they put the info into a card that disappears street the first time you read it.

zepearl 8y ago

Thx for the check-link :) I understand in general that only "pure" facebook users were impacted and that "WhatsApp" users aren't? (not sure how integrated WhatsApp is with the Facebook infrastructure - I do use WhatsApp but I don't have a Facebook account)