7 ms·

Logged in today and found: "[name], we have more information about the security incident we discovered on September 25, 2018. An unauthorized third party acces

Logged in today and found: "[name], we have more information about the security incident we discovered on September 25, 2018. An unauthorized third party accessed your name, email address and phone number. We acted quickly to secure the site and took action to protect your account, and we're working closely with law enforcement to address the incident." Ridiculous.

cobookman 8y ago
Got the same message. So what's the recommended thing to do. Rotate all your passwords and security questions?
- notimetorelax 8y ago
  I guess in this case, - rotate all your names, phone numbers, and addresses. :( In all earnestness, Facebook would have required password reset if it were needed.
  - pbhjpbhj 8y ago
    If you were I've of the unlucky ones then check your security data at banks and any other place that has financial info, or ability to spend money (Amazon, etc.). More important is perhaps to warn less savvy people to be vigilant about phishing attempts.
    - pbhjpbhj 8y ago
      s/I\'ve/one
SketchySeaBeast 8y ago
> name, email address and phone number I kind of work on the assumption that those things are largely public. I mean, phone books were a thing for a very long time. Don't get me wrong, leak bad, very bad, but they didn't leak my bank accounts or a list of my worst fears.
- barkingcat 8y ago
  Did you read the article? "For 14 million people, the attackers accessed the same two sets of information, as well as other details people had on their profiles. This included username, gender, locale/language, relationship status, religion, hometown, self-reported current city, birthdate, device types used to access Facebook, education, work, the last 10 places they checked into or were tagged in, website, people or Pages they follow, and the 15 most recent searches. " The attackers accessed different info for different groups of people.
  - Joe-Z 8y ago
    FYI people will downvote you for suggesting someone hasn't read the post. (And I don't think it was necessary to make your point.) HN guidelines: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html >Please don't insinuate that someone hasn't read an article.
    - deleted 8y ago
      [deleted]
    - deleted 8y ago
      [deleted]
    - delecti 8y ago
      Hm, that's a bit of a silly rule. This isn't the best example, but there are certainly instances where someone is arguing from a point of complete ignorance about details in the article. Even the rule's preferred example of "The article mentions that." still seems to me to insinuate someone hasn't read the article.
      - jjeaff 8y ago
        I think it is just more polite to cite the article than make an accusation. There is no real benefit in accusing someone of not reading the article. This seems like a case of fostering civil discussion without losing any clarity. Since "you must not have read the article." or "did you even read the article?" adds nothing to the discussion.
a13n 8y ago
Why is that ridiculous? Here are the facts: 1. A software company had a security incident. 2. They urgently resolved the issue. 3. They looked into who was impacted, and sent customized notifications letting people know how they were impacted. None of this behavior is ridiculous. It's quite responsible. What would you expect to happen differently?
- spike021 8y ago
  Well, let's see. A feature used to view profile information had a vulnerability that allowed an attacker to get my phone number. My phone number isn't even listed on my profile. This means the credentials from the original implementation of said feature weren't locked down to only data available from your viewable profile. While my phone number may be available elsewhere outside of FB, I only have it tied to my account as a password reset contact.
  - jjeaff 8y ago
    The vulnerability allowed the attacker to obtain an access token for your site. So with that access token, they presumably had full access to everything as if they were you. Hence their ability to get a phone number not listed. I'm not sure if the web interface uses those same access tokens, but the mobile app probably does. So they were probably able to access everything using unpublished API endpoints that the mobile app would normally use.
    - spike021 8y ago
      Right, I get that. I just think, or would hope, rather, that access tokens are locked down appropriately or never "over-granted" access to unnecessary data. In this case, my phone number which isn't on my profile. If that means different API tokens for different services, then maybe that's a better way to do it. I'm not Facebook, though.
  - a13n 8y ago
    > This means the credentials from the original implementation of said feature weren't locked down to only data available from your viewable profile. Yeah, that's the entire security incident. So are you saying you expect software companies to never have security incidents? Now that's ridiculous.
freediver 8y ago
If a business model of a company is based on monetizing user data, it seems only fair that in cases like this flow of the money is reversed - from Facebook to users. Otherwise it seems that big tech has limited risk and huge upside. edit: 40acres put it more eloquently - Regulation is coming. If data is the new oil these are the oil spills that lead to the EPA.

