4 ms·

Here we go... the slow trickle of them saying every few days that the data breach is MUCH worse than what they had said days ago. Boil the frog. 1 month from n

by atonse 8y ago

Here we go... the slow trickle of them saying every few days that the data breach is MUCH worse than what they had said days ago. Boil the frog. 1 month from now, compare what they've said to what they said this week.

Bartweiss 8y ago
Among other interesting things, this was initially sold as an attack that enabled 'View As' for attackers who shouldn't have had access to it. It's been described like another issue in the same vein as Cambridge Analytica and Google+. I don't doubt that setting was involved, but it's obvious by now that this wasn't equivalent to the others - there's no "View As" which will show you someone's search and location history. This isn't just a public/private breakdown but an actual breach of Facebook's internal-only data, and unlike the prior stories this ought to seriously challenge people's reliance on features like Facebook-based app sign-ins.
- fcarraldo 8y ago
  I’m not sure this is entirely true. The hack was reported to have exploited a flaw in the View As feature to retrieve user access tokens. With an access token, a user can view their own location history. This isn’t internal-only data, but it is supposed to be private to the user.
- iodiniemetra 8y ago
  > there's no "View As" which will show you someone's search and location history Not in the UI, no. But once you have the token, which is what this was, then you can request that from many of the UI API interfaces facebook provides. When this first leaked, anyone who worked with auth systems immediately assumed it was a game over scenario.
  - Bartweiss 8y ago
    Interesting, thanks. I had only followed general-consumption reports here, and hadn't seen that the attack involved obtaining a token that allowed the attacker to authenticate as the user, and I didn't realize that the API included support for pulling search history data. Given that, I understand much better why this was a disaster from the beginning, and why people are so mistrustful of the rolling "and also this..." disclosures.
paulcole 8y ago
Except they're going backwards this time. First they said, "exposure of information from nearly 50 million of its users" and now it's "directly affected 29 million people on the social network". John Gruber claimed the same thing a couple weeks ago: https://daringfireball.net/linked/2018/09/28/facebook-hack https://daringfireball.net/linked/2018/09/28/facebook-hack Surprisingly quiet this time since it doesn't fit the narrative he wanted.
- Scoundreller 8y ago
  It’s a cumulative thing. Each time you load the page, it’s a separate publication about a different 50 million /s.
  - jen729w 8y ago
    You’re joking, but I came here to ask “which breach is this one referring to”, and was going to suggest assigning them each a serial number. It’s just getting too hard to track, and FB sure isn’t going to go out of its way to make the numbers comprehensible.

by atonse 8y ago

Bartweiss 8y ago

Among other interesting things, this was initially sold as an attack that enabled 'View As' for attackers who shouldn't have had access to it. It's been described like another issue in the same vein as Cambridge Analytica and Google+. I don't doubt that setting was involved, but it's obvious by now that this wasn't equivalent to the others - there's no "View As" which will show you someone's search and location history. This isn't just a public/private breakdown but an actual breach of Facebook's internal-only data, and unlike the prior stories this ought to seriously challenge people's reliance on features like Facebook-based app sign-ins.

fcarraldo 8y ago
I’m not sure this is entirely true. The hack was reported to have exploited a flaw in the View As feature to retrieve user access tokens. With an access token, a user can view their own location history. This isn’t internal-only data, but it is supposed to be private to the user.
iodiniemetra 8y ago
> there's no "View As" which will show you someone's search and location history Not in the UI, no. But once you have the token, which is what this was, then you can request that from many of the UI API interfaces facebook provides. When this first leaked, anyone who worked with auth systems immediately assumed it was a game over scenario.
- Bartweiss 8y ago
  Interesting, thanks. I had only followed general-consumption reports here, and hadn't seen that the attack involved obtaining a token that allowed the attacker to authenticate as the user, and I didn't realize that the API included support for pulling search history data. Given that, I understand much better why this was a disaster from the beginning, and why people are so mistrustful of the rolling "and also this..." disclosures.

paulcole 8y ago

Except they're going backwards this time. First they said, "exposure of information from nearly 50 million of its users" and now it's "directly affected 29 million people on the social network". John Gruber claimed the same thing a couple weeks ago: https://daringfireball.net/linked/2018/09/28/facebook-hack https://daringfireball.net/linked/2018/09/28/facebook-hack Surprisingly quiet this time since it doesn't fit the narrative he wanted.

Scoundreller 8y ago
It’s a cumulative thing. Each time you load the page, it’s a separate publication about a different 50 million /s.
- jen729w 8y ago
  You’re joking, but I came here to ask “which breach is this one referring to”, and was going to suggest assigning them each a serial number. It’s just getting too hard to track, and FB sure isn’t going to go out of its way to make the numbers comprehensible.