3 ms·

Wouldn’t it be pretty simple (for FB) to create accounts with super unique password as part of their test process? Then they scan all their storeage for the sup

Wouldn’t it be pretty simple (for FB) to create accounts with super unique password as part of their test process? Then they scan all their storeage for the super unique password? Or am I missing something?

slig 8y ago
Do you know of any companies doing that?
- shshhdhs 8y ago
  Yes, I do. They’re called canaries by the security teams. It’s especially useful for when you run automated tests when pushing updates in your pipeline. Scan the logs and database entries for the canaries.
  - slig 8y ago
    Thank you, didn't know what they're called.
int_19h 8y ago
To implement, yes. But you'd have to think about this as a problem first. The very fact that we're having this discussion here now shows that it's not all that obvious, at least for your average dev. How their privacy and/or security review missed it is a more interesting question.
- shard972 8y ago
  Well combine this with them releasing a "feature" to ask users for their email passwords and you have to wonder.
- Nydhal 8y ago
  TIL facebook hires average devs.
Someone 8y ago
That test user also would have to hit every nook and cranny of their code. That’s hard, and may not be repeatably possible (some code may only run at first login, or when making your 1024th post, or if you’re posting a movie before you ever post a photo, or when a single server sees its millionth post, etc) They also would have to run it in such a way after every code update. Since every code update may introduce a new nook or cranny, that would slow down development too much. I wouldn’t even try doing that, but instead have a two-pronged defense: - code review of every single log statement in the code base by individuals whose _only_ job it is to prevent such problems. - permanent checking of every single line logged for a thousand or so common passwords. At Facebook’s scale, the second probably has lots of false positives, so I would do that at time of logging, when the location doing that logging is known, so that an alarm only gets triggered if a single log statement repeatedly logs passwords.

slig 8y ago

Do you know of any companies doing that?

shshhdhs 8y ago
Yes, I do. They’re called canaries by the security teams. It’s especially useful for when you run automated tests when pushing updates in your pipeline. Scan the logs and database entries for the canaries.
- slig 8y ago
  Thank you, didn't know what they're called.

int_19h 8y ago

To implement, yes. But you'd have to think about this as a problem first. The very fact that we're having this discussion here now shows that it's not all that obvious, at least for your average dev. How their privacy and/or security review missed it is a more interesting question.

shard972 8y ago
Well combine this with them releasing a "feature" to ask users for their email passwords and you have to wonder.
Nydhal 8y ago
TIL facebook hires average devs.

Someone 8y ago

That test user also would have to hit every nook and cranny of their code. That’s hard, and may not be repeatably possible (some code may only run at first login, or when making your 1024th post, or if you’re posting a movie before you ever post a photo, or when a single server sees its millionth post, etc) They also would have to run it in such a way after every code update. Since every code update may introduce a new nook or cranny, that would slow down development too much. I wouldn’t even try doing that, but instead have a two-pronged defense: - code review of every single log statement in the code base by individuals whose _only_ job it is to prevent such problems. - permanent checking of every single line logged for a thousand or so common passwords. At Facebook’s scale, the second probably has lots of false positives, so I would do that at time of logging, when the location doing that logging is known, so that an alarm only gets triggered if a single log statement repeatedly logs passwords.