cobookman 8y ago

Got the same message. So what's the recommended thing to do. Rotate all your passwords and security questions?

notimetorelax 8y ago
I guess in this case, - rotate all your names, phone numbers, and addresses. :( In all earnestness, Facebook would have required password reset if it were needed.
- pbhjpbhj 8y ago
  If you were I've of the unlucky ones then check your security data at banks and any other place that has financial info, or ability to spend money (Amazon, etc.). More important is perhaps to warn less savvy people to be vigilant about phishing attempts.
  - pbhjpbhj 8y ago
    s/I\'ve/one

SketchySeaBeast 8y ago

> name, email address and phone number I kind of work on the assumption that those things are largely public. I mean, phone books were a thing for a very long time. Don't get me wrong, leak bad, very bad, but they didn't leak my bank accounts or a list of my worst fears.

barkingcat 8y ago
Did you read the article? "For 14 million people, the attackers accessed the same two sets of information, as well as other details people had on their profiles. This included username, gender, locale/language, relationship status, religion, hometown, self-reported current city, birthdate, device types used to access Facebook, education, work, the last 10 places they checked into or were tagged in, website, people or Pages they follow, and the 15 most recent searches. " The attackers accessed different info for different groups of people.
- Joe-Z 8y ago
  FYI people will downvote you for suggesting someone hasn't read the post. (And I don't think it was necessary to make your point.) HN guidelines: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html >Please don't insinuate that someone hasn't read an article.
  - deleted 8y ago
    [deleted]
  - deleted 8y ago
    [deleted]
  - delecti 8y ago
    Hm, that's a bit of a silly rule. This isn't the best example, but there are certainly instances where someone is arguing from a point of complete ignorance about details in the article. Even the rule's preferred example of "The article mentions that." still seems to me to insinuate someone hasn't read the article.
    - jjeaff 8y ago
      I think it is just more polite to cite the article than make an accusation. There is no real benefit in accusing someone of not reading the article. This seems like a case of fostering civil discussion without losing any clarity. Since "you must not have read the article." or "did you even read the article?" adds nothing to the discussion.

a13n 8y ago

Why is that ridiculous? Here are the facts: 1. A software company had a security incident. 2. They urgently resolved the issue. 3. They looked into who was impacted, and sent customized notifications letting people know how they were impacted. None of this behavior is ridiculous. It's quite responsible. What would you expect to happen differently?

spike021 8y ago
Well, let's see. A feature used to view profile information had a vulnerability that allowed an attacker to get my phone number. My phone number isn't even listed on my profile. This means the credentials from the original implementation of said feature weren't locked down to only data available from your viewable profile. While my phone number may be available elsewhere outside of FB, I only have it tied to my account as a password reset contact.
- jjeaff 8y ago
  The vulnerability allowed the attacker to obtain an access token for your site. So with that access token, they presumably had full access to everything as if they were you. Hence their ability to get a phone number not listed. I'm not sure if the web interface uses those same access tokens, but the mobile app probably does. So they were probably able to access everything using unpublished API endpoints that the mobile app would normally use.
  - spike021 8y ago
    Right, I get that. I just think, or would hope, rather, that access tokens are locked down appropriately or never "over-granted" access to unnecessary data. In this case, my phone number which isn't on my profile. If that means different API tokens for different services, then maybe that's a better way to do it. I'm not Facebook, though.
- a13n 8y ago
  > This means the credentials from the original implementation of said feature weren't locked down to only data available from your viewable profile. Yeah, that's the entire security incident. So are you saying you expect software companies to never have security incidents? Now that's ridiculous.

freediver 8y ago

If a business model of a company is based on monetizing user data, it seems only fair that in cases like this flow of the money is reversed - from Facebook to users. Otherwise it seems that big tech has limited risk and huge upside. edit: 40acres put it more eloquently - Regulation is coming. If data is the new oil these are the oil spills that lead to the EPA.