6 ms·
Why is that ridiculous? Here are the facts: 1. A software company had a security incident. 2. They urgently resolved the issue. 3. They looked into who was
by a13n 8y ago
Why is that ridiculous?
Here are the facts:
1. A software company had a security incident.
2. They urgently resolved the issue.
3. They looked into who was impacted, and sent customized notifications letting people know how they were impacted.
None of this behavior is ridiculous. It's quite responsible. What would you expect to happen differently?
- spike021 8y agoWell, let's see. A feature used to view profile information had a vulnerability that allowed an attacker to get my phone number. My phone number isn't even listed on my profile. This means the credentials from the original implementation of said feature weren't locked down to only data available from your viewable profile. While my phone number may be available elsewhere outside of FB, I only have it tied to my account as a password reset contact.
- jjeaff 8y agoThe vulnerability allowed the attacker to obtain an access token for your site. So with that access token, they presumably had full access to everything as if they were you. Hence their ability to get a phone number not listed. I'm not sure if the web interface uses those same access tokens, but the mobile app probably does. So they were probably able to access everything using unpublished API endpoints that the mobile app would normally use.
- spike021 8y agoRight, I get that. I just think, or would hope, rather, that access tokens are locked down appropriately or never "over-granted" access to unnecessary data. In this case, my phone number which isn't on my profile. If that means different API tokens for different services, then maybe that's a better way to do it. I'm not Facebook, though.
- a13n 8y ago> This means the credentials from the original implementation of said feature weren't locked down to only data available from your viewable profile. Yeah, that's the entire security incident. So are you saying you expect software companies to never have security incidents? Now that's ridiculous.
- panic 8y agoWhy is that ridiculous?
- Kalium 8y agoIt's only possible with a very different set of tradeoffs around risk and innovation than are the norm in software. It takes NASA-grade layers of slow development processes to be 100% certain that there will never be any incidents. Most companies, most developers, and most consumers would not be happy with the cost and speed this would result in. In short: it's not that it's impossible. We know how to do it. It just comes with a cost attached that nobody wants to pay.
- YetAnotherNick 8y agoLet me ask you this: Have you done any programming yourself? Facebook has some of the best information security researchers, takes bug bounty seriously, and they have got very low hacks compared to the effort hackers put to hack it